Build A Darknet To Capture Naughty Traffic 266
DM_NeoFLeX writes "Have some routable Address Space lying around? You might want to build a DarkNet. The folks over at Team Cymru have outlined instructions for creating one with FreeBSD and as little as /32 routable space. From the article: 'A Darknet is a portion of routed, allocated IP space in which no active services or servers reside. These are 'dark' because there is, seemingly, nothing within these networks. Any packet that enters a Darknet is by its presence Aberrant.' Darknets can provide useful information for tracking the flow of naughty network traffic."
Luke (Score:5, Funny)
Re:Luke (Score:3, Interesting)
Doesn't the term "Darknet" also refer to a collection of networks and other technologies that enable people to share files with little or no fear of detection?
Re:Luke (Score:5, Funny)
Naw... thats called the Internet.
(I didn't say they shouldn't be afraid, but don't seme to be)
Re:Luke (Score:5, Informative)
The term "Darknet" is cited in this [wordspy.com] sense frequently. It was first used by Patrick Ross in Nov. 2002
Thanks, though.
Re:Luke (Score:3, Informative)
Yes, that's a usage I've seen too, for example in this article in Slate. [msn.com]
Re:Luke (Score:2, Funny)
Build a DorkNet (Score:5, Funny)
The comments that follow are time-stamped proof of what you were all doing during working hours...
Already been done... (Score:5, Funny)
Actually, we have had these for about that long... (Score:5, Informative)
Down at SDSC they have a little less than 1% of ALL of the routable IP space dedicated to doing this stuff. They call it a network telescope, and use it to study DOS activity and stuff.
http://www.caida.org/analysis/security/telescop
"Inferring Internet Denial-of-Service Activity" [2001] is good reading.
Re:Already been done... (Score:2)
Re:Already been done... (Score:2, Funny)
Re:Already been done... (Score:2, Funny)
I'm getting tired of being accused of having derivative code for every blackout we spawn however. We have not used any of SCOs code in development of our own blackouts.
Darknets = P2P (Score:5, Informative)
http://www.wordspy.com/words/darknet.
Re:Darknets = P2P (Score:3, Insightful)
With all that said, honeynet would seem be a more sensible term for a network like this. It's even sticky, which means people will be getting caught in it more readily, which is pre
Re:Darknets = P2P (Score:4, Insightful)
You sound like my roommate, anything He hasn't heard of isn't legitimate or good enough, which is funny since he won't even accept as valid terms that are listed in the Jargon File)
Re:Darknets = P2P (Score:3, Interesting)
My not having heard of it doesn't make it "not good enough", there are plenty of more logical reasons for that. My not having heard of it is enough
Re:Darknets = P2P (Score:4, Funny)
Nicely put, though it applies to half of the tech journalist types out there.
Re:Darknets = P2P (Score:4, Interesting)
[snippet]
A Darknet is a portion of routed, allocated IP space in which no active services or servers reside. These are "dark" because there is, seemingly, nothing within these networks.
A Darknet does in fact include at least one server, designed as a packet vacuum. This server gathers the packets and flows that enter the Darknet, useful for real-time analysis or post-event network forensics.
Any packet that enters a Darknet is by its presence aberrant. No legitimate packets should be sent to a Darknet. Such packets may have arrived by mistake or misconfiguration, but the majority of such packets are sent by malware. This malware, actively scanning for vulnerable devices, will send packets into the Darknet, and this is exactly what we want.
[/snippet]
Think this kind of scenario...
A computer gets some form of malware on it that scans random addresses in its attempt to find vulnerable hosts. I'm going to use the name Blaster for this fictional bug...
Now lets assume that the IP for your darknet box is aaa.bbb.ccc.ddd. If the bug randomly chooses your box (which isn't entirely unlikely) to scan, you will instantly know something is up. We're not talking "Oh no the evil **AA is after us!" (where ** is any two letters). We're talking more "Hmmm... Someone is trying to send data to an address that as far as anyone knows doesn't have any device on it." It's safe to consider a box compromised if they try to send data to an address that isn't used.
Nitpickers Anonymous. (Score:2, Informative)
Or at least, it's only really client-server in passive mode. The rest of the time, it's two servers talking to each other in the dumbest, most broken way imaginable.
