If you’re a target for either financially motivated cyber criminals, or nation state grade attackers, chances are your security team feels outgunned. Deception technology excels at detecting these attacks by shifting the cognitive, economic and time costs of the attack back onto the attacker. The principles of deception have been around for years, and recently, they’ve become the secret weapon of purple teams and threat hunters worldwide. Here’s the good new — You can start seeing the benefits of deception for free using open source honeypots that can be deployed immediately.
\nDeception is so crucial to detecting lateral movement, uncovering privilege escalation, and building threat intelligence, that any deception, even open-source honeypots are valuable. Whenever we’re on the road, we make it a point to give a shout-out to some of these tools, and will happily help you plan how you can use them. And we’ll do this for free, no strings attached. Just get in touch!
\nCaveat Emptor: You get what you pay for — Some of these tools may no longer be supported, and will require leg-work to setup and see results. However, they’re a great way to get familiar with deception. They’re also emulations, not real systems, so don’t expect high-interaction activity. While we’ll offer friendly advice around how you can use them, we don’t officially support them.
\nFor more on planning effective deception, check out our strategy focused blog-posts:
\nSetting up most of these open source honeypots in a lab should be a fairly simple weekend project for seasoned security professionals. You can then run red-team style attacks against them to understand what sort of telemetry you can expect. Finally, you can tweak the source to reduce how easily they can be fingerprinted (don’t forget to submit patches to the authors if you do).
\nIf you’d like to take the next step with professional deception technology, check out our IllusionBLACK platform by seeing a live demo.
\n","excerpt":"If you’re a target for either financially motivated cyber-criminals, or nation-state grade attackers, chances are your security team feels outgunned. Deception technology excels at detecting these attacks by shifting the cognitive, economic and time costs of the attack back onto the attacker.\n","slug":"practical-honeypots-a-list-of-open-source-deception-tools-that-detect-threats-for-free","date":"2017-09-20T12:18:42.000Z","status":"publish","modified":"2020-09-14T06:17:12.000Z","wordpress_id":16927,"featured_media":{"id":"fe9a8c35-b0a3-525e-b272-29dd6f0cbf3b","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2017/09/Open-source-honeypots-Smokescreen.jpeg","alt_text":"Open source honeypots","large":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAANABQDASIAAhEBAxEB/8QAFwAAAwEAAAAAAAAAAAAAAAAAAAIDBf/EABQBAQAAAAAAAAAAAAAAAAAAAAD/2gAMAwEAAhADEAAAAdyTzAUP/8QAFhABAQEAAAAAAAAAAAAAAAAAEAEC/9oACAEBAAEFAq6f/8QAFBEBAAAAAAAAAAAAAAAAAAAAEP/aAAgBAwEBPwE//8QAFBEBAAAAAAAAAAAAAAAAAAAAEP/aAAgBAgEBPwE//8QAFBABAAAAAAAAAAAAAAAAAAAAIP/aAAgBAQAGPwJf/8QAGBAAAwEBAAAAAAAAAAAAAAAAAAERECH/2gAIAQEAAT8haFudDef/2gAMAwEAAgADAAAAEEPP/8QAFBEBAAAAAAAAAAAAAAAAAAAAEP/aAAgBAwEBPxA//8QAFBEBAAAAAAAAAAAAAAAAAAAAEP/aAAgBAgEBPxA//8QAGhAAAwADAQAAAAAAAAAAAAAAAAERECFBMf/aAAgBAQABPxCSvwlLzgno0R4Ez//Z","aspectRatio":1.5037593984962405,"src":"/static/03cd33bfc3eac071715696dc4b64baf3/14b42/Open-source-honeypots-Smokescreen.jpg","srcSet":"/static/03cd33bfc3eac071715696dc4b64baf3/f836f/Open-source-honeypots-Smokescreen.jpg 200w,\n/static/03cd33bfc3eac071715696dc4b64baf3/2244e/Open-source-honeypots-Smokescreen.jpg 400w,\n/static/03cd33bfc3eac071715696dc4b64baf3/14b42/Open-source-honeypots-Smokescreen.jpg 800w,\n/static/03cd33bfc3eac071715696dc4b64baf3/47498/Open-source-honeypots-Smokescreen.jpg 