This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "OWASP Honeypot Project"

From OWASP
Jump to: navigation, search
(Created page with "Main Instructions are in RED text and should be removed from your document by deleting the text with the span tags. This document is intended to serve as an example of...")
 
m
 
(21 intermediate revisions by 2 users not shown)
Line 1: Line 1:
−
Main
+
=Main=
  
 +
<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>
  
 +
{| style="padding: 0;width:100%;margin:0;margin-top:10px;text-align:left;" |-
 +
| style="border-right: 1px dotted gray;padding-right:25px;" valign="top" |
 +
== OWASP Honeypot Project Background ==
  
 +
Scientists at National Institute of Science and Technology claim that 92% of security vulnerabilities lie within the applications; handing the advantage over to the cyber-thieves. Many of these bugs can be eliminated simply by improving the code in which the software applications are written. The UK government estimates that the cost from cyber-attacks to be on average around £310,000 for a UK SME per annum, with almost 1 million UK SMEs having suffered from a data breach in 2017. SMEs are 70% more likely to be attacked than larger organisations, simply because they lack the ability to protect themselves. Regulations such as GDPR (which replaced the Data Protection Act in May 2018) exist to enforce that organisations protect data. Yet little in the way of understanding the threat exposures exist, with even less guidance on how to protect against the risks.
  
 +
The web application Defender's community already exists. Not-for-profit charitable organisations such as OWASP (Open Web Application Security Project) raison d’etre is to provide an open source community to help organisations develop safer software applications that can be trusted to be secure against criminal attack. TSI (the Trusted Software Initiative) and OWASP create educational information on how software should be written and some of the more obvious bugs that are left open to give attackers access to confidential information.
  
 +
==Introduction ==
 +
Researchers are beginning to realise that by “watching” how Internet criminals behave, we can learn directly from their work flow activities, and use this information to protect ourselves. The past 20 years of research into Internet security, has made internal hosting infrastructures more secure, especially in large businesses. So today, Internet criminals take advantage of bugs in the software applications themselves. These bugs originate wholly because software has been poorly written and designed.
  
 +
Large businesses may already employ a team of people to evaluate and protect any software facing the Internet. However, a key area lacking protection are the millions of smaller businesses worldwide that trade via the Internet, right down to the one person hobby-business selling products from home on eBay.
  
−
Instructions are in RED text and should be removed from your document by deleting the text with the span tags. This document is intended to serve as an example of what is required of an OWASP project wiki page. The text in red serves as instructions, while the text in black serves as an example. Text in black is expected to be replaced entirely with information specific to your OWASP project.
+
This project is about collecting and maximising intelligence from the cyber-battlefield that exists between attackers with criminal intent and the people creating the software upon which the Internet runs. By collecting intel on what the criminals are doing, we can define rules for writing software that can be fed back to the front line troops writing the code, so they can close these bugs and other vulnerabilities in their software. An attacker only needs to be lucky once, whereas we need to be lucky in protecting against all attacks, all of the time. By sharing the findings from our reconnoitres out in the field, this project provides educational information back to the community of software coders, be they professional developers or school kids working in their bedrooms. Today, the advantage lies clearly with the attackers. With this kind of threat information we take the advantage back into the hands of the defenders.
  
 +
| style="padding-left:25px;width:34%;border-right: 1px dotted gray;padding-right:25px;" valign="top" |
  
−
OWASP Tool Project Template
+
== Description ==
 +
The goal of the OWASP ''Honeypot Project'' is to identify emerging attacks against web applications and report them to the community, in order to facilitate protection against such targeted attacks. Within this project, Anglia Ruskin University is leading the collection, storage and analysis of threat intelligence data.
  
−
This section should include an overview of what the project is, why the project was started, and what security issue is being addressed by the project deliverable. Some readers may be discouraged from looking further at the project if they do not understand the significance of the security concern that is being addressed, so provide enough context so the average reader will continue on with reading the description. You shouldn't assume the reader will understand the objective by providing security terminology, e.g. this project builds cryptographic algorithms, but should also endeavor to explain what they are used for.
+
The purpose of this part of the project is to capture intelligence on attacker activity against web applications and utilise this intelligence as ways to protect software against attacks. Honeypots are an established industry technique to provide a realistic target to entice a criminal, whilst encouraging them to divulge the tools and techniques they use during an attack. Like bees to a honeypot. These honeypots are safely designed to contain no information of monetary use to an attacker, and hence provide no risk to the businesses implementing them.  
  
