Abstract:
A Honeypot is an Internet-attached server designed to detect and monitor the activities of computer hackers. HoneyNet is a network of these honeypots with high interaction design. CUHK has launched the HoneyNet project since June 2002. This seminar reviews some findings from this HoneyNet project, which include hacking techniques, hackers's activities after break-ins, and some general hackers' behaviors. Some hackers' activities will be described and illustrated with live demonstrations through scene reconstruction. Forensic techniques used to examine the data obtained from the HoneyNet will also be discussed.

Seminar Outline:

1. Objectives of our Honeynet
2. What is a Honeynet and how it works
3. Hackers' Activities (with live demo)
4. Forensic Tools
5. How Honeynet May Help E-banking
6. Future Development
7. Q & A

Presentation Slides ([PPT|PDF])

Some hacking patterns from captured packets

• A ssh CRC32 overflow NOOP attack
• Creating backdoor accounts in a root shell access
• An Apache/mod_ssl Worm attack
• A wuftpd break-in and backdoor setup

Hackers' keystroke

• A hacker keystroke record
  
  • sneak in by a backdoor account
  • Get root access by sudo
  • Check around the honeypot environment
  • Download a root kit and intsall it
  • Disable the honeypot anonymous ftp so as to keep out other hackers.
• A hacker started up a IRC bot
• A hacker killed other hacker backdoor daemon
• A hacker checked out other hackers' IRC bot and backdoors, and then kill them
• A hacker wiped out log entries
• A hacker mass openssl scanned to other network and try to attack
• A hacker launch a DoS attack
• A hacker installed rootkit which check for other rootkit

Some hackers' startup scripts

• Startup ssh backdoor daemon, disguise it as portmap daemon, and startup sniffer program
• Startup ssh backdoor daemon, disguise it as java daemon, and startup sniffer program
• Startup trojan daemon, hide it, and send reboot e-mail back
• Startup ssh backdoor daemon and hide it

Hacker conversation from IRC data capture

• HoneyNet Project at www.honeynet.org
• SNORT NIDS
• Honeypots: Tracking Hackers
• Forensics tools on UNIX
• The Coroner's Toolkit (TCT)
• Internet Storm Center
• CERT