1200w,\n/static/03cd33bfc3eac071715696dc4b64baf3/0e329/Open-source-honeypots-Smokescreen.jpg 1600w,\n/static/03cd33bfc3eac071715696dc4b64baf3/eeda9/Open-source-honeypots-Smokescreen.jpg 1650w","srcWebp":"/static/03cd33bfc3eac071715696dc4b64baf3/58556/Open-source-honeypots-Smokescreen.webp","srcSetWebp":"/static/03cd33bfc3eac071715696dc4b64baf3/61e93/Open-source-honeypots-Smokescreen.webp 200w,\n/static/03cd33bfc3eac071715696dc4b64baf3/1f5c5/Open-source-honeypots-Smokescreen.webp 400w,\n/static/03cd33bfc3eac071715696dc4b64baf3/58556/Open-source-honeypots-Smokescreen.webp 800w,\n/static/03cd33bfc3eac071715696dc4b64baf3/99238/Open-source-honeypots-Smokescreen.webp 1200w,\n/static/03cd33bfc3eac071715696dc4b64baf3/7c22d/Open-source-honeypots-Smokescreen.webp 1600w,\n/static/03cd33bfc3eac071715696dc4b64baf3/36d36/Open-source-honeypots-Smokescreen.webp 1650w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAANABQDASIAAhEBAxEB/8QAFwAAAwEAAAAAAAAAAAAAAAAAAAIDBf/EABQBAQAAAAAAAAAAAAAAAAAAAAD/2gAMAwEAAhADEAAAAdyTzAUP/8QAFhABAQEAAAAAAAAAAAAAAAAAEAEC/9oACAEBAAEFAq6f/8QAFBEBAAAAAAAAAAAAAAAAAAAAEP/aAAgBAwEBPwE//8QAFBEBAAAAAAAAAAAAAAAAAAAAEP/aAAgBAgEBPwE//8QAFBABAAAAAAAAAAAAAAAAAAAAIP/aAAgBAQAGPwJf/8QAGBAAAwEBAAAAAAAAAAAAAAAAAAERECH/2gAIAQEAAT8haFudDef/2gAMAwEAAgADAAAAEEPP/8QAFBEBAAAAAAAAAAAAAAAAAAAAEP/aAAgBAwEBPxA//8QAFBEBAAAAAAAAAAAAAAAAAAAAEP/aAAgBAgEBPxA//8QAGhAAAwADAQAAAAAAAAAAAAAAAAERECFBMf/aAAgBAQABPxCSvwlLzgno0R4Ez//Z","aspectRatio":1.5066666666666666,"src":"/static/03cd33bfc3eac071715696dc4b64baf3/32fd5/Open-source-honeypots-Smokescreen.jpg","srcSet":"/static/03cd33bfc3eac071715696dc4b64baf3/06e94/Open-source-honeypots-Smokescreen.jpg 113w,\n/static/03cd33bfc3eac071715696dc4b64baf3/07ab6/Open-source-honeypots-Smokescreen.jpg 225w,\n/static/03cd33bfc3eac071715696dc4b64baf3/32fd5/Open-source-honeypots-Smokescreen.jpg 450w,\n/static/03cd33bfc3eac071715696dc4b64baf3/4a838/Open-source-honeypots-Smokescreen.jpg 675w,\n/static/03cd33bfc3eac071715696dc4b64baf3/9842e/Open-source-honeypots-Smokescreen.jpg 900w,\n/static/03cd33bfc3eac071715696dc4b64baf3/eeda9/Open-source-honeypots-Smokescreen.jpg 1650w","srcWebp":"/static/03cd33bfc3eac071715696dc4b64baf3/b8a88/Open-source-honeypots-Smokescreen.webp","srcSetWebp":"/static/03cd33bfc3eac071715696dc4b64baf3/3a3bf/Open-source-honeypots-Smokescreen.webp 113w,\n/static/03cd33bfc3eac071715696dc4b64baf3/975bf/Open-source-honeypots-Smokescreen.webp 225w,\n/static/03cd33bfc3eac071715696dc4b64baf3/b8a88/Open-source-honeypots-Smokescreen.webp 450w,\n/static/03cd33bfc3eac071715696dc4b64baf3/761da/Open-source-honeypots-Smokescreen.webp 675w,\n/static/03cd33bfc3eac071715696dc4b64baf3/210c1/Open-source-honeypots-Smokescreen.webp 900w,\n/static/03cd33bfc3eac071715696dc4b64baf3/36d36/Open-source-honeypots-Smokescreen.webp 1650w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"9257cd1e-ca7f-578b-a2dd-9c2e74282caf","name":"Smokescreen Team"}}},{"node":{"id":"f97c1999-2d51-531f-96b6-fb52e7dd7acc","title":"In Defence of Signatures – They Don’t Suck","content":"You’ve heard it before — Signatures suck.
\nThis trope is so common that you even have RFPs specifically banishing signatures as if they’re some shameful pariah step-child.
\nIt’s a Friday evening, so we’ve decided to step up and defend the undefended. As is typical in our hype-fuelled industry, there’s more to be explored and understood here.
\nIt’s a matter of language. You see, signatures are far from bad. Their miserable reputation stems from the company they kept in school — that nasty second word, ‘detection’.
\nLet’s get this out of the way — ‘detecting’ stuff with static signatures is usually, always A Bad Thing (™), but ‘identifying’ stuff with signatures actually rocks. Very hard.
