-7

I would like to create a honeypot (bot) to hunt browser zero-days (and browser extensions). What is the best way to find those 0days automatically (I would like to create a sandboxed bot which would visit websites and check if they are trying to exploit browser vulnerability). I think that just to sandbox this bot and attach a debugger would not be enough.

Is there anything else that I should consider?

My inspiration was this article from corelan.be: The Honeypot Incident – How strong is your UF (Reversing FU) from 2011.

If exploit is well-written and well-tested than nothing should crash and hence attached debugger would be pretty useless?


The idea is that we have our honeypot which would detect zero-days. It should be done by visiting websites, clicking on links, just imitating usual user behaviour. Our honeypot is actually a bot. Our bot is not allowed to download any executable binaries (we still want to be able to open PDF documents, Excel spreadsheets in a browser (Google Chrome allows it)). This is a hard task because we need to detect something undetectable, so we need to detect by its traces and by deduction.

If we detect any outgoing requests from our machine e.g. to C&C-server or detect some malware (we will use behaviour based malware detection, because we cannot detect just some hardcoded signatures, but we need to keep in mind that is very resource consuming), then we know, that we forbid to download & execute any executables and thus the only way to infect that sandboxed machine was through a zero-day.

Thus we need to keep track of memory states (memory dumps every X seconds, but is obviously very resource consuming), we need to create log files, execute our browsers in debug modes to trace even more. Because if we detect some strange behaviour on our machine, we need to check an initial data for traces of a zero-day, because it would be the only way how attackers were able to intrude into the system.

I think this is the only way reasonable in detecting it without to execute any executables (click_me_to_see_secret_documents.exe, would be too easy).


EDIT:

Here is nice tool advised from AV researcher: https://buffer.github.io/thug/

Here is a doc: https://buffer.github.io/thug/doc/

The number of client-side attacks has grown significantly in the past few years shifting focus on poorly protected vulnerable clients. Just as the most known honeypot technologies enable research into server-side attacks, honeyclients allow the study of client-side attacks. A complement to honeypots, a honeyclient is a tool designed to mimic the behavior of a user-driven network client application, such as a web browser, and be exploited by an attacker’s content.

Here is a somewhat similar question (but with less technical details): Recommendations for honeypot software


Take as an example Google Chrome browser, on Windows 10. And explain how you would set up such a honeypot.

closed as too broad by Steffen Ullrich, MechMK1, Conor Mancone, schroeder Sep 2 at 15:07

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 5
    The time when 0days where used in mass-attacks against browsers seems to be currently over and hopefully never comes back. It was easy in the past because of insecure technologies like Java, Flash and ActiveX and because the browser were not hardened enough. This has fortunately changed. - Apart from that I still think that the question is too broad. You might think that it cannot be that hard to implement what you want and therefore feel it is not too broad. I think it is very complex and that's why I consider your question as too broad. – Steffen Ullrich Sep 2 at 13:21
  • 2
    I know you are only asking about browsers. That is still very broad. Different browsers, different classes of vulnerabilities, different detection techniques... – Conor Mancone Sep 2 at 14:53
  • 3
    Let me break this down for you. This is your question: "What is the best way to find [unspecified, undefined, unscoped] 0days [in any browser] automatically?" Yes, that is too broad. The best way to find 0-days is not to blindly hunt for the potential for some unknown exploit in the wild to teach you how their 0-day works. You do that by looking at the code of the browser. To do what you want to do would require such a broad spectrum of preparation for all the differrent things that could go wrong in any one browser. Explaining all that would take more than an answer could provide. – schroeder Sep 2 at 15:06
  • 2
    I take issue with your latest edit to answer your question. Other than the fact that it violates the spirit of this site, your latest edit doesn't actually answer your question. You've referenced a honeypot client, which is a fine concept that I'm sure google and others likely use to detect malicious websites. However, that doesn't address the issue of finding zero days, which is what the bulk of your question was about. – Conor Mancone Sep 19 at 12:39
  • 2
    I mean, if you're going to try to answer your question with an edit, you should make sure you at least actually answer your question... – Conor Mancone Sep 19 at 12:40
4

If I had the means to automatically detect a 0-day exploit in a piece of software, the vendor of that software has the same potential, thus these exploits would be caught before the software was ever released.

Such things are done, of course, and they are called Source Code Analysis. They do exactly what you are trying to do: Automatically look for potential vulnerabilities and flag them. Developers then fix these vulnerabilities.

If exploit is well-written and well-tested than nothing should crash and hence attached debugger would be pretty useless?

You don't understand what a debugger does. A debugger doesn't "prevent" an exploit from happening. A debugger shows the internal state of an application as it runs, allowing you to better understand how the application works.

This is used in two scenarios: Debugging and Reverse Engineering.

What is debugging?

Debugging is the process of finding erroneous behavior in a program and finding the root cause of it. In order to do that, a developer uses a debugger to watch the execution of a program step-by-step, and compares the actual state of the program with the expected state of a program.

For instance, if a program rejects an input as erroneous, even though it should be accepted as valid, a developer can go through the function that makes this decision and find out exactly where the program makes a "wrong" decision and then fix this problem.

What is reverse engineering?

Reverse Engineering (also shortened as "RE") is the process of figuring out what exactly what a program with unknown source code is doing. This is done for a variety of reasons. To figure out if a program is (not) doing something specific, or to gather some other internal information.

"Reversers" use debuggers to reveal the same internal state of the program, but without access to the source code.

  • In Germany we say "Am Thema vorbei" (missed the topic). In you answer you're describing wrong things. Question was not about debugging, static/dynamic analysis, RE and stuff. It was about getting some tips how to setup a honeypot to catch browser based exploits - sandbox usage, logging, starting browsers in debug mode, just some general ideas what to consider without unnecessary going into details. Instead you're writing about what is RE, etc. It's a bit annoying. Yes, debugger can track an internal state, you're right here. But I think it is a not so easy to use to detect used exploits. – notyourdolly Sep 2 at 13:17
  • Because you need to check debug log files automatically or manually and compare them to normal browser execution, so you need somehow to detect the difference in browser behaviour – notyourdolly Sep 2 at 13:18
  • corelan was able to detect it. So how it comes that you're saying it is not possible? you can detect malware (delivered by some 0day) by their behaviour: if they're connecting to C&C servers, installing rootkits or something else. – notyourdolly Sep 2 at 13:21
  • @MechMK1 some anti-viruses are using behaviour based approach, example: github.com/scVENUS/PeekabooAV (it scans email attachments, but we are talking in general, so if it works here it can be applied also for other software) – notyourdolly Sep 2 at 13:28
  • "Behaviour Based Malware Detection" – notyourdolly Sep 2 at 13:31

Not the answer you're looking for? Browse other questions tagged or ask your own question.