 +
The project will create honeypots that the community can distribute within their own networks. With enough honeypots globally distributed, we will be in a position to aggregate attack techniques to better understand and protect against the techniques used by attackers. With this information, we will be in a position to create educational information, such as rules and strategies, that application writers can use to ensure that any detected bugs and vulnerabilities are closed.
  
−
The OWASP Tool Template Project is a template designed to help Project Leaders create suitable project pages for OWASP Projects.  By following the instructional text in red (and then deleting it) it should be easier to understand what information OWASP and the project users are looking for.  And it's easy to get started by simply creating a new project from the appropriate project template.
+
Project progression:
  
−
Description
+
# '''Honeypot software.''' The honeypot software that is to be provided to the community to place in their networks has been written. Honeypots are available in a variety of forms, to make deployment as flexible as possible and appeal to a diverse a user set as possible.
 +
# '''Collection software.''' The centralised collection software has been written and evaluated in a student driven proof-of-concept project. Honeypots have been attacked in a laboratory situation and have reported both the steps taken by the attacker and what they have attacked, back to the collection software.
 +
# '''Rollout to the Community.''' The project now needs a dedicated infrastructure platform in place that is available to the entire community to start collecting intelligence back from community deployed honeypots. This infrastructure will run the collector software, analysis programmes and provide a portal for communicating our finds and recommendations back to the community in a meaningful manner.
 +
# '''Going Forward'''. Toolkits and skills used by attackers do not stand still.  As existing bugs are plugged, others open. . Follow up stages for the project will be to create a messaging system to automatically update the community on findings of significant risk in their existing code that requires attention.
  
−
This is where you need to add your more robust project description. A project description should outline the purpose of the project, how it is used, and the value it provides to application security. Ideally, project descriptions should be written in such a way that there is no question what value the project provides to the software security community. This section will be seen and used in various places within the Projects Portal. Poorly written project descriptions therefore detract from a project’s visibility, so project leaders should ensure that the description is meaningful. 
+
| style="padding-left:20px;width:32%;" valign="top" |
  
 +
== What is the OWASP Honeypot Project? ==
 +
The OWASP Honeypot Project provides:
 +
* Real-time, detailed Web Application Attack Data
 +
* Threat Reports to the community
  
−
The Tool Project Template is simply a sample project that was developed for instructional purposes that can be used to create default project pages for a Tool project.  After copying this template to your new project, all you have to do is follow the instructions in red, replace the sample text with text suited for your project, and then delete the sections in red.  Doing so should make it clearer to both consumers of this project, as well as OWASP reviewers who are trying to determine if the project can be promoted to the next category.  The information requested is also intended to help Project Leaders think about the roadmap and feature priorities, and give guidance to the reviews as a result of that effort.
+
== News and Events ==
  
−
Creating a new set of project pages from scratch can be a challenging task. By providing a sample layout, with instructional text and examples, the OWASP Tool Project Template makes it easier for Project Leaders to create effective security projects and hence helps promote security.
+
* [[Media:Open Security Summit Honeypot.pdf|OWASP Honeypot Project Reboot]] at Open Security Summit 2018 & CRS Community Summit 2018 (hosted at AppSec Europe 2018)
 +
* [https://drive.google.com/open?id=1ZVg8C8Fkp-q6SoMtYUR2NAmCOg319eRl CRS Community Summit 2018 Video Presentations] (hosted at Appsec Europe 2018, QE2 Conference Centre, London.
  
