In this lesson,
we're going to start talking about honeypots
and active defense.
Honeypots are probably the most well known form
of active defense, although there are several other types.
Now, when we talk about defense,
you probably have heard the old saying,
the best defense is a good offense.
Now what does that mean?
Well, this was actually a saying from a boxer back
in the 1930s named Jack Dempsey.
And his idea was if you have a really good offense
and you're hitting the other guy over, and over,
and over again, you're going to bloody him up
to the point where he gets tired, and gives up on you.
That's the idea of the best defense being a good offense.
Now, when we talk about active defense,
we're talking about the practice of responding to a threat
by destroying or deceiving the threat actor's capabilities.
Now, what this really means is
that we have an engagement with the adversary.
That's what active defense is all about.
You're going to hit me, well, I'm going to hit you back,
or you're going to try breaking into my network.
I'm going to let you in, but I'm going to put you
in this other area that's a decoy.
That's the idea of active defense.
For instance, I might want to set up something
that is essentially bait for an attacker.
I set up an area of my network that is exposed
to the internet, and I don't patch my servers,
and I put false information on that stuff.
That all looks like a very attractive target to an attacker.
And so, they may go and grab that and I'm luring them in.
Well, that concept is actually called a honeypot.
A honeypot is essentially a host
or a server that is set up with the purpose
of luring attackers away from your actual network components
that you care about and instead, allowing them
to start attacking this other area.
When they do this, it allows you
to discover attack strategies and weaknesses
in different security configurations,
and learn from their attack methods
because as you watch them doing things, you're going to see,
oh, when they first break in, then they try to pivot,
or then they try to escalate privileges,
or then they try to do X, Y, Z.
And by being able to gather that information,
you can learn about your adversary.
Now, in addition to a honeypot,
which is a single host or server, you might have a honeynet.
And this is an entire network that's set up
to entice an attacker and it looks really juicy,
like it's a real company's network.
Now, often these honeynets are set up
by internet security companies
because they want to use that to allow
their security teams to analyze an attacker's behavior.
Now, what's a good example of this?
Let's say I went ahead and said,
I have this wonderful database,
so I'm going to set up a database server.
I'm going to put some fake information in the database server
and I'm going to expose it to the internet.
Now, inside of that database,
I have a lot of meaningless or unhelpful information,
but the attacker doesn't know that.
They just see there's a database
with a lot of important financial records
because that's what I made it look like.
And so as they go in there and they start attacking
that database, and they start getting into there,
I can start seeing what they're doing,
and figure out what their techniques are,
and then use that to better harden
the rest of my network against that type of an attack.
That's the idea of using a honeypot or a honeynet.
Now, one of the reasons why security researchers set up
these big honeynets is to learn about new techniques
because when they learn about techniques,
they can try to attribute them back to the actor.
When we talk about attribution,
we're talking about the ability to do identification
and publication of an attacker's methods,
techniques and tactics as useful threat intelligence.
For instance, if you look at FireEye,
they do this all the time.
You can go look at a report on APT28, for instance,
and they'll tell you they believe this is attributed
to APT28, these types of malware,
and these are the common techniques they use,
and these are the common tactics they use,
and this is who we think they are.
We think they are part of the Russian Federation,
or we think they are part of China,
or we think they are part of the US,
or whoever it is they think they are.
That is what attribution does.
Now, in addition to dealing with things
like honeynets, and honeypots, and attribution,
we also can do other strategies like annoyance strategies.
Now, annoyance strategies often,
will rely on obfuscation techniques.
These are things we're basically trying to annoy
our attacker and waste their time.
So for instance, we might put in bogus DNS entries.
So when they look at our DNS records they see that we have
a mail server, and a SharePoint server,
and a file server, and a web server,
and we may not have any of those servers up,
but we can give bogus DNS entries
so they think there's something else there,
and so they'll waste their time trying to find it.
Then we can also have things like web servers
with decoy directories so I have a web server up
and I have all my juicy information
in a file called Confidential.
No, I don't because I don't want somebody
to see that 'cause they see confidential,
they're going to try to get into it, right?
But I might put decoy directories like confidential,
important, financial, and that way attackers
might try to go for those and waste their time
'cause if they're wasting their time
on stuff I don't care about, hopefully,
they're not using their time against stuff
I actually do care about.
And then the other thing we can do is
we can use port triggering and spoofing.
There's a lot of techniques out there
where when you see traffic come in
on port X, have this action occur.
And so you might have something like they connect
on port 25 to try to get into your SMTP server
and you're not really running an SMTP server.
Instead, you're going to send that over to port 80
and give them some other kind of message back.
So again, you're wasting their time.
Now, another thing you can do is what's known as hack back,
and this is something I don't really encourage you to do.
Most organizations are not going to allow you to do hack back
unless you work for maybe a three letter agency,
or a military component, or some other nation state
because when you're hacking back,
you are conducting offensive attacks.
Hack back is essentially using offensive
or counter attacking techniques to identify
the attacker and degrade their capabilities.
The idea here with hack back is maybe you have
somebody who is attacking your network
and you identify that their command
and control is at this particular IP.
Well, you can start doing a denial
of service against their IP to get them
to stop doing the attack against you.
That's the idea of a hack back.
Now, can you do this legally?
Mm, maybe, it depends where you live
because these things all are in different laws based on
the city, the state, the country,
or the region of the world that you live in.
And so, you have to look into that
because there are many legal and reputational implications
that you have to consider and mitigate
before you can use some of these active defense strategies,
especially hack back, for instance,
hack back is considered an offensive maneuver.
As I said, you are attacking somebody.
So in the United States, you could actually go to jail
for that because you are breaking the law.
It is illegal to do hacking.
And so if you are hacking back against somebody
who is hacking you, that doesn't make two wrongs
make a right here, you could still go to jail for that.
So keep that in mind, remember where you are,
and the laws in your area and the laws of the server
that you're actually attacking
because just 'cause you're in the United States,
that server may be someplace else,
and then it's affected by those laws and regulations.
So again, the best practice is really not to do a hack back,
but again, it is one of those things that's covered
so I wanted to bring it up here.