BACKGROUND

Field of the Disclosure

This disclosure is related to deception systems implemented in cybersecurity computing environments. In particular, this disclosure is related to recovering opaque credentials in deception systems.

Description of the Related Art

Honeypots are physical or virtual computing systems (e.g., virtual machines) implemented in a network as a decoy to lure malicious actors (e.g., hackers, rogue government entities, and the like) in an attempt to detect, deflect, and/or study hacking attempts. Such deception computing systems can be configured as enticing targets for attackers (e.g., as a high-value server, and the like) and can be used to gather valuable attack telemetry data (e.g., the identity of attackers, attack mechanism(s) used, targets sought, credentials used, and the like). Therefore, honeypots are often implemented in modern cybersecurity computing environments to identify and defend (against) attacks from advanced persistent threat actors.

Honeypots often support protocols (e.g., client/server protocols, communication protocols, and the like) that exchange encrypted (or hashed) credentials (e.g., a username and/or password). While non-plaintext credentials are desirable in production use of such protocols (e.g., for the security benefits they provide by virtue of being encrypted), in a honeypot, encrypted or hashed credentials are rendered opaque. Unfortunately, opaque credentials in a honeypot ecosystem prevent the identification of plaintext credentials being used by malicious attackers and consequently, thwart the gathering of valuable attacker telemetry data. Further, and in addition to various other shortcomings, such opaque credentials may also prevent the honeypot from being configured to only accept logins from one or more specific credentials, thus significantly limiting the effectiveness of the honeypot.

SUMMARY OF THE DISCLOSURE

Disclosed herein are methods, systems, and processes for recovering opaque credentials in deception systems. One such method involves receiving a plaintext credential at a honeypot, accessing a plaintext lookup table, determining that the plaintext credential does not exist in the plaintext lookup table, adding the plaintext credential to the plaintext lookup table and to a protocol specific plaintext lookup table, generating an opaque credential for the plaintext credential, and adding the opaque credential to a protocol specific opaque lookup table.

In one embodiment, the plaintext credential is received from an original attacker and the original attacker initiates an original attack event. In this example, the method involves generating attack context metadata associated with the original attack event and storing the attack context metadata in the protocol specific opaque lookup table in association with the plaintext credential and the opaque credential.

In some embodiments, the method involves receiving the opaque credential at the honeypot from a subsequent attacker that initiates a subsequent attack event, accessing the protocol specific opaque lookup table, and recovering the plaintext credential associated with the opaque credential. In other embodiments, the method involves performing a registration operation with a credential manager by providing a table identifier and a protocol methodology and populating the plaintext lookup table from a plaintext password list.

In certain embodiments, the method involves storing the opaque credential in a log generated for the original attack event or determining whether the opaque credential is included in a list of credentials the honeypot is configured to consider valid. In this example, the method exchanges the plaintext credential, the opaque credential, and the attack context metadata with a credential exchange manager.

The foregoing is a summary and thus contains, by necessity, simplifications, generalizations and omissions of detail; consequently those skilled in the art will appreciate that the summary is illustrative only and is not intended to be in any way limiting. Other aspects, features, and advantages of the present disclosure, as defined solely by the claims, will become apparent in the non-limiting detailed description set forth below.