−
Contextual custom dictionary builder with character substitution and word variations for pen-testers
+
== Project Resources ==
  
−
Licensing
+
== Project Leader ==
 +
* [https://www.owasp.org/index.php/User:Adrian_Winckles Adrian Winckles]
  
−
A project must be licensed under a community friendly or open source license.  For more information on OWASP recommended licenses, please see OWASP Licenses. While OWASP does not promote any particular license over another, the vast majority of projects have chosen a Creative Commons license variant for documentation projects, or a GNU General Public License variant for tools and code projects.  This example assumes that you want to use the AGPL 3.0 license.
+
== Related Projects ==
  
 +
==Licensing==
  
−
This program is free software: you can redistribute it and/or modify it under the terms of the link GNU Affero General Public License 3.0 as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.  OWASP XXX and any contributions are Copyright © by {the Project Leader(s) or OWASP} {Year(s)}. 
+
==Classifications==
  
 +
  {| width="200" cellpadding="2"
 +
  |-
 +
  | colspan="2" align="center" | [[File:Project_Type_Files_TOOL.jpg|link=https://www.owasp.org/index.php/Category:OWASP_Tool]]
 +
  |-
 +
  | rowspan="2" width="50%" valign="top" align="center" | [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects|Incubator Project]]
 +
  | width="50%" valign="top" align="center" | [[File:Owasp-builders-small.png|link=Builders]] 
 +
  |-
 +
  | width="50%" valign="top" align="center" | [[File:Owasp-defenders-small.png|link=Defenders]]
 +
  |-
 +
  | colspan="2" align="center" | [[File:Agplv3-155x51.png|link=http://www.gnu.org/licenses/agpl-3.0.html|Affero General Public License 3.0]]
 +
  |}
  
 +
|}
  
−
Project Resources
+
=FAQs=
  
−
This is where you can link to the key locations for project files, including setup programs, the source code repository, online documentation, a Wiki Home Page, threaded discussions about the project, and Issue Tracking system, etc.
+
<!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.-->==How can I participate in your project?==
−
 
 
−
 
 
−
Installation Package
 
−
 
 
−
Source Code
 
−
 
 
−
What's New (Revision History)
 
−
 
 
−
Documentation
 
−
 
 
−
Wiki Home Page
 
−
 
 
−
Issue Tracker
 
−
 
 
−
Slide Presentation
 
−
 
 
−
Video
 
−
 
 
−
Project Leader
 
−
 
 
−
A project leader is the individual who decides to lead the project throughout its lifecycle. The project leader is responsible for communicating the project’s progress to the OWASP Foundation, and he/she is ultimately responsible for the project’s deliverables. The project leader must provide OWASP with his/her real name and contact e-mail address for his/her project application to be accepted, as OWASP prides itself on the openness of its products, operations, and members.
 
−
 
 
−
 
 
−
Project leader's name
 
−
 
 
−
Related Projects
 
−
 
 
−
This is where you can link to other OWASP Projects that are similar to yours.
 
−
 
 
−
OWASP_Code_Project_Template
 
−
OWASP_Documentation_Project_Template
 
−
 
 
−
Classifications
 
−
 
 
−
 
 
−
 
 
−
   
 
−
 
 
−
   
 
−
     
 
−
 
 
−
   
 
−
 
 
−
   
 
−
 
 
−
 
 
−
 
−
 
 
−
News and Events
 
−
 
 
−
This is where you can provide project updates, links to any events like conference presentations, Project Leader interviews, case studies on successful project implementations, and articles written about your project.
 
−
 
 
−
[12 Feb 2013] Support for Spanish is now available with this release.
 
−
[11 Jan 2014] The 1.0 stable version has been released! Thanks everyone for your feedback and code fixes that made this happen!
 
−
[18 Dec 2013] 1.0 Release Candidate is available for download.  This release provides final bug fixes and product stabilization.  Any feedback (good or bad) in the next few weeks would be greatly appreciated.
 
−
[20 Nov 2013] 1.0 Beta 2 Release is available for download. This release offers several bug fixes, a few performance improvements, and addressed all outstanding issues from a security audit of the code.
 
−
[30 Sep 2013] 1.0 Beta 1 Release is available for download.  This release offers the first version with all of the functionality for a minimum viable product.    
 
−
 
 
−
 
 
−
 
 
−
FAQs
 
−
 
 
−
 
 
−
 
 
−
Many projects have "Frequently Asked Questions" documents or pages. However, the point of such a document is not the questions. The point of a document like this are the answers. The document contains the answers that people would otherwise find themselves giving over and over again. The idea is that rather than laboriously compose and post the same answers repeatedly, people can refer to this page with pre-prepared answers. Use this space to communicate your projects 'Frequent Answers.'
 
−
 
 
−
 
 
−
How can I participate in your project?
 
 
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.  
 
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.  
  
