FY2010 - Oak Ridge National Laboratory

Seed Money Fund—
Computational Sciences and Engineering Division
05881
Thwarting Online Deception and Phishing with Honeypots and
DNS Analysis
Craig A. Shue, Gregory C. Hinkel, and Frederick T. Sheldon
Project Description
Criminals impersonate legitimate institutions and defraud users through the Internet. In phishing attacks,
criminals send deceptive e-mails that encourage users to follow a link to a fraudulent Web site and
provide sensitive information. In 2007, such attacks led to financial losses exceeding $3 billion.
Phishers must obtain e-mail addresses for potential victims before they can launch an attack. Phishers
harvest addresses through Web crawling, yet little is known about which sites they crawl or whether their
crawlers exhibit atypical domain name service (DNS) access patterns. With extensive real-time data from
trap e-mail addresses (or honeypots) at external sites and ORNL, combined with ORNL server logs, we
will examine phishing Web crawler access patterns. This will enable us to (1) prevent crawlers from
harvesting our users’ e-mail addresses, (2) block spam from the crawlers’ networks, and (3) determine
whether a campaign is Internet-wide or targeting DOE.
Mission Relevance
Phishing has serious implications for organizations, including ORNL. In a June 2009 phishing test of the
lab staff, ORNL Cyber Security found that over 20% of our users were deceived, including 14.86% of our
technically savvy users authorized to administer their own machines. These phishing attacks can lead to
infected machines, the loss of sensitive information, and a tarnished reputation for the organization. By
protecting our users from phishing attacks, we can avoid these risks for ORNL and DOE.
Our approach has broad implications for other federal agencies, including the Department of Defense, the
Department of Homeland Security, and the Federal Bureau of Investigation. This work can deter financial
crimes, help limit infiltrations into federal computers, and avoid the loss of sensitive data.
Results and Accomplishments
We have created honeypot systems for distributing trap e-mail accounts and for receiving phishing
messages. We have been advertising the device to attract more phisher attention so that we can study their
behavior. We have also obtained DNS server logs and network connection information from the
Information Technology Services Division. We have analyzed these logs to determine the timing
difference between a DNS resolver’s query and the Web/mail client access attempt. In doing so, we have
found some atypical behavior with DNS caching that seems to be common among attackers: attackers
tend to cache DNS responses long past when the records have expired. These caching violations can be a
warning sign for automated malicious activity. However, some clients that have not been blacklisted also
violate DNS cache limits. These clients may have been false negatives in blacklisting or automated
visitors that are not malicious. We have additionally detected an instance of misconfiguration with an
Internet service provider resolver.
These results may allow us to detect automated visitor behavior early in the connection and allow us to
take appropriate action, such as filtering e-mail messages or adjusting the information we release to these
visitors. Future efforts will refine these measurements.
196