A Bad Day For A Threat Actor by Dónnan Mallon

### Overview In this talk, security analyst Dónnan Mallon (NCC Group, formerly Quorum Cyber) provides an in-depth introduction to honeypots, examining their history, operational types, defensive utility, and implementation. Mallon explains how honeypots serve as deception-based detection mechanisms designed to be probed, attacked, and intentionally compromised. By tricking adversaries, security teams can detect intrusions, identify internal and external threats, gather threat intelligence, and increase attacker dwell frustration while minimizing dwell time.

### Key Topics - **Honeypot Classifications**: Honeypots are categorized into honeytokens (mimicking legitimate data like spreadsheets or databases with passwords), honey services (emulating protocols such as SSH, FTP, HTTP, or SMTP), and honey systems (mimicking complete operating systems like Windows 10 or Red Hat Linux). - **Levels of Interactivity**: Honeypots range from low interaction (decoy detection mechanisms operating like an IDS with low risk) to high interaction (allowing deeper adversary engagement and command execution, but carrying higher operational risk if fully compromised). - **Historical Evolution**: Early pioneers include Cliff Stoll at Lawrence Berkeley Laboratory in the 1980s, who traced an intruder back to Germany by tracking a 75-cent accounting discrepancy and luring them with the fake "SDI project" missile defense files. In the 1990s, Bill Cheswick created prison-cell decoys emulating buggy services, leading into the Honeynet Project, which formalized honeypots into research and production categories. - **Defensive Value**: Honeypots function as tripwires with fast response times and low false-positive rates because legitimate systems and users should never interact with them. Mallon notes that internal vulnerability scanners should be whitelisted to avoid accidental alerts.

### Technical Details Mallon walks through a technical demonstration using Cowrie, a medium-to-high interaction honeypot designed to emulate SSH and telnet services. - **Architecture & Setup**: Cowrie runs inside a dedicated virtual environment under a separate non-privileged user account. In medium interaction mode, it emulates a UNIX environment via Python; in high interaction mode, it can proxy SSH and telnet traffic. - **Simulation & Logging**: Using a Kali Linux attack machine, Mallon demonstrates brute-force login attempts against the Cowrie instance. The honeypot records the attempted passwords, usernames, client IP addresses, and exact timestamps in its log source files. - **Post-Exploitation Interaction**: If an attacker successfully logs in, Cowrie can provide a fake filesystem (such as via pickle-based filesystem structures) and fake credentials, allowing defenders to record interactive shell commands, script execution, file creations, and potential malware payload uploads without exposing genuine infrastructure.

### Takeaways Honeypots are not a silver bullet on their own, but they serve as an invaluable layer in defense-in-depth strategies. They effectively disrupt threat actors by wasting their time and resources, creating frustration, and gathering actionable Indicators of Compromise (IOCs) and adversary TTPs. While commercial solutions like Thinkst Canary simplify token deployment, numerous open-source options exist across various protocols and use cases.