New Project Takes Aim At Web Vulnerabilities

New open source honeypot sets bait to lure attackers and to gain first hand information on current attack techniques underway.I've always appreciated honeypots: set a server out onto the Internet and see what attacks come its way. It's a valuable way for researchers to learn about broad attacks underway, and it's also a great way for corporations to see what types of attacks are coming their way.

And, based on this story in DarkReading, student developers through the Google Summer of Code 2009 program, developed a honeynet, dubbed Glastopf, that "morphs" based on attacker actions:

"Unlike other Web honeypots, the new open-source Glastopf tool dynamically emulates vulnerabilities attackers are looking for, so it's more realistic and can gather more detailed attack information, according to its developers. "Many attackers are checking the vulnerability of the application before they inject malicious code. My project is the first Web application honeypot with a working vulnerability emulator able to respond properly to attacker requests," says Lukas Rist, who created Glastopf.

Unlike other Web honeypots that use templates posing as real Web apps, Glastopf basically adapts to the attack and can automatically detect and allow an unknown attack. Glastopf uses a combination of known signatures of vulnerabilities and also records the keywords an attacker uses when visiting the honeypot to ensure it gets indexed in search engines, which attackers often use to find new targets. The project uses a central database to gather the Web attack data from the Glastopf honeypot sensors installed by participants who want to share their data with the database.

"

According to the story, the creators are working with ISPs in Germany and France, who hope to use the data gleaned from the honeypot to potentially shut down servers that are hosting malware.

I'm hopeful this project also nets some new information about botnets in operation, and new Web application attack techniques.

Information on the project can be found here.

For my security and technology observations throughout the day, consider following me on Twitter.