Tracking malware with honeyclients

I’ve been a big fan of honeypots ever since I first learned about them in Clifford Stoll’s The Cuckoo’s Egg. His story about catching German hackers because of a 75-cent accounting error is a thrilling forensics journey. Today, I support honeypots because they are a must-have early-warning tool in any organization.

If you can’t stop the hacker or malware -- it’s hard to be perfect all the time -- the next best thing is early warning. Placing a honeypot within your enterprise network, next to other valuable assets, assures that any rogue outsiders -- or insiders -- will be discovered quickly. If the hacker or malware touches the fake asset, they are done. Low cost and low noise equals high value.

Unfortunately, in order for most honeypots to work, you have to wait for the attacker to assault the honeypot head on from a remote location. This set of circumstances ignores the fact that most malicious hacking occurs from client-side attacks. A malicious phishing e-mail arrives in the user’s inbox and waits for the user to click and pursue. This series of events allows the remote malware to activate on the box locally and allows it to return to the network over TCP port 80 outbound, which is allowed by most firewalls.

Many security researchers realized this loophole a few years ago, as browser-based malware began to overtake file attachment worms as the major means of hacking. Many computer defense companies now use client-side honeypots, known as honeyclients, to track and analyze these types of intruders.

The honeyclient is a honeypot that mimics, either manually or automatically, the normal series of steps a regular user would make when visiting various Web sites. A honeyclient can be fully patched or be left vulnerable to reveal more malware. The idea is to identify malicious software, computers that host malware, and -- dare to dream! -- even the miscreants that make malware.

Although Microsoft was far from the first to explore honeyclients, its Strider HoneyMonkey project was one of the first honeyclient endeavors to get widespread attention. Started by four Microsoft employees, the project has spread beyond its initial scope and has been highly successful.

Here's how it works: Malware and rogue links, new and old, are reported to other Microsoft teams. Based on those details, malicious Web sites are shut down, products are updated, and security teams educated. In at least one instance, an IE zero-day exploit was found by the Strider HoneyMonkey team; the site was taken down, and a solution was implemented before the exploit had time to spread widely.

A whole new honeyclient subculture is also making a name for itself apart from the normal honeypot folks. The Honeyclient Development Project, led by Kathy Wang, offers up a mailing list and the first open source honeyclient, along with an Outlook-based plug-in for collecting malicious URLs. Wang works full-time for Mitre, and rumor has it that they are working on a more sophisticated open source honeyclient to be released soon.