1

I have been developing a simple honeypot system.

Configuration of the honeypot system is : 1. Main router R has two parts: part A and B. 2. Part A is turned off and part B is set as a DMZ with a single PC running on Windows 7. 3. Part B PC has a deactivated antivirus. Access to hard drive partitions are configured to ReadOnly, except OS partition.

Now, my question is how can I freeze (for analysis) a malware, assuming bots/hackers are sending malware/spyware? I mean how can I store the binary of the virus/malware which has been sending by the attacker before it executes. And how can I log the attacks?

3

Logging attackers will be highly dependent on how you set up the honeypot system you describe. What methods you expect (or don't expect) attackers to use to acquire access and what they do within the system there.

Secondly you will need a method of identifying malware. How in depth you want to set up logging on the operating system is up to you here. You can log a lot of things... You have to draw the line somewhere.

As for quarantining malware for analysis, the accepted method is to archive or encrypt it. The professional community prefers the encryption method because only the researcher who encrypted it can decrypt it (avoiding the whole "Hey! whats in here?" problem with archives with no password).

Encrypted malware can be safely transported to the analysis machine for debugging and examination. The analysis machine should be a VM. This way once the analysis is complete, the VM is simply nuked from orbit and restored, ready for the next test. The reason we do it this way is to avoid missing a piece of malware somewhere and contaminating a subsequent analysis.

Hope this helps!

EDIT:

I missed the bit where you state "freezing the malware before it executes". You can't. You can use the same heuristics and detection as the antivirus to get known malware before it runs. But then, it's known. Why would you want to analyze these. The unknown ones are, by definition, unknown. Therefore there will be no reliable way to stop them. You will only know after the fact they are malware.

I think a better way to do this would be to replace your windows7 component with a VM in the DMZ, then you can isolate and encrypt the malware through whatever method you wish and then transport it for analysis. Then nuke the DMZ VM and replace it with a fresh version along with your analysis VM. This way, you always revert to the same uninfected configuration. You can also activate the antivirus in the DMZ VM and set it to only quarantine in the case you wish to analyze known malware also.

  • For detection of attack, I am using antivirus. It is defined to quarantine the malicious files. I want to log the method (eg. FTP, TFTP, source IP-masked IP is ok) used by the attacker in order to deliver the malware. If the malware/spyare is unknown, then is this possible to detect abnormal activities through constant monitoring? I am saying abnormal in the sense that I know PC is not being used by any user. So, given this situation, is this possible to detect something which is not normal? And yes it is good to use VM. – Shamindra Parui Jun 24 '17 at 18:24
  • If no one but you will be using the computer ever you may be able to apply an advanced security audit policy in windows 7. This wiki article from Microsoft covers the basics: social.technet.microsoft.com/wiki/contents/articles/… and should point you in the right directions. What you might have to do is audit network activity and file access activity and associate them by the time stamps. The more logging you do, the more the VM will fill with logs. Its not easy to pin point any possible attack though. – Nalaurien Jun 24 '17 at 19:01
2

I would advice virtual environment or a reboot and restore software like deep freeze. You can record execution using sysinternals or recording facility of your virtualization provider. Be advised that certain recent malware especially ATPs check for virtualization before executing. For a malware to infect or propagate you'll need vulnerable service or software in listening state. How do you plan to have malware find your Honeypot? As far as network traffic goes, a simple syslog should suffice. Search around for SANS articles on building a Honeypot. I hope this helps. Please do let everyone know that know your final design and Implimentation. Lastly, instead of disabling antivirus, wouldn't it be better not have it installed in the first place?

  • I am publishing my network within an IRC and linking it with random ad-services. If I disable AV then how can I detect successful attack? My intention is to detect the (previously known to AV) attack and collect the spyware executable for autopsy. Correct me if my goals are not feasible. – Shamindra Parui Jun 24 '17 at 18:44
  • 1
    If your goal is to solely collect known malware files, why don't you use lists like malwaredomainlist and others to directly download the executable. I see no problem with your goals. :) – Parth Maniar Jun 25 '17 at 6:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.