OWASP Honeypot Project

• Main
• FAQs
• Acknowledgements
• Road Map and Getting Involved
• Minimum Viable Product
• Project About

OWASP Honeypot Project Background Scientists at National Institute of Science and Technology claim that 92% of security vulnerabilities lie within the applications; handing the advantage over to the cyber-thieves. Many of these bugs can be eliminated simply by improving the code in which the software applications are written. The UK government estimates that the cost from cyber-attacks to be on average around £310,000 for a UK SME per annum, with almost 1 million UK SMEs having suffered from a data breach in 2017. SMEs are 70% more likely to be attacked than larger organisations, simply because they lack the ability to protect themselves. Regulations such as GDPR (which replaced the Data Protection Act in May 2018) exist to enforce that organisations protect data. Yet little in the way of understanding the threat exposures exist, with even less guidance on how to protect against the risks. The web application Defender's community already exists. Not-for-profit charitable organisations such as OWASP (Open Web Application Security Project) raison d’etre is to provide an open source community to help organisations develop safer software applications that can be trusted to be secure against criminal attack. TSI (the Trusted Software Initiative) and OWASP create educational information on how software should be written and some of the more obvious bugs that are left open to give attackers access to confidential information. Introduction Researchers are beginning to realise that by “watching” how Internet criminals behave, we can learn directly from their work flow activities, and use this information to protect ourselves. The past 20 years of research into Internet security, has made internal hosting infrastructures more secure, especially in large businesses. So today, Internet criminals take advantage of bugs in the software applications themselves. These bugs originate wholly because software has been poorly written and designed. Large businesses may already employ a team of people to evaluate and protect any software facing the Internet. However, a key area lacking protection are the millions of smaller businesses worldwide that trade via the Internet, right down to the one person hobby-business selling products from home on eBay. This project is about collecting and maximising intelligence from the cyber-battlefield that exists between attackers with criminal intent and the people creating the software upon which the Internet runs. By collecting intel on what the criminals are doing, we can define rules for writing software that can be fed back to the front line troops writing the code, so they can close these bugs and other vulnerabilities in their software. An attacker only needs to be lucky once, whereas we need to be lucky in protecting against all attacks, all of the time. By sharing the findings from our reconnoitres out in the field, this project provides educational information back to the community of software coders, be they professional developers or school kids working in their bedrooms. Today, the advantage lies clearly with the attackers. With this kind of threat information we take the advantage back into the hands of the defenders. Licensing

Description The goal of the OWASP Honeypot Project is to identify emerging attacks against web applications and report them to the community, in order to facilitate protection against such targeted attacks. Within this project, Anglia Ruskin University is leading the collection, storage and analysis of threat intelligence data. The purpose of this part of the project is to capture intelligence on attacker activity against web applications and utilise this intelligence as ways to protect software against attacks. Honeypots are an established industry technique to provide a realistic target to entice a criminal, whilst encouraging them to divulge the tools and techniques they use during an attack. Like bees to a honeypot. These honeypots are safely designed to contain no information of monetary use to an attacker, and hence provide no risk to the businesses implementing them. The project will create honeypots that the community can distribute within their own networks. With enough honeypots globally distributed, we will be in a position to aggregate attack techniques to better understand and protect against the techniques used by attackers. With this information, we will be in a position to create educational information, such as rules and strategies, that application writers can use to ensure that any detected bugs and vulnerabilities are closed. Project progression: Honeypot software. The honeypot software that is to be provided to the community to place in their networks has been written. Honeypots are available in a variety of forms, to make deployment as flexible as possible and appeal to a diverse a user set as possible. Collection software. The centralised collection software has been written and evaluated in a student driven proof-of-concept project. Honeypots have been attacked in a laboratory situation and have reported both the steps taken by the attacker and what they have attacked, back to the collection software. Rollout to the Community. The project now needs a dedicated infrastructure platform in place that is available to the entire community to start collecting intelligence back from community deployed honeypots. This infrastructure will run the collector software, analysis programmes and provide a portal for communicating our finds and recommendations back to the community in a meaningful manner. Going Forward. Toolkits and skills used by attackers do not stand still.  As existing bugs are plugged, others open. . Follow up stages for the project will be to create a messaging system to automatically update the community on findings of significant risk in their existing code that requires attention.

