KPN Uses Honeypots To Understand Cybercriminals

KPN will deploy this year honeypots to better understand the process of cybercriminals, as the telecom provider's own website announced . "Honeypots are an example of how we as KPN keep abreast of methods and tools of attackers," said Jaya Baloo, Chief Information Security Officer.

A honeypot is a mostly deliberately vulnerable machine attached to the Internet. Then can be monitored how attackers trying to break into the machine. To ensure that an attacker through the honeypot no other servers in the network attacks that are run in a restricted environment. KPN uses Linux Containers (LXC). Each process gets its own container where only a limited area is accessible, according to a report ( pdf ) where the honeypots are defined.

Log data are moved to the storage directly to another container. KPN also makes the setup using a routing container. This container is responsible for Network Address Translation (NAT) between the individual honeypotcontainers and the outside world. Additionally, the program runs continuously tcpdump to save traffic to the honeypot and study in the case provides the honeypot itself is not enough information.

Location

According to KPN plays in deploying honeypots location is key. "It is important to have a clear idea of ​​where you want to place your honeypots before you start to build, because the location eventually largely affects how useful you will be honeypot datas." KPN has a number of physically separate networks with different functions. Based on these features, the locations were chosen where the honeypotservers to start running. "If we know how and why criminals and hackers to penetrate our systems, we can take action," said Baloo. "Everything for a safer network."

DDoS Botnet Is Linux Servers Via SSH

Linux Servers are already several months the target of a DDoS botnet machines via SSH trying to take over in order to use them subsequently for DDoS attacks. The attack consists of three different phases where tens of thousands of passwords are trying to log in via SSH.

The botnet infected machines leaving out a certain number of times to log in before the next IP address is used to carry out the attack. According to security firm FireEye use the assailants include a modified version of the Rock You password list .In case the login attempt is successful is immediately logged out. Within 24 hours is logged in from a different IP address.The attackers do this in a way that they know to bypass the default logging and thus leave no trace.

After being signed is ultimately the "XOR.DDoS" malware installed. On the honeypotservers of FireEye were nearly 1 million logins attackers observed within three months. According to researchers at the company XOR.DDoS one of the more advanced malware families for Linux. It also supports multiple platforms, including x86 and ARM. "Network devices and embedded systems are vulnerable to brute force SSH attacks," said analyst Michael Lin.

He notes that it is not always possible or apparent to end users how these systems can be protected against these attacks.However, users are advised to set as their SSH server that encryption keys are used instead of passwords. Furthermore, it is advised to turn off the remote login to the root account. Also the use of fail2ban is recommended.

"Brute force attacks are one of the oldest attacks. Because it avoids many there are plenty of solutions available to protect against it. Yet many systems vulnerable," Lin says. He warns that the brutal Forcen of credentials in the Top 10 of methods is allowing companies to be hacked.