(And if you have no idea what I'm talking about, examine the mechanics of the PORT command. And understand why firewall designers the world over just wish everybody would switch to WebDAV over HTTPS, or sftp, or some other equivalent, so we could pretend FTP never existed.)
Re:Darknets = P2P (Score:3, Informative)
"Darknets" at least as described here, are not set up to be juicy targets. Technically they shouldn't be targets in the least. They are to all appearances dead IP addresses, hence calling them "dark." This method doesn't catch the perpetrator in the act. Most of what it does is watch for IPs tha
So hows this work now? (Score:3, Interesting)
Re:So hows this work now? (Score:5, Funny)
Easy by monitoring for traffic with the evil bit set [rfc.net] which will either be originating from hell [bofh.net] or going there [go.to] :)
Re:So hows this work now? (Score:5, Funny)
Re:So hows this work now? (Score:3, Informative)
Re:So hows this work now? (Score:4, Informative)
The equivalents in Linux would be ipchains and iptables, I do believe. (My firewall's FreeBSD, never touched any Linux firewall rules.)
These tools allow you to log raw packets. Handy.
Use this for... (Score:3, Informative)
Re:Use this for... (Score:2)
<img src="darknet.ip.address.here/file.jpg"> and blacklist everyone who shows up to your site.
Nothing really new here... (Score:5, Informative)
You can assign it any IP and port combination, and it will ACK for any SYN's sent to it, whether there's a real server running on that IP or not. Such 'unsolicited' connections are a bad-traffic giveaway.
Re:Nothing really new here... (Score:2, Interesting)
The IDP is a very impressive piece of technology. A very good complement to a Layer 3 firewall.
-Scott
Really . . . (Score:5, Insightful)
That's like the mailman trying to deliver letters to Santa Claus, or somebody addressing a letter wrong, thank good I know all those letters are Abberant now.
Re:Really . . . (Score:3, Informative)
Re:Really . . . (Score:2)
Re:Really . . . (Score:5, Interesting)
These centers are the only part of the postal system allowed to open letters intentionally... as the privacy concern goes out the window in one last ditch attempt to try to figure out where it should be going. Any property that ends up there and has no address indications inside ends up going up for auction. Some charities take the letters addressed to Santa to find ones that indicate particularly needy families and grant wishes.
Snail mail just can't drop packets on the floor as easily...
Re:Really . . . (Score:4, Insightful)
Not only that, but I'm betting a dramatically higher percentage of snailmail packets are misdelivered than IP packets. I am constantly getting mail for my neighbors in unit A in my mailbox, unit B. One wonders if it's my mail carrier or the mail sorters. It's not that they're getting the mailboxes confused, because I get my mail in there at the same time, it's an issue with sorting.
Re:Really . . . (Score:2)
Yes, especially mail-in rebates
Re:Really . . . (Score:5, Insightful)
Quite the contrary; it's far easier to drop a letter on the floor. A letter has mass.
Re:Really . . . (Score:2)
Umm, no. Photons do NOT have mass. And electricity is the movement of electrons. Movement doesn't have mass.
Santa has an address (Score:4, Informative)
North Pole, Canada
H0H 0H0
If you write Santa at this address, he will write back. Not 100% sure USPS will send it over the border, but if they do, it'll work.
( Canada Post sends out replies to children each year; I think employees at the post office volunteer and take the time to hand-craft a personal reply to each and every letter, though they may be auto-generated nowadays, i am not certain ).
Re:Santa has an address (Score:4, Funny)
"OMG! They slashdotted Santa!"
"Those bastards!"
The power of the Darknet (Score:2)
Very Interesting (Score:4, Interesting)
I like the idea, and wish I had the corporate status to consider an implementation at my company.
Re:Very Interesting (Score:2, Redundant)
Re:Very Interesting (Score:2)
When you think about it, it makes sense that a honeypot could do this in its normal course of operation, since most unwanted traffic is not specifically aimed at you, but rather just someone looking for something to do, if it wasn't able to respond to random pings like this, its useless for most of the unwanted traffic you want it to absorb.
Re:Very Interesting (Score:3)
Going by the junk mail I receive in my domain site, you don't even need a valid E-mail address. The spammers just create a @yourdomain.com address and take their chances with a catch all E-mail address.