\nHere’s an experiment. You’ve been given a 10 GB PCAP. There are (at least) three attacks going on. How are you going to identify what they are?
\nGo on… dice that baby like Martin Yan with Wireshark… whip out your hex-editor, conjure up your disassembler, use Solarized as a colorscheme if you’re getting really hardcore. Time yourself, you maestro of packets…
\nNow go: snort -r foo.pcap
In this case, you’re detecting AND identifying the bad stuff with signatures. A small modification to the attack would obviously mean you miss detecting it (very bad).
\nHowever, if you have an alternate detection approach (e.g. behaviour, deception, anomaly detection, in this case, perhaps Bro-IDS), then signatures become very useful for the ‘identification‘ part. They let you very quickly pull out things that we already know are bad.
\nYou don’t see DFIR folks hating on Yara do you? Of course not… it’s using signatures to identify what we already know is bad (if you’re using it for detection, that’s a problem).
\nSo signatures rock. That’s right, we said it. They’re like selfie sticks — to be used at an appropriate time.
\nOkay, so besides hating on the brittle-ness of detection, what else do people dislike about signatures?
\nThere’s that old antivirus bug-bear of ‘updates’ — thousands of endpoints slavishly pulling down the latest sigs. Very 90’s.
\nOnce again, this doesn’t matter if you’re doing centralised identification. You’ve got (probably) a single system pulling down a daily update, or some solution up in the cloud. As long as it’s not pushing stuff to your nodes and chewing bandwidth, why do you care?
\nThat signature update is going to take the hard work off your analysts to instantly identify stuff that we already know how to deal with. Suddenly sounds like a winning proposition.
\nAsk your DFIR rockstar what’s the first place she goes with a shiny new malware sample. Chances are, you’ll hear VirusTotal (yeah, yeah, caveats of non-sharing samples, and in-house analysis platforms aside).
\nSure, there’s a lot of heuristics and fancy detection mechanisms on there now, but often she’s just looking for that quick flag on ‘Riskware/PsExec’. What’s wrong with that?
\nFun thought: Why do so many vendors that claims behavioural / ML / what-have-you approaches finally plug into everyone’s favourite multi-AV scanner? Beyond the marketing hype, there’s definitely signatures involved.
\nSo somewhat tongue-in-cheek, let’s all promise to insist that solutions use signatures for identification, and restore them to their rightful place in the cybersecurity pantheon.
\nTo all the IDS and malware analysts sweating away over unique byte sequences — we salute you!
\nNext week: We defend MD5 and PERL scripts /sarcasm.
\nDisclosure #1: Smokescreen only ever detects stuff with deception because that’s just how we like to roll; but of course we love using signatures to identify naughty things. Ignoring them would be plain stupid. We do, however, really enjoy arguing against conventional wisdom.
\nDisclosure #2: Smokescreen doesn’t actually believe there’s ever an appropriate time for selfie sticks. Unfortunately, our head of engineering disagrees.
