In recent years, the emerging Internet-of-Things (IoT) has led to rising concerns about the security of networked embedded devices. In this work, we focus on the adaptation of Honeypots for improving the security of IoTs. Low-interaction honeypots are used so far in the context of IoT. Such honeypots are limited and easily detectable, and thus, there is a need to find ways how to develop high-interaction, reliable, IoT honeypots that will attract skilled attackers. In this work, we propose the SIPHON architecture - a Scalable high-Interaction Honeypot platform for IoT devices. Our architecture leverages IoT devices that are physically at one location and are connected to the Internet through so-called wormholes distributed around the world. The resulting architecture allows exposing few physical devices over a large number of geographically distributed IP addresses. We demonstrate the proposed architecture in a large scale experiment with 39 wormhole instances in 16 cities in 9 countries. Based on this setup, six physical IP cameras, one NVR and one IP printer are presented as 85 real IoT devices on the Internet, attracting a daily traffic of 700MB for a period of two months. A preliminary analysis of the collected traffic indicates that devices in some cities attracted significantly more traffic than others (ranging from 600 000 incoming TCP connections for the most popular destination to less than 50000 for the least popular). We recorded over 400 brute-force login attempts to the web-interface of our devices using a total of 1826 distinct credentials, from which 11 attempts were successful. Moreover, we noted login attempts to Telnet and SSH ports some of which used credentials found in the recently disclosed Mirai malware.
@cite_3 , the authors described the implementation and deployment of a honeypot based on a number of real, vulnerable web applications. They hosted all the web applications in seven isolated virtual machines running on a VMWare Server. In order to limit the attack surface, the authors let the exposed services run as a non privileged user. They then analyzed the collected data to study attackers' behavior on the web applications during pre and post exploitation. In contrast, we work with real physical IoT devices to set up a high-interaction honeypot.
@cite_3
2949324006 2126363842 1514368868 2622206102
This paper presents an experimental study and the lessons learned from the observation of the attackers when logged on a compromised machine. The results are based on a six months period during which a controlled experiment has been run with a high interaction honeypot. We correlate our findings with those obtained with a worldwide distributed system of lowinteraction honeypots. In this paper, we implement a HoneyPot system equipped with several sub systems for their use. Obtaining the new knowledge on the access skills of intruder allows us to make a policy more precisely and quickly to protect a system from the new attacks. Our implementation presents an HoneyPot System cooperates with firewall and management server. In this system, firewall redirects a session from an abnormal user to HoneyPot to learn the advanced intrusion skills and to respond more effectively. A honeypot is a closely monitored network decoy serving several purposes: it can distract adversaries from more valuable machines on a network, provide early warning about new attack and exploitation trends, or allow in-depth examination of adversaries during and after exploitation of a honeypot. Deploying a physical honeypot is often time intensive and expensive as different operating systems require specialized hardware and every honeypot requires its own physical system. This paper presents Honeyd, a framework for virtual honeypots that simulates virtual computer systems at the network level. The simulated computer systems appear to run on unallocated network addresses. To deceive network fingerprinting tools, Honeyd simulates the networking stack of different operating systems and can provide arbitrary routing topologies and services for an arbitrary number of virtual systems. This paper discusses Honeyd's design and shows how the Honeyd framework helps in many areas of system security, e.g. detecting and disabling worms, distracting adversaries, or preventing the spread of spam email. Every day, a new technology comes up and the primary reason why it fails to attract many people in this era is the concern of privacy and security. Each day, along with the new technology comes a load of vulnerabilities waiting to be exploited. IoT (Internet of Things) is the latest trend and like all technology, it is open for exploitation. The most common attack which is used to bring down a whole network, without even finding a loophole in the security — DoS can be used to pull down any IoT network as well. In this paper, we propose a honeypot model for mitigating DoS attacks launched on IoT devices. Honeypots are commonly used in online servers as a decoy to the main server so that the attack is mitigated to the decoy instead of the main server. Here a similar methodology is used to avoid the whole IoT system from being shut down due to a DoS attack.