Re:Very Interesting (Score:5, Interesting)
You don't need to be a big company to do this, just a little savvy and a DSL line. I've been doing like this for a while with my DSL router's firewall which has a feature to copy any traffic matched by a rule to the LAN with the target set to an arbitrary MAC address. I have it setup so that any traffic targetted at my unused IPs gets directed to a bogus MAC on the LAN where it gets directed by my switch to be captured by an old laptop. With the flick of a few config files, I can get a honeypot running too, so I can get a little more than the initial "SYN" of TCP sessions.
You get some fascinating stuff. My IP space is a few class B's away from some allocated to S. Korea, and a few months ago I saw someone testing a worm exploiting MS-DS in real time. The scriptkiddie had obviously made a typo, because instead of port 445 the traffic was hitting 455, but the traffic was clearly trying to cause use a known buffer overflow and was coming from a dozen or so IPs all within a single ISP.
Unfortunately, the email I sent to the ISP's NOC listing the source IPs didn't get acted on in time. After about an hour the guy must have corrected the error and the traffic switched to port 445 and the number of source IPs started to grow... I never did find out precisely which one of the many, many, MS-DS exploits circulating at the time this one was though. :(
Re:Very Interesting (Score:4, Informative)
The Tecra is currently running Fedora Core 1 with IPTables enabled and a bunch of IDS and traffic capture tools installed. Finally, I have modified numerous scripts to seamlessly enable and disable IP on the box if I want to run the Honeypot or anything else that requires a real IP address - I have enough IPs that I don't need to bother with NAT. There is also some basic checking in place to make sure if I run two scripts that would bring up the IP interface then shut the first down, it doesn't bring down the IP interface with it.
Re:Very Interesting (Score:2)
I want one! (Score:4, Funny)
I can hear the cry of the children everywhere!
Oh yeah! and whats an IP?
The Box is Open
But then (Score:5, Insightful)
Re:But then (Score:3, Interesting)
Analyzing the Witty worm with a massive darknet (Score:5, Informative)
Re:Analyzing the Witty worm with a massive darknet (Score:3, Informative)
ARIN (Score:3, Funny)
Re:ARIN (Score:5, Informative)
I'm Mr. Huge ISP, with gobs of class B's and class C's already allocated to me, the routes for these subnets already advertised on the backbone as coming to me, I might as well do something with the space until I can put some servers there later.
Fire up a Juniper IDP and configure it for those unused networks. Then when bad guys come a'callin', you'll be able to log or block as you like.
Re:ARIN (Score:2)
I'm sure they will not be happy if Mr. Huge ISP run a darknet and then goes back for more ips because they made the darknet too big.
Re:ARIN (Score:2)
The idea is that if you need more IPs, you re-allocate some of those you were using for the Darknet. Only when you are exhausted of IPs (meaning no more Darknet left to pilfer) do you go to IANA and request another block.
Re:ARIN (Score:5, Informative)
And of course, if you don't document who's using what, they don't do anything about it anyways. God help you if you want more IPs, though.
Re:ARIN (Score:2)
Re:ARIN (Score:5, Funny)
HoneyPot? (Score:5, Insightful)
-molo
Re:HoneyPot? (Score:5, Interesting)
Yeah, agreed, but.....
I think motivation is important here. Honeypots by their nature are designed to entice black hats into attacking them...so that the owner of the honeypot can analyse what the latest and greatest black hats are going to look for, exploit etc
A darknet setup is passive in that it logs aberrant traffic. It tells you when something out there is actively scanning large gobs of your address space.
Ever played with Snort\ACID and a ruleset from somewhere like Whitehats [whitehats.com] on a live user subnet ? You get so many false positives that you start to pare down your ruleset. You keep doing this until you start to question the validity of the IDS in the first place.
I think this idea has some real utility....even if it is just to create another dataset to throw at MRTG !!
aka blackhole networks (Score:5, Informative)
Darknet used as filter. (Score:5, Insightful)
As an example. Setup a darknet on the following IPs:
DARK_A : 204.210.34.1
DARK_B : 204.210.34.3
Setup the real server mathematically between the two darknet IP addresses:
REAL : 204.210.34.2
Now have DARK_A & DARK_B contact REAL whenever DARK_A or DARK_B receive any packets. REAL can be setup to, on the fly, filter out any packets received from the same source as the DARK servers reported.