\n","excerpt":"Signatures take a beating in most conversations in security. What, if anything, are they actually good for, then? Team Smokescreen stands up for the rights of the humble signature, explaining why they’re misapplied and how to better use them for defence\n","slug":"signatures-rock-defending-a-cybersecurity-whipping-boy","date":"2017-09-15T19:09:27.000Z","status":"publish","modified":"2020-12-29T04:54:10.000Z","wordpress_id":16920,"featured_media":{"id":"d1c3c2bb-1c00-5605-a9e9-1f37683e94bc","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2017/09/fingerprint.jpg","alt_text":"Signatures can be extremely useful when used right.","large":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAANABQDASIAAhEBAxEB/8QAFgABAQEAAAAAAAAAAAAAAAAAAAUE/8QAFQEBAQAAAAAAAAAAAAAAAAAAAQP/2gAMAwEAAhADEAAAAYVCdoZZQV//xAAZEAADAQEBAAAAAAAAAAAAAAABAgMAERL/2gAIAQEAAQUCVfRpILPKeF6lxv/EABgRAAIDAAAAAAAAAAAAAAAAAAECEBEh/9oACAEDAQE/AWDXkf/EABURAQEAAAAAAAAAAAAAAAAAAAEQ/9oACAECAQE/ASf/xAAXEAADAQAAAAAAAAAAAAAAAAAAEBEB/9oACAEBAAY/AnSav//EABoQAQACAwEAAAAAAAAAAAAAAAEAEBEhMUH/2gAIAQEAAT8hYAi9xs9pDHSY46r/2gAMAwEAAgADAAAAEL/P/8QAFhEBAQEAAAAAAAAAAAAAAAAAARBB/9oACAEDAQE/EGHE/8QAFxEBAAMAAAAAAAAAAAAAAAAAARARIf/aAAgBAgEBPxBFbH//xAAbEAEAAgIDAAAAAAAAAAAAAAABABEhMUFRYf/aAAgBAQABPxAu7VqpUw1e1juYxUsg0GXDWe47n//Z","aspectRatio":1.5384615384615385,"src":"/static/1e9030bcb015fe2dbbc34531d6dbe086/14b42/fingerprint.jpg","srcSet":"/static/1e9030bcb015fe2dbbc34531d6dbe086/f836f/fingerprint.jpg 200w,\n/static/1e9030bcb015fe2dbbc34531d6dbe086/2244e/fingerprint.jpg 400w,\n/static/1e9030bcb015fe2dbbc34531d6dbe086/14b42/fingerprint.jpg 800w,\n/static/1e9030bcb015fe2dbbc34531d6dbe086/32a41/fingerprint.jpg 923w","srcWebp":"/static/1e9030bcb015fe2dbbc34531d6dbe086/58556/fingerprint.webp","srcSetWebp":"/static/1e9030bcb015fe2dbbc34531d6dbe086/61e93/fingerprint.webp 200w,\n/static/1e9030bcb015fe2dbbc34531d6dbe086/1f5c5/fingerprint.webp 400w,\n/static/1e9030bcb015fe2dbbc34531d6dbe086/58556/fingerprint.webp 800w,\n/static/1e9030bcb015fe2dbbc34531d6dbe086/cddad/fingerprint.webp 923w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAANABQDASIAAhEBAxEB/8QAFgABAQEAAAAAAAAAAAAAAAAAAAUE/8QAFQEBAQAAAAAAAAAAAAAAAAAAAQP/2gAMAwEAAhADEAAAAYVCdoZZQV//xAAZEAADAQEBAAAAAAAAAAAAAAABAgMAERL/2gAIAQEAAQUCVfRpILPKeF6lxv/EABgRAAIDAAAAAAAAAAAAAAAAAAECEBEh/9oACAEDAQE/AWDXkf/EABURAQEAAAAAAAAAAAAAAAAAAAEQ/9oACAECAQE/ASf/xAAXEAADAQAAAAAAAAAAAAAAAAAAEBEB/9oACAEBAAY/AnSav//EABoQAQACAwEAAAAAAAAAAAAAAAEAEBEhMUH/2gAIAQEAAT8hYAi9xs9pDHSY46r/2gAMAwEAAgADAAAAEL/P/8QAFhEBAQEAAAAAAAAAAAAAAAAAARBB/9oACAEDAQE/EGHE/8QAFxEBAAMAAAAAAAAAAAAAAAAAARARIf/aAAgBAgEBPxBFbH//xAAbEAEAAgIDAAAAAAAAAAAAAAABABEhMUFRYf/aAAgBAQABPxAu7VqpUw1e1juYxUsg0GXDWe47n//Z","aspectRatio":1.547945205479452,"src":"/static/1e9030bcb015fe2dbbc34531d6dbe086/32fd5/fingerprint.jpg","srcSet":"/static/1e9030bcb015fe2dbbc34531d6dbe086/06e94/fingerprint.jpg 113w,\n/static/1e9030bcb015fe2dbbc34531d6dbe086/07ab6/fingerprint.jpg 225w,\n/static/1e9030bcb015fe2dbbc34531d6dbe086/32fd5/fingerprint.jpg 450w,\n/static/1e9030bcb015fe2dbbc34531d6dbe086/4a838/fingerprint.jpg 675w,\n/static/1e9030bcb015fe2dbbc34531d6dbe086/9842e/fingerprint.jpg 900w,\n/static/1e9030bcb015fe2dbbc34531d6dbe086/32a41/fingerprint.jpg 923w","srcWebp":"/static/1e9030bcb015fe2dbbc34531d6dbe086/b8a88/fingerprint.webp","srcSetWebp":"/static/1e9030bcb015fe2dbbc34531d6dbe086/3a3bf/fingerprint.webp 113w,\n/static/1e9030bcb015fe2dbbc34531d6dbe086/975bf/fingerprint.webp 225w,\n/static/1e9030bcb015fe2dbbc34531d6dbe086/b8a88/fingerprint.webp 450w,\n/static/1e9030bcb015fe2dbbc34531d6dbe086/761da/fingerprint.webp 675w,\n/static/1e9030bcb015fe2dbbc34531d6dbe086/210c1/fingerprint.webp 900w,\n/static/1e9030bcb015fe2dbbc34531d6dbe086/cddad/fingerprint.webp 923w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"9257cd1e-ca7f-578b-a2dd-9c2e74282caf","name":"Smokescreen Team"}}}]}},"pageContext":{"id":"0caa71d0-1366-5b02-88d7-fd2ea6d36809"}},"staticQueryHashes":["1478079672"]}