Spanish Honeynet Project

Forensic Challenge 5 – Log Mysteries

Diego Gonzalez — Wed, 01 Sep 2010 15:55:33 +0000

The Honeynet Project has recently announced Forensic Challenge 5. This challenge takes you into the world of virtual systems and confusing log data. Figure out what happened to a virtual server using all the logs from a possibly compromised server.

Challenge 5 has been created by Raffael Marty from the Bay Area Chapter, Anton Chuvakin from the Hawaiian Chapter, and Sebastien Tricaud from the French Chapter. It is a bit more open ended than the last challenges.

The questions are a more open ended than past challenges. To score highly, we recommend to answer the following way:

* Accuracy is highly encouraged to get the highest note
* You must explain tools you used and how
* If you use visualization tools such as afterglow, picviz, graphviz, gnuplot etc. explain why this was better (than other tools, than other visualization): such as good timeline representation etc.
* Outline HOW you found things

Submission deadline is September 30th and we will be announcing winners around October 21st. We have a few small prizes for the top three submission.

Enjoy!

VoIP Honey, a honeypot for VoIP

Diego Gonzalez — Sat, 26 Jun 2010 14:54:46 +0000

The guys at Bytecoders have released VoIP Honey, a comprehensible honeypot for VoIP (Voice over IP) networks. VoIP Honey provides a set of tools for building an entire honeynet, thus includes honeywall and honeypot emulating VoIP environments such as Asterisk PBX or OpenSer with fully configurable connections.

To facilitate the work VoIP Honey includes a very nice bash-like command line interface based on ncurses, with history and auto-complete features. Also offers comprehensive well-structured and full configurable debug information.

As the authors say the VoIP Honey project is in a very basic early stage and it is only recommend to use it for testing in a strictly controlled network environments without direct Internet connection (in example Virtual Machines).

Photo by kozumel

Mailing list moved

Diego Gonzalez — Mon, 02 Mar 2009 20:16:28 +0000

We have moved our mail list location to freelists.org. The new address is http://www.freelists.org/list/sphoneynet.

New member

Diego Gonzalez — Sun, 01 Mar 2009 15:54:38 +0000

We are glad to announce that our group has a new member. He is Pedro Sánchez, a security administrator of “Asociación Técnica de Cajas de Ahorros”.

He has worked in important companies as a security consultant specialized in computer forensics, honeynets, intrusion detection, firewalls, he also holds CISM and CHFI certifications. More details at members page.

Welcome aboard, Pedro! :)

HoneySpot: The Wireless Honeypot

siles — Tue, 15 Jan 2008 20:54:24 +0000

HoneySpot: The Wireless Honeypot
Monitoring the Attacker’s Activities in Wireless Networks
A design and architectural overview

We’ve been developing a paper to create awareness and help to guide the deployment of wireless honeypots, mainly centered on 802.11 (WiFi) technologies. The paper is focused on providing a design and architectural overview for the deployment of wireless honeypots, coined as HoneySpots.

We’re currently involved in deploying these technologies, capture attacks and related information, develop analysis tools, and will publish a future paper with the findings. Meanwhile, we would like to publicly promote the deployment of these technologies by releasing this paper. If you are interested in developing or/and deploying wireless honeynets, contact us at project at (removethis)honeynet.org.es. The Spanish Honeynet Project wants to promote this research area, including multiple wireless technologies, mainly 802.11 and Bluetooth today, with future additions such as WiMAX.

FIST Talk

Diego Gonzalez — Fri, 04 Feb 2005 16:52:55 +0000

Presentation of the Spanish Honeynet Project, describing the Project, what Honeynets are, their value, how they operate, and how they contribute to computer security. 29 slides.

FIST 21st May

FIST 22nd May

Scan of The Month 32 Write-up

Diego Gonzalez — Wed, 27 Oct 2004 13:51:35 +0000

In this paper we analyze the malware provided for the Scan of the Month 32 released by the Honeynet Project in September 2004. The paper contains not only the answers to the questions of the challenge but also a detailed explanation of the methods and tools used to do the analysis.

Installing a Virtual Honeywall with VMware

Diego Gonzalez — Wed, 15 Sep 2004 17:46:55 +0000

If the Honeywall CDROM is installed on a virtual machine, it will also include the many advantages that a virtual machine environment offers. This paper explains how to go about configuring VMware to deploy a Honeywall.

Building a GenII Honeynet Gateway

Diego Gonzalez — Wed, 11 Aug 2004 21:13:29 +0000

This is a short guide to build a GenII Honeynet Gateway, also called a Honeywall, under Linux, broaching the most common problems and providing several solutions and tips.

Honeywall scripts

Diego Gonzalez — Sun, 11 Jul 2004 20:41:14 +0000

The scripts below have been written to make easier the management of the most common tools used in a Honeywall. The logging directories and log file name formats used are similar to the ones used by the Honeywall CDROM tool to preserve compatibility. These scripts are also included in the paper “Building a GenII Honeynet Gateway”.

honeywall.conf: The main configuration file. It is an improved version of honeywall.conf config file included in the Honeywall CDROM by The Honeynet Project. It has two new options: LAN_BLOCK and LAN_ALLOWDED_IP. We suggested this new functionality to the Alliance who integrated it into Roo as whitelisting and blacklisting.

rc.firewall: Script for loading iptables firewall. It is an improved version of the rc.firewall script v0.8 found in Honeywall CDROM that supports the new LAN_BLOCK option. On the other hand, the handlers’ section has been simplified.

snort.sh: Script for managing snort NIDS (config file not provided).

snort_inline.sh: Script for managing snort-inline (config file not provided).

snort_pcap.sh: Script for recording network traffic in binary format using snort in logging mode.

tcpdump.sh: Script for recording network traffic in binary format using tcpdump.

swatch.sh: Script for managing Swatch, used to provide basic alerting capabilites.

swatch.conf: Swatch elemental configuration file.