Credential Honeytoken for Tracking Web-based Attack CycleReturn to TOC

No ratings

Presented at FIRST 2014 by

Mitsuaki Akiyama

Background – The web-based attacks called Beladen, Gumblar, and Nineball are large-scale incidents of mass compromises of websites. These types of compromises are the leading cause of malware infection of general public users on the Web. In fact, adversaries use complex attack techniques such as malware infection, credential leakage, and tactics to compromise websites. A compromised website then carries out drive-by download attacks and leads to secondary malware infections.?We have focused our research on this web-based attack cycle. Our proposal – To consistently observe web-based attack cycle, we developed a novel observation system based on a honeytoken that actively leaks credentials and lures adversaries to a decoy that behaves like a compromised web content management system. Our assumption is that honeytoken-based observation can be used for in-depth tracking of a series of attack cycles by a specific adversary and can discover malicious entities. Experimental result – In a one-year experiment, our proposed system was successfully compromised by various adversary groups without being recognized, which allowed us to closely monitor the adversaries' activities. – Obtained malicious enteritis are about 10,000 IP addresses and 900 FQDNs. There are small overlap between them and six famous public blacklists, therefore the result means that our system can observe unknown malicious entities effectively. Contributions for CSIRT organizations – Our obtained malicious entities can be applicable to proactive defenses such as blacklisting and filtering. Moreover, we revealed detailed activities of adversary groups and ecosystems of recent complex attack cycle. We believe that the knowledge of malicious activities and ecosystems can accelerate CSIRT activity.