2007 Issue 2 - Raytheon

Feature
Comprehensive Mission Assurance
involves the disciplined application
of systems engineering, thorough
risk management, superior quality and
sound management principles to achieve
mission success. In a DoD network-centric
environment, the warfighter is faced with
both wired and wireless network–based
threats. To mitigate wireless threats, innovative
software technologies can be applied
to identify wireless attacks and perform risk
management. One such technology is the
wireless honeypot.
A honeypot is an information system
resource whose purpose is to attract attackers,
provide them with misinformation,
cause confusion and monitor their actions.
Even more importantly, a honeypot gathers
valuable information to determine if a
threat exists, and then provides details to
help mitigation of these threats. A wireless
version of a honeypot entices its attackers
through a simulated wireless access point.
Raytheon Network Centric Systems in St.
Petersburg, Fla., recently sponsored a wireless
honeypot research project at the
University of Florida to help address wireless
threats. The goal of the project, which was
dubbed “The Hive,” was to design, build
and test a simulated environment for a
wireless networked system, or honeypot.
In order to track and log suspicious nodes
and traffic in mobile environments, the Hive
research team developed a wireless honeypot
as a live Linux bootable mini-CD. The
Hive Linux is a Live-CD version of Debian
Linux that was scaled down for operating
system security, and contains the tools
needed to run a standalone wireless honeypot
with virtual services. It is currently available
at the Hive’s project website 1 .
14 2007 ISSUE 2 RAYTHEON TECHNOLOGY TODAY
Wireless
Honeypots
Innovative software technologies
to identify wireless attacks
and perform risk management
Using a Hive Linux CD, any personal computer
(including laptops) can easily be
turned into a wireless honeypot. The experimental
system operates on the IEEE
802.11g wireless standard and instantiates
a honeypot as a simulated wireless access
point with tracking capabilities.
The Hive honeypot runs Honeyd, a GNU
Public License (GPL) open source honeypot
program. Honeyd is described on its website
as “… a small daemon that runs on
both UNIX-like and Windows platforms. It is
used to create multiple virtual honeypots
on a single machine. Entire networks can
be simulated using Honeyd. Honeyd can be
configured to run a range of services like
FTP, HTTP or SMTP. Furthermore, a personality
can be configured to simulate a certain
operating system. Honeyd allows a single host
to claim as many as 65536 IP addresses.” 2
The Hive lures its attacker by broadcasting a
modifiable service set identifier (SSID) over
the network. As an attacker attempts to
connect to the honeypot, its Dynamic Host
Configuration Protocol (DHCP) assigns the
attacker an Internet Protocol (IP) address so
that the attacker is placed on a simulated
network. For the proof of concept, it was
important to allow the attacker to see and
gain access to the network. (An encrypted
and secured wireless network would make
the establishment of a network connection
far more difficult, but may lure the more
experienced attacker.)
One of the first things that an attacker may
do is to “fingerprint” computers that are
local to their subnet. This can be done by
port-scanning local nodes. In our case, the
attacker port-scans the honeypot’s virtual
services. The system tells the attacker that
ports 22, 23, 80 and 110 are open, while
Honeyd logs the probe. When an attacker
connects to port 22 secure shell (SSH) or
port 23 (Telnet), an authentication script is
executed. The attacker may try a brute
force attack to guess username and password
combinations; such an attack can be
done easily with a program named Hydra 3 ,
and all connection attempts can be logged.
Once the attacker gains access, all commands
entered are logged. This connection
is similarly made for the virtual services of
port 80 Web and port 110 Post Office
Protocol 3 (POP3).
The honeypot itself is composed of a Linux
operating system running a DHCP server,
HostAP, Honeyd, and Sebek with Syslog.
HostAP is a driver for Prism2-based wireless
client cards that allows them to appear and
act as a wireless access point. Sebek 4 is a
data capture tool designed to capture the
attacker’s activities on a honeypot, without
their knowledge. Syslog is the system logger,
which is similar to the Event Viewer in
Microsoft ® Windows.
The Hive was able to integrate and test the
DCHP server, some scripts, the logging with
Sebek, Honeyd, Syslog and the wireless
access point emulation. This integration cre-
Attacker
802.11
Virtual Services
Honeypot
Simple Wireless Honeypot Diagram