−
If I am not a programmer can I participate in your project?
+
==If I am not a programmer can I participate in your project?==
 
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.  See the Road Map and Getting Involved tab for more details.
 
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.  See the Road Map and Getting Involved tab for more details.
  
−
Acknowledgements  
+
= Acknowledgements =
−
Contributors
+
==Contributors==
  
−
 
+
= Road Map and Getting Involved =
  
−
The success of OWASP is due to a community of enthusiasts and contributors that work to make our projects great. This is also true for the success of your project.  
+
<!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.-->
−
Be sure to give credit where credit is due, no matter how small! This should be a brief list of the most amazing people involved in your project.  
+
==Roadmap==
−
Be sure to provide a link to a complete list of all the amazing people in your project's community as well.
+
As of <strong>August, 2018, the  priorities for the next 6 months</strong> are:
 +
<strong>
 +
* Setup Proof of Concept to understand how Mod Security baed Honeypot/Probe interacts with a receiving console (develop a VM and/or Docker based test solution to store logs from multiple probes).
 +
* Evaluate console options to visualise threat data received from ModSecurity Honeypots/probes in MosSecurity Audit Console, WAF-FLE, Fluent and bespoke scripts for single and multiple probes.
 +
* Develop a mechanism to convert from stored MySQL to JSON format.
 +
* Provide a mechanism to convert ModSecurity mlogc audit log output into JSON format.
 +
* Provide a mechanism to convert mlogc audit log output directly into ELK (ElasticSearch/Logstash/Kibana) to visualise the data.
 +
* Provide a mechanism to forward honest output into threat intelligence format such as STIX using something like the MISP project
 +
* (https://www.misp-project.org) to share Threat data coming from the Honeypots making it easy to export/import data from formats such as STIX and TAXII., may require use of concurrent logs in a format that MISP can deal with.
 +
* Consider new alternatives for log transfer including the use of MLOGC-NG or other possible approaches.
 +
* Develop a new VM based honeypot/robe based on CRS v3.0.
 +
* Develop new alternative small footprint honeypot/probe formats utilising Docker & Raspberry Pi.
 +
* Develop machine learning approach to automatically be able to update the rule set being used by the probe based on cyber threat intelligence received.
 +
</strong>
  
 +
==Getting Involved==
 +
Involvement in the development and promotion of the <strong>Web Honeypot Project </strong> is actively encouraged!
  
−
The OWASP Tool Project Template is developed by a worldwide team of volunteers. A live update of project  contributors is found here.
+
You do not have to be a security expert or a programmer to contribute.
−
 
 
−
The first contributors to the project were:
 
−
 
 
−
Colin Watson who created the OWASP Cornucopia project that the template was derived from
 
−
Chuck Cooper who edited the template to convert it from a documentation project to a Tool Project Template
 
−
YOUR NAME BELONGS HERE AND YOU SHOULD REMOVE THE PRIOR 3 NAMES
 
−
 
 
−
Road Map and Getting Involved
 
−
 
 
−
 
 
−
 
 
−
A project roadmap is the envisioned plan for the project. The purpose of the roadmap is to help others understand where the project is going as well as areas that volunteers may contribute. It gives the community a chance to understand the context and the vision for the goal of the project. Additionally, if a project becomes inactive, or if the project is abandoned, a roadmap can help ensure a project can be adopted and continued under new leadership.
 
−
Roadmaps vary in detail from a broad outline to a fully detailed project charter. Generally speaking, projects with detailed roadmaps have tended to develop into successful projects. Some details that leaders may consider placing in the roadmap include: envisioned milestones, planned feature enhancements, essential conditions, project assumptions, development timelines, etc. You are required to have at least 4 milestones for every year the project is active.
 
−
 
 
−
 
 
−
Roadmap
 
−
As of November, 2013, the highest priorities for the next 6 months are:
 
  
−
Complete the first draft of the Tool Project Template
 
−
Get other people to review the Tool Project Template and provide feedback
 
−
Incorporate feedback into changes in the Tool Project Template
 
−
Finalize the Tool Project template and have it reviewed to be promoted from an Incubator Project to a Lab Project
 
−
 
−
 
−
Subsequent Releases will add
 
−
 
−
Internationalization Support
 
−
Additional Unit Tests
 
−
Automated Regression tests
 
−
 
−
 
−
Getting Involved
 
−
Involvement in the development and promotion of Tool Project Template is actively encouraged!
 