In a sense you're creating a realtime blacklist. You can set the list on a timed delay to expire. Or even filter out specific packet signatures instead of entire suspect IP addresses.
just a thought...
Joseph Elwell
Re:Darknet used as filter. (Score:5, Interesting)
Re:Darknet used as filter. (Score:3, Insightful)
Re:Darknet used as filter. (Score:3, Funny)
That actually sounds like a good geek drinking game.
Re:Darknet used as filter. (Score:5, Funny)
I see you've played this game before.
Re:Darknet used as filter. (Score:5, Informative)
Re:Darknet used as filter. (Score:2, Insightful)
Realtime blacklists are lovely tools for denial-of-service attacks. Probably why you don't see more of them out there.
Re:Darknet used as filter. (Score:5, Informative)
To paraphrase a smart person (can't remember who), when you let the bad guys write your firewall rulesets for you, bad things could happen.
When you actively block things based on preceived bad traffic, you are in essence allowing the bad person to write some rules for you.
Imagine if your attacker knew your default route and sent some spoofed packets to
Best of luck.
Darknet not needed (Score:5, Insightful)
Seriously, though... I have a spare wireless router set up at work that's easily hacked, easily found, and logs every damn thing that touches it. Our real wireless network is obscured, encrypted, mac filtered, etc. I realize it's not technically the same thing as the post describes (I guess you'd call it a honeypot network or something) but it's the same idea.
Of course, nobody will care if a hacker makes his way into our network (honeypot or not) unless he does some "damage."
Re:Darknet not needed (Score:3, Informative)
A honeypot is a server that appears to be riddled with security holes. What you have isn't a server, so not a honeypot.
A darknet is an IP-addressable network that appears to be not in use. What you have isn't IP-addressable, so not a darknet. We need a new phrase :)
Dark* (Score:2)
HoneyPots (Score:4, Interesting)
Re:HoneyPots (Score:3, Informative)
darknet seems to be logging traffic to the undefined addresses instead of dropping packets on the floor or sending icmp error responses. darknets don't appear to actually respond to traffic (analyzing worms / automated tools, no intelligence behind them).
I would have thought... (Score:4, Funny)
I don't get the complexity (Score:5, Informative)
For example, say you have a Linux system in a colo somewhere (or on the end of a T-1 or some other >1 IP address static network). You have some IP addresses assigned to you that are otherwise not assigned. Here is how you can get all of the darknet functionality with your standard server.
Some example numbers (none of which are real)
Unused address to watch: 10.11.12.13
Interface on which you receive traffic: eth0
A fake interface to route to: tap0
Configure your server to ARP the extra addresses:
arp -Ds 10.11.12.13 eth0 -i eth0 pub
Setup a "tap" device to route the traffic to
tunctl -u nobody -t tap0
ifconfig tap0 10.11.12.13 netmask 255.255.255.0 broadcast 10.11.12.255 up
Setup a "route" to the device
ip route add 10.11.12.13 dev tap0
At this point the traffic should all route to the fake device tap0. You can run tcpdump on this, setup IP filter chains, run MRTG on it directly, etc. All without any extra hardware.
For those that work with UML (User Mode Linux), you already recognize this is exactly how you setup virtual UML networks.
This is also somewhat related to "tar pits" that just answer connect requests to addresses that have un-completed ARP requests.
Have fun.
Re:I don't get the complexity (Score:2, Informative)
Your idea of binding addresses through arp works almost as well, but it is not the same. Once you bind an address through arp, the interface will respond to arp requests. This goes against the author's idea of having absolutely no outbound on the sniffing interface. You can probably get along without it, but it's nice to be able to put up firewall rules that block all outbound and inbound traffic of all types on the sniffer interface, so that you know that anything you collect is genuine Bad Data.
Also
Re:I don't get the complexity (Score:4, Interesting)
A couple of other points here. ARP does not actually create any extra traffic on the interface that is being watched. In this example, the ARP goes from eth0 to the upstream router. You are packet sniffing tap0. Thus tap0 will show absolutely zero outbound traffic (it cannot because there is no "client" application talking to it). Regardless, we are talking about IP here. If you have traffic reaching your interface that it not IP (and ARP is not IP), just why did the router forward it to you anyway.