What is the OWASP Honeypot Project? The OWASP Honeypot Project provides: Real-time, detailed Web Application Attack Data Threat Reports to the community News and Events Project Resources Project Leader Adrian Winckles Related Projects Classifications

How can I participate in your project?

All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

If I am not a programmer can I participate in your project?

Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator. See the Road Map and Getting Involved tab for more details.

Contributors

The OWASP Tool Project Template is developed by a worldwide team of volunteers. A live update of project contributors is found here.

The first contributors to the project were:

• Colin Watson who created the OWASP Cornucopia project that the template was derived from
• Chuck Cooper who edited the template to convert it from a documentation project to a Tool Project Template
• YOUR NAME BELONGS HERE AND YOU SHOULD REMOVE THE PRIOR 3 NAMES

Roadmap

As of November, 2013, the highest priorities for the next 6 months are:

• Complete the first draft of the Tool Project Template
• Get other people to review the Tool Project Template and provide feedback
• Incorporate feedback into changes in the Tool Project Template
• Finalize the Tool Project template and have it reviewed to be promoted from an Incubator Project to a Lab Project

Subsequent Releases will add

• Internationalization Support
• Additional Unit Tests
• Automated Regression tests

Getting Involved

Involvement in the development and promotion of Tool Project Template is actively encouraged! You do not have to be a security expert or a programmer to contribute. Some of the ways you can help are as follows:

Coding

We could implement some of the later items on the roadmap sooner if someone wanted to help out with unit or automated regression tests

Localization

Are you fluent in another language? Can you help translate the text strings in the Tool Project Template into that language?

Testing

Do you have a flair for finding bugs in software? We want to product a high quality product, so any help with Quality Assurance would be greatly appreciated. Let us know if you can offer your help.

Feedback

Please use the Tool Project Template project mailing list for feedback about:

• What do like?
• What don't you like?
• What features would you like to see prioritized on the roadmap?

The Tool Project Template must specify the minimum set of tabs a project should have, provide some an example layout on each tab, provide instructional text on how a project leader should modify the tab, and give some example text that illustrates how to create an actual project.

It would also be ideal if the sample text was translated into different languages.

Addtional Instructions for making changes:

The About 'tab' on that page is done with a MediaWiki template. If you log into the wiki page for your project and click the "Edit" button/link/tab in the top-right between 'Read' and 'View History', you'll see the edit page for the main body of your project page.

If you scroll down below the form to edit that page (below the "Save page", "Show preview", "Show changes" buttons, you'll see some text with a triangle in front of it reading "Templates used on this page:" A list will expand if you click on the triangle/text to show the templates that make up this page. The one you want is the "Projects/OWASP Example Project About Page" - click the (edit) next to this to edit that template. The direct link is: https://www.owasp.org/index.php?title=Projects/OWASP_Example_Project_About_Page&action=edit

The template takes 'input' that are key/value pairs where you'll need to edit the stuff after the equals (=) like: project_name =Place your project name here.

You'd edit the bold bit.

PROJECT INFO What does this OWASP project offer you?	RELEASE(S) INFO What releases are available for this project?
what is this project? Name: N/A Purpose: N/A License: N/A who is working on this project? Project Leader(s): N/A how can you learn more? Project Pamphlet: Not Yet Created Project Presentation: Mailing list: N/A Project Roadmap: Not Yet Created Key Contacts Contact the GPC to contribute to this project Contact the GPC to review or sponsor this project	current release pending last reviewed release pending other releases