−
You do not have to be a security expert or a programmer to contribute.
 
 
Some of the ways you can help are as follows:
 
Some of the ways you can help are as follows:
  
−
Coding
+
* Coding aspects of CRS/JSON
−
We could implement some of the later items on the roadmap sooner if someone wanted to help out with unit or automated regression tests
+
* Working on Component Integration
−
Localization
+
* Deploying a Honeypot/Probe
−
Are you fluent in another language? Can you help translate the text strings in the Tool Project Template into that language?
+
* Testing
−
Testing
 
−
Do you have a flair for finding bugs in software? We want to product a high quality product, so any help with Quality Assurance would be greatly appreciated. Let us know if you can offer your help.
 
−
Feedback
 
−
Please use the Tool Project Template project mailing list for feedback about:
 
−
 
 
−
What do like?
 
−
What don't you like?
 
−
What features would you like to see prioritized on the roadmap?
 
−
 
 
−
 
 
−
Minimum Viable Product
 
−
 
 
−
 
 
−
This page is where you should indicate what is the minimum set of functionality that is required to make this a useful product that addresses your core security concern.
 
−
Defining this information helps the project leader to think about what is the critical functionality that a user needs for this project to be useful, thereby helping determine what the priorities should be on the roadmap.  And it also helps reviewers who are evaluating the project to determine if the functionality sufficiently provides the critical functionality to determine if the project should be promoted to the next project category. 
 
−
 
 
−
 
 
−
The Tool Project Template must specify the minimum set of tabs a project should have, provide some an example layout on each tab, provide instructional text on how a project leader should modify the tab, and give some example text that illustrates how to create an actual project.
 
−
 
 
−
It would also be ideal if the sample text was translated into different languages.
 
−
 
 
−
Project About
 
−
Addtional Instructions for making changes:
 
−
 
 
−
The About 'tab' on that page is done with a MediaWiki template.  If you log into the wiki page for your project and click the "Edit" button/link/tab in the top-right between 'Read' and 'View History', you'll see the edit page for the main body of your project page.
 
−
 
 
−
If you scroll down below the form to edit that page (below the "Save page", "Show preview", "Show changes" buttons, you'll see some text with a triangle in front of it reading "Templates used on this page:"  A list will expand if you click on the triangle/text to show the templates that make up this page.  The one you want is the "Projects/OWASP Example Project About Page" - click the (edit) next to this to edit that template.  The direct link is: https://www.owasp.org/index.php?title=Projects/OWASP_Example_Project_About_Page&action=edit
 
−
 
 
−
The template takes 'input' that are key/value pairs where you'll need to edit the stuff after the equals (=) like:
 
−
project_name =Place your project name here.
 
−
 
 
−
You'd edit the bold bit.
 
−
 
 
−
 
 
−
 
 
−
This page is where you need to place your legacy project template page if your project was created before October 2013. To edit this page you will need to edit your project information template. You can typically find this page by following this address and substituting your project name where it says "OWASP_Example_Project". When in doubt, ask the OWASP Projects Manager.
 
−
Example template page: https://www.owasp.org/index.php/Projects/OWASP_Example_Project
 
−
 
 
−
 
 
−
 
 
−
 
 
−
PROJECT INFO What does this OWASP project offer you?
 
−
RELEASE(S) INFO What releases are available for this project?
 
−
 
 
−
 
 
−
 
−
what
 
−
is this project?
 
−
 
 
−
Name: OWASP SecureTea Tool Project
 
−
 
 
−
  Purpose:  The OWASP SecureTea Project is a application designed to help Secure a person's laptop or computer with IoT (Internet Of Things) for notify users via twitter, whenever anyone accessing his laptop or computer. This application work using the touchpad / mouse / wireless mouse and developed in python. The purpose of this application is to warn the user (on twitter) whenever her laptop accessible. This small application was developed and tested in python in linux machine likely to be working well in the Raspberry Pi as well.
 
−
 
 
−
  License: OWASP SecureTea Project is free software, released under the GNU GPL v3 License.
 
−
 
 
−
who
 
−
is working on this project?
 
