Free Honeypot Client Could Sting Malware

March 27, 2008 – 2:30 PM

The Honeynet Project has released a new freebie honeypot client tool that lets security pros and researchers automatically detect and dissect bot infections and other malware attacks on client machines.

Capture-HPC v2.1 is an updated and enhanced version of the Honeynet Project’s high-interaction Capture-HPC client honeypot, which the organization last year used to study over 300,000 URLs from around 150,000 hosts for malicious intent. But this new client honeypot is 500 percent faster, and collects network traffic for all client-server interactions. 

The new client has many potential uses. It can be deployed as an intrusion detection sensor on a Website or as a pure honeypot to capture and vet all URLs that arrive via email, for instance.

“A Website operator could use it to crawl his own Website as an intrusion detection sensor. If he detects a client-side attack from his own Website using Capture, he can conclude that his site was compromised and is now serving malware code,” says Christian Seifert, a researcher from Victoria University in New Zealand, a member of Honeynet Project, and a co-developer of the tool. “An administrator could pipe all URLs received on their email system to a capture system.”

And unlike the previous version of the honeypot, one box is enough. “Client honeypots struggle with the vast number of servers they need to inspect to find client-side attacks, so usually one needed to set up multiple instances of Capture to look at a sample of sufficient size,” Seifert says. But Version 2.1 allows just one box running Capture to collect malware data, he says.

Version 2.1 also supports third-party applications, such as various browser types, office apps, and media players, and includes a plug-in option for porting additional apps to it as well.

“While the previous version allowed [you] to automatically crawl the Web as well, this new version is much faster, collects more data, and is able to detect attacks on a wider range of client applications,” Seifert says.

With the streamlined server resources and some new reporting features, Capture-HPC is now more enterprise-friendly for organizations that want to be more proactive about Web-borne attacks on their client machines. “The ease of use of Capture-HPC allows enterprise security personnel the ability to deploy and collect malware from ‘drive-by’ malicious sites,” says Ralph Logan, global Honeynet chapter lead. “Then all they do is block those Websites and mark them as ‘bad.’”

Source: Dark Reading