If you have a lot of nets that need to be routed this way, you can still do it. There is nothing wrong with static routes that go thru 5 systems on the way to the tap device. These can cross local LAN segments and provided there are no firewall rules that disallow it, the effect is the same.
If your purpose is to dedicate resources to this project, then the dedicated network solutions is best. Otherwise, the virtual network solutions that use 'arp' and 'tap' devices gets you 100% of the same traffic to analyze.
My "best" choice if you want to watch a "lot" of addresses would be to run something like LaBrea that responds to "un ARPed" packets. This could be mangled to automatically setup the interface to forward unused addresses within the current block to a tap device. I have not tried this, but it would be fun and not too hard to implement.
AKA Network Telescopes (Score:5, Informative)
Also, see the NANOG guide to setting them up here [nanog.org], and the home for the CAIDA/UCSD telescope here [caida.org].
So in short, nice job to the Welsh for implementing it, but there's bigger elsewhere for y'all to play with.
IPv6 (Score:5, Interesting)
This is in no way an argument against IPv6, I'm eagerly awaiting it - I'm just curious...
Re:IPv6 (Score:4, Insightful)
Seems the purpose is to monitor IP scanning activity - something wholly impractical with IPv6.
Re:IPv6 (Score:3, Interesting)
Brute force scanning, yes. But plug into the IANA/ARIN/etc databases and you can narrow it down quite a bit.
HoneyNet... (Score:2)
Darknet, invite naughty traffic on your net today! (Score:5, Informative)
An IDS is only so efficient, you need to first really understand your network before deploying, and even after deployment, this is only the beginning.
We have been using Darknets, or honeypots for sometime, an excellent combination of tools, see Snort [slashdot.org], ACID (Analysis Console for Intrusion Databases [sourceforge.net]
As said before and in the article, this is a sophisticated set of tools and you need to understand your network, or you will find yourself chasing ghosts, Enter the Darknet (Honeypot).
Combined with the other tools, we have been using Honeyd [honeyd.org], an excellent honeypot, simple to get up an going and very configurable.
Snort.org [snort.org] has an excellent howto documentation [snort.org] to get the IDS up an going, then you can add the honeypot.
It can be downright humorous how quickly you will begin to capture useful information. In addition, adding scripts to interact with the traffic will allow you to keep the user busy while you are collecting data, or Tarpitting the traffic making the port "sticky" dragging the connections, another good one would be LeBrea [hackbusters.net].
If you have any interest in network security, or simply want to monitor your home network, you need to take a look at darknet, or any of the other tools mentioned.
Life imitating art again? (Score:2)
Weird.
And then what? (Score:4, Funny)
Re:Slashdot "punishment" problem (Score:2, Insightful)
I have read thousands of Slash posts, and I promise you that being funny has never been a problem.
Seriously. I've read Dilbert and User Friendly, and what passes for +1 Funny with you folks isn't. It's complaining with community tech jargon thrown in, or it's complaining, or it's misuse of community jargon by outsiders.
I'm not the only one who's made this observation. You guys need a serious humor overhaul. Look to some humor sources from better-adjusted people to
Re:Very cool! (Score:3, Funny)
Re:Very cool! (Score:5, Informative)
If it seems like you've heard it before, you probably have, its similar if not the same thing to a honeypot/net.
Re:like anyone here as a /32 ip block (Score:3, Funny)
Re:like anyone here as a /32 ip block (Score:2)
192.168.1.23/32 is still an ip address.
Re:like anyone here as a /32 ip block (Score:2, Funny)
Re:like anyone here as a /32 ip block (Score:4, Informative)
Maybe you should have learned networking before posting that. You have a
Hey loser...I've got a /8 block (Score:3, Funny)
but I control it...and that's what's important.
Ok, well...yes, I only control it on my side of the router...
sniff...nevermind
True (Score:2)
Re:Am I the only one (Score:2, Informative)
Waitaminute !
Flash withdrawls? (Score:2)
Re:Am I the only one (Score:2, Insightful)
Re: (Score:3, Interesting)