−
 
 
−
Project Leader(s):
 
−
  Gustavo Nieves Arreaza @       
 
−
                 
 
−
 
 
−
how
 
−
can you learn more?
 
−
 
 
−
Project Pamphlet: Not Yet Created
 
−
 
 
−
Project Presentation:
 
−
 
 
−
Mailing list: N/A
 
−
 
 
−
Project Roadmap: Not Yet Created
 
−
 
 
−
 
 
−
 
 
−
Key Contacts
 
−
 
 
−
 
−
 
−
Contact  Gustavo Nieves Arreaza @ to contribute to this project
 
−
 
 
−
Contact  Gustavo Nieves Arreaza @ to review or sponsor this project
 
−
 
 
−
Contact the GPC to report a problem or concern about this project or to update information.
 
−
 
 
−
 
 
−
 
 
−
 
 
−
 
−
  current release
 
−
 
 
−
 
 
−
 
 
−
1.0
 
−
 
−
 
 
−
  last reviewed release
 
  
 +
=Project Participants=
  
−
1.0
+
* [https://www.owasp.org/index.php/User:Adrian_Winckles Adrian Winckles]
−
+
* Mark Graham
 +
* Andrew Moore
 +
* Artur Zaremba (Intern)
 +
* [https://www.owasp.org/index.php/Special:Contributions/Felipe_Zipitria Felipe Zipitria]
 +
* [https://www.owasp.org/index.php/User:Tin_Zaw Tin Zaw]
 +
* [https://www.owasp.org/index.php/User:Chaim_sanders Chaim Sanders]
 +
* [https://www.owasp.org/index.php/User:Ali_Razmjoo Ali Razmjoo]
  
 +
__NOTOC__ <headertabs />
  
−
   
+
[[Category:OWASP Project]]  
−
  other releases
+
[[Category:OWASP_Builders]]
 +
[[Category:OWASP_Defenders]]  
 +
[[Category:OWASP_Tool]]

Latest revision as of 12:26, 15 December 2018

OWASP Project Header.jpg

OWASP Honeypot Project Background

Scientists at National Institute of Science and Technology claim that 92% of security vulnerabilities lie within the applications; handing the advantage over to the cyber-thieves. Many of these bugs can be eliminated simply by improving the code in which the software applications are written. The UK government estimates that the cost from cyber-attacks to be on average around £310,000 for a UK SME per annum, with almost 1 million UK SMEs having suffered from a data breach in 2017. SMEs are 70% more likely to be attacked than larger organisations, simply because they lack the ability to protect themselves. Regulations such as GDPR (which replaced the Data Protection Act in May 2018) exist to enforce that organisations protect data. Yet little in the way of understanding the threat exposures exist, with even less guidance on how to protect against the risks.

The web application Defender's community already exists. Not-for-profit charitable organisations such as OWASP (Open Web Application Security Project) raison d’etre is to provide an open source community to help organisations develop safer software applications that can be trusted to be secure against criminal attack. TSI (the Trusted Software Initiative) and OWASP create educational information on how software should be written and some of the more obvious bugs that are left open to give attackers access to confidential information.

Introduction

Researchers are beginning to realise that by “watching” how Internet criminals behave, we can learn directly from their work flow activities, and use this information to protect ourselves. The past 20 years of research into Internet security, has made internal hosting infrastructures more secure, especially in large businesses. So today, Internet criminals take advantage of bugs in the software applications themselves. These bugs originate wholly because software has been poorly written and designed.

Large businesses may already employ a team of people to evaluate and protect any software facing the Internet. However, a key area lacking protection are the millions of smaller businesses worldwide that trade via the Internet, right down to the one person hobby-business selling products from home on eBay.

This project is about collecting and maximising intelligence from the cyber-battlefield that exists between attackers with criminal intent and the people creating the software upon which the Internet runs. By collecting intel on what the criminals are doing, we can define rules for writing software that can be fed back to the front line troops writing the code, so they can close these bugs and other vulnerabilities in their software. An attacker only needs to be lucky once, whereas we need to be lucky in protecting against all attacks, all of the time. By sharing the findings from our reconnoitres out in the field, this project provides educational information back to the community of software coders, be they professional developers or school kids working in their bedrooms. Today, the advantage lies clearly with the attackers. With this kind of threat information we take the advantage back into the hands of the defenders.

