The Honeynet ProjectAdvancements in HoneypotTools课件.pptVIP

The Honeynet ProjectAdvancements in HoneypotTools Presented by Kirby Kuehl Background Feel free to ask questions during presentation. Email: kkuehl@ Websites: About the Honeynet Project Informally began as the Wargames mailing list in 1999. Project officially formed in 2000. Became a Non-profit organization in 2001. Consists of 30 members who volunteer their time and resources to research the hacker community. Honeynet Project Goals Learn the Tools, Tactics, and Motives of the Hacker Community Raise Awareness through release of “Know Your Enemy” series of whitepapers. Teach and Inform Scan of the Month Challenges Reverse Challenge Forensic Challenge Research Honeynet Alliance Tool Development Generation II Honeynet Sensor Components: The Bridging Firewall Counting and Blocking Connections Improvements Data Control with Snort-Inline Sebek kernel module Honeyd and arpd Sneak Peak of “The Honeywall CD” Honeynet Data Control The Linux Bridging Firewall Bridges are Layer 2 devices that connect two or more distinct Ethernet segments. All packets received by one interface are transparently copied to the other interface based upon MAC address. A Bridging Firewall is capable of transparently filtering received frames before they are copied to the second interface. Requires a Linux kernel compiled with bridge and bridge firewall support. See / for kernel patches and more information. Honeynet Data ControlMethod 1: Counting and Blocking Connections IPTables Firewall Script uses the LOG and ACCEPT targets for all inbound connections allowing attackers to enter the honeynet. The IPTables Firewall Script LOGs and ACCEPTs outbound connections until a predefined limit is reached within a specified timeframe. Connection attempts beyond the limit are DROPped. Example Data Control Firewall Script /papers/honeynet/tools/rc.firewall Honeynet Data ControlMethod 2: Snort-Inline The Honeynet Project utilizes Snort-Inline in combination with netfilter/iptables operating