Tan Kean Siong - Stories from a 15 days SMB Honeypot Mum

### The Post-WannaCry Threat Landscape At 00:00, Tan Kean Siong opens by recounting the global cybersecurity crisis of May 2017: the explosive outbreak of the WannaCry ransomware worm. Weaponizing the leaked NSA exploit EternalBlue (MS17-010), WannaCry crippled hospitals, logistics networks, and corporate systems across the globe in a matter of hours. In response to this historic event, Kean Siong designed and deployed an experimental SMB honeypot infrastructure to capture, dissect, and monitor weaponized worm traffic in real time.

### Architecture of the 15-Day SMB Honeypot Deployment At 06:15 and 12:40, the speaker details the deployment methodology used to monitor Server Message Block (SMB) exploitation. Utilizing the open-source Dionaea honeypot framework paired with virtualized Windows 7 and Samba instances, the team exposed raw TCP ports 139 and 445 directly to public Internet IP ranges. The architecture was engineered to emulate vulnerable SMBv1 protocol handshakes, capture DoublePulsar backdoor pings, and log incoming binary payloads into secure, isolated analysis sandboxes.

### Analyzing the Mechanics of EternalBlue and DoublePulsar At 19:46, Kean Siong breaks down the telemetry collected across the 15-day recording period. He illustrates how automated threat actors continuously probed the IPv4 address space for vulnerable SMBv1 endpoints. He explains the exact payload exchange: attackers first injected EternalBlue to achieve kernel-level execution via an SrvTransaction2 buffer overflow, installed the in-memory DoublePulsar ring-0 implant, and subsequently leveraged DoublePulsar to upload and execute secondary malware payloads.

### The Rise of SambaCry and Multi-Platform Exploitation At 27:30 and 33:15, the presentation examines the simultaneous emergence of SambaCry (CVE-2017-7494), an arbitrary code execution vulnerability affecting Samba file-sharing daemons on Unix and Linux systems. Kean Siong shows how attackers rapidly weaponized SambaCry to upload malicious shared libraries (`.so` files) into world-writable network shares, successfully recruiting networked storage appliances, home routers, and Linux servers into distributed cryptocurrency mining botnets.

### Honeypot Forensics, Threat Intelligence, and SMB Hardening Concluding between 36:50 and 39:42, Kean Siong shares lessons learned from managing high-exposure honeypots. He emphasizes that unpatched legacy protocols like SMBv1 remain continuous targets for automated cybercrime syndicates. He urges network administrators to completely disable SMBv1 across enterprise fleets, enforce strict perimeter filtering on ports 139 and 445 at Internet edge gateways, and deploy active network deception to detect early reconnaissance in internal subnets.

(AI summary — Gemini 3.8 Flash)