Description

The goal of the OWASP Honeypot Project is to identify emerging attacks against web applications and report them to the community, in order to facilitate protection against such targeted attacks. Within this project, Anglia Ruskin University is leading the collection, storage and analysis of threat intelligence data.

The purpose of this part of the project is to capture intelligence on attacker activity against web applications and utilise this intelligence as ways to protect software against attacks. Honeypots are an established industry technique to provide a realistic target to entice a criminal, whilst encouraging them to divulge the tools and techniques they use during an attack. Like bees to a honeypot. These honeypots are safely designed to contain no information of monetary use to an attacker, and hence provide no risk to the businesses implementing them.

The project will create honeypots that the community can distribute within their own networks. With enough honeypots globally distributed, we will be in a position to aggregate attack techniques to better understand and protect against the techniques used by attackers. With this information, we will be in a position to create educational information, such as rules and strategies, that application writers can use to ensure that any detected bugs and vulnerabilities are closed.

Project progression:

  1. Honeypot software. The honeypot software that is to be provided to the community to place in their networks has been written. Honeypots are available in a variety of forms, to make deployment as flexible as possible and appeal to a diverse a user set as possible.
  2. Collection software. The centralised collection software has been written and evaluated in a student driven proof-of-concept project. Honeypots have been attacked in a laboratory situation and have reported both the steps taken by the attacker and what they have attacked, back to the collection software.
  3. Rollout to the Community. The project now needs a dedicated infrastructure platform in place that is available to the entire community to start collecting intelligence back from community deployed honeypots. This infrastructure will run the collector software, analysis programmes and provide a portal for communicating our finds and recommendations back to the community in a meaningful manner.
  4. Going Forward. Toolkits and skills used by attackers do not stand still.  As existing bugs are plugged, others open. . Follow up stages for the project will be to create a messaging system to automatically update the community on findings of significant risk in their existing code that requires attention.

What is the OWASP Honeypot Project?

The OWASP Honeypot Project provides:

  • Real-time, detailed Web Application Attack Data
  • Threat Reports to the community

News and Events

Project Resources

Project Leader

Related Projects

Licensing

Classifications

Project Type Files TOOL.jpg
Incubator Project Owasp-builders-small.png
Owasp-defenders-small.png
Affero General Public License 3.0

How can I participate in your project?

All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

If I am not a programmer can I participate in your project?

Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator. See the Road Map and Getting Involved tab for more details.

Contributors

Roadmap

As of August, 2018, the priorities for the next 6 months are:

  • Setup Proof of Concept to understand how Mod Security baed Honeypot/Probe interacts with a receiving console (develop a VM and/or Docker based test solution to store logs from multiple probes).
  • Evaluate console options to visualise threat data received from ModSecurity Honeypots/probes in MosSecurity Audit Console, WAF-FLE, Fluent and bespoke scripts for single and multiple probes.
  • Develop a mechanism to convert from stored MySQL to JSON format.
  • Provide a mechanism to convert ModSecurity mlogc audit log output into JSON format.
  • Provide a mechanism to convert mlogc audit log output directly into ELK (ElasticSearch/Logstash/Kibana) to visualise the data.
  • Provide a mechanism to forward honest output into threat intelligence format such as STIX using something like the MISP project
  • (https://www.misp-project.org) to share Threat data coming from the Honeypots making it easy to export/import data from formats such as STIX and TAXII., may require use of concurrent logs in a format that MISP can deal with.
  • Consider new alternatives for log transfer including the use of MLOGC-NG or other possible approaches.
  • Develop a new VM based honeypot/robe based on CRS v3.0.
  • Develop new alternative small footprint honeypot/probe formats utilising Docker & Raspberry Pi.
  • Develop machine learning approach to automatically be able to update the rule set being used by the probe based on cyber threat intelligence received.

Getting Involved

Involvement in the development and promotion of the Web Honeypot Project is actively encouraged!

You do not have to be a security expert or a programmer to contribute.

Some of the ways you can help are as follows:

  • Coding aspects of CRS/JSON
  • Working on Component Integration
  • Deploying a Honeypot/Probe
  • Testing
Retrieved from "https://wiki.owasp.org/index.php?title=OWASP_Honeypot_Project&oldid=246075"