Risk
10/31/2009
07:06 PM
George V. Hulme
George V. Hulme
Commentary
50%
50%

New Project Takes Aim At Web Vulnerabilities

New open source honeypot sets bait to lure attackers and to gain first hand information on current attack techniques underway.

New open source honeypot sets bait to lure attackers and to gain first hand information on current attack techniques underway.I've always appreciated honeypots: set a server out onto the Internet and see what attacks come its way. It's a valuable way for researchers to learn about broad attacks underway, and it's also a great way for corporations to see what types of attacks are coming their way.

And, based on this story in DarkReading, student developers through the Google Summer of Code 2009 program, developed a honeynet, dubbed Glastopf, that "morphs" based on attacker actions:

Unlike other Web honeypots, the new open-source Glastopf tool dynamically emulates vulnerabilities attackers are looking for, so it's more realistic and can gather more detailed attack information, according to its developers. "Many attackers are checking the vulnerability of the application before they inject malicious code. My project is the first Web application honeypot with a working vulnerability emulator able to respond properly to attacker requests," says Lukas Rist, who created Glastopf.

Unlike other Web honeypots that use templates posing as real Web apps, Glastopf basically adapts to the attack and can automatically detect and allow an unknown attack. Glastopf uses a combination of known signatures of vulnerabilities and also records the keywords an attacker uses when visiting the honeypot to ensure it gets indexed in search engines, which attackers often use to find new targets. The project uses a central database to gather the Web attack data from the Glastopf honeypot sensors installed by participants who want to share their data with the database.

According to the story, the creators are working with ISPs in Germany and France, who hope to use the data gleaned from the honeypot to potentially shut down servers that are hosting malware.

I'm hopeful this project also nets some new information about botnets in operation, and new Web application attack techniques.

Information on the project can be found here.

For my security and technology observations throughout the day, consider following me on Twitter.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-4077
Published: 2015-09-03
The (1) mdare64_48.sys, (2) mdare32_48.sys, (3) mdare32_52.sys, and (4) mdare64_52.sys drivers in Fortinet FortiClient before 5.2.4 allows local users to read arbitrary kernel memory via a 0x22608C ioctl call.

CVE-2015-5189
Published: 2015-09-03
Race condition in pcsd in PCS 0.9.139 and earlier uses a global variable to validate usernames, which allows remote authenticated users to gain privileges by sending a command that is checked for security after another user is authenticated.

CVE-2015-5190
Published: 2015-09-03
The pcsd web UI in PCS 0.9.139 and earlier allows remote authenticated users to execute arbitrary commands via "escape characters" in a URL.

CVE-2015-5735
Published: 2015-09-03
The (1) mdare64_48.sys, (2) mdare32_48.sys, (3) mdare32_52.sys, and (4) mdare64_52.sys drivers in Fortinet FortiClient before 5.2.4 allows local users to write to arbitrary memory locations via a 0x226108 ioctl call.

CVE-2015-5736
Published: 2015-09-03
The Fortishield.sys driver in Fortinet FortiClient before 5.2.4 allows local users to execute arbitrary code with kernel privileges by setting the callback function in a (1) 0x220024 or (2) 0x220028 ioctl call.

Dark Reading Radio
Archived Dark Reading Radio
Another Black Hat is in the books and Dark Reading was there. Join the editors as they share their top stories, biggest lessons, and best conversations from the premier security conference.