Know Your Enemy

DESCRIPTION

For centuries, military organizations have depended on scouts to gather intelligence on the enemy. Specifically, who the enemy was, what they were doing, how they may attack, the weapons they use, and their ultimate objectives. Time and again this information has proven critical in defending against and defeating the enemy. For information security, this scout has never existed. Very few organizations know who their enemy is, how they may attack, what the enemy does once they compromise a system, and why they attack. The Honeynet Project is changing this. A research organization of thirty security professionals, we are dedicated to learning the tools, tactics and motives of the blackhat community. Just as with scouts in the military, our mission is to gather intelligence on the enemy. The primary weapon of the Honeynet Project is the Honeynet, a unique solution designed to capture and study the blackhat's every move. In this book you will learn in detail not only what we have discovered about this adversary, but how we built and used Honeynets to gather this critical information. Know Your Enemy includes: The Honeynet: Description of a honeynet, and how to plan, build, and maintain one. Also covers risks and issues involved. The Analysis: Step-by-step instructions on how to capture and analyze data from a honeynet. The Enemy: Presents what the project learned about the blackhat community, including documented compromised systems. Aimed at both security professionals and those with a non-technical background, this book teaches the technical skills needed to study a blackhat attack and learn from it. The CD includes examples of network traces, code, system binaries, and logs used by intruders from the blackhat community. Introducing honeynets: the breakthrough tool for monitoring and containing "blackhat" hackers! This book shares the lessons of the Honeynet Project, in which leading security professionals built networks designed to be compromised. From this they learned everything possible from the "blackhat" hackers who took the bait: their tools, their tactics, and their motives. The insights in this book will go a long way towards helping security professionals protect their networks against real attacks. If that's not enough, the book shows you how to build your own honeynet, learning even more about today's most significant exploits -- and tomorrow's. Lance Spitzer, leader of The Honeynet Project, begins by introducing honeynets and honeypots (the parts that make up the honeynet network), explaining how they work, and showing how to build one. Next, Know Your Enemy focuses on an in-depth analysis of attacks, including detailed analyses of compromised systems, and techniques for containing blackhat hackers while you gather evidence and work to identify them. Part III takes you into the minds of the blackhat hackers, focusing on the evidence left by actual attacks -- not theory or speculation. For all computer security specialists, and network and system administrators concerned with intrusion detection and security. The Honeynet Project is designed to raise awareness about computer vulnerabilities and to teach network administrators how to defend against them. Lance Spitzer is founder and lead researcher at The Honeynet Project, and lead author of this book. He has written influential papers on building honeypots and honeynets that attract blackhat hackers in order to learn their motives and behaviors. He is a frequent speaker at SANS and other security conferences. TABLE OF CONTENTS Preface Foreword Ch. 1 The Battleground 1 Pt. I The Honeynet 7 Ch. 2 What a Honeynet Is 9 Ch. 3 How a Honeynet Works 19 Ch. 4 Building a Honeynet 45 Pt. II The Analysis 55 Ch. 5 Data Analysis 57 Ch. 6 Analyzing a Compromised System 75 Ch. 7 Advanced Data Analysis 95 Ch. 8 Forensic Challenge 111 Pt. III The Enemy 123 Ch. 9 The Enemy 125 Ch. 10 Worms at War 139 Ch. 11 In Their Own Words 151 Ch. 12 The Future of the Honeynet 267 App. A: Snort Configuration 271 App. B Swatch Configuration File 275 App. C Named NXT HOWTO 277 App. D NetBIOS Scans 285 App. E Source Code for bj.c 297 App. F TCP Passive Fingerprint Database 299 App. G ICMP Passive Fingerprint Database 301 App. H Honeynet Project Members 303 Index 315