Techniques for Catching Hackers: Honeypots and Operational Security

Hackers often expose themselves through predictable mistakes, making them vulnerable to detection and arrest.

### Catching Hackers: Techniques and Tools for Cybersecurity
* 🔍 In the quest to identify hackers, cybersecurity experts utilize various techniques such as **honeypots**, **honey nets**, and **intentionally vulnerable hosts** to detect and analyze malicious activities.
* 💻 Honeypots serve as bait by mimicking vulnerable systems, thereby allowing defenders to **collect data on attack methods** while distracting potential intruders from **real targets**.
* 🤖 The concept of **operational security (opsec)** plays a crucial role, as even seasoned hackers can be caught due to **small mistakes in their online behavior or identity management**, exemplified by the case of **Ross Ulbricht**, the Silk Road founder.
* 📊 Security tools like intrusion detection systems and data loss prevention technologies are essential for **monitoring network traffic** and providing **alerts on suspicious activities**.
* 💸 Cryptocurrencies pose both a challenge and an opportunity for tracking hackers, as transactions can be **traced through blockchain technology**, despite attempts at **obfuscation via crypto mixing**.
* 🌐 Organizations such as Interpol facilitate international cooperation in tracking cybercriminals, providing **crucial intelligence to local law enforcement agencies**.
* 🛡 The importance of TTP (tactics, techniques, and procedures) knowledge bases cannot be overstated, as they help security researchers **understand adversary behavior** and **enhance defense strategies against persistent threats**.
* 📈 Ultimately, the goal of employing these diverse strategies is to **enhance cybersecurity defenses** and **mitigate the risks posed by cyber threats** in an increasingly digital world.

Here in front of me is a honeypot, one of the many ways and techniques that cyber defenders can catch hackers while hacking a network. Now, this honeypot is specifically hosted in the cloud on a cloud provider and is using an open-source project called teapot. Teapot provides various types of Docker containers that run intentionally vulnerable code packages or misconfigured devices, and they have all types of Docker containers. Now, honeypots may vary in form and complexity, and they may have different goals, but they really ultimately have one overarching goal, and that is to catch hackers in the act. Now, teapot specifically provides extensive telemetry into the different types of attacks, source IPs, and it provides these awesome Kibana dashboards to visualize what's going on out in the world, who is attacking your Docker containers. Teapot also offers an attack map, which shows active attacks on your Docker containers and various other tools, and it's all free. So, I do recommend that you check out the teapot project. So, this all

leads to the question of how do security researchers or cybersecurity companies or just companies in general how do they catch hackers and how do they identify them well in this video I'm going to be going over some of the many techniques that defenders can use to well at least attempt to try to get the hacker so this product user puts it best in my opinion and that is we don't know who the best hackers are because they didn't get caught so far but humans are inherently valuable they are predictable they make mistakes and while those can be exploited just like attackers or hackers can do the same starting off with the many techniques and tactics going over today's video we are going to just go and overview honeypots honey nets and just intentionally vulnerable hosts so as I said at the beginning of the video honeypots are intentionally vulnerable hosts running intentionally vulnerable packages or misconfigured durations and there's honey nuts which are a network of honeypots and again it's an intentionally vulnerable network the

purpose of honey pots and honey nuts is to collect extensive telemetry on what's going on in the wild in terms of exploits in the wild, identifying and analyzing intentionally vulnerable hosts, detecting any attackers on your network, and distracting attackers while you are extensively defending your network. So, different honeypots have different use cases, including cybersecurity companies, which may deploy honeypots to see the different types of exploits in the wild, and that would help them develop their own threat intelligence databases. There are real-world companies that are trying to maybe detect and perhaps distract attackers, and then there are nation-states which probably use this to lure and attack hackers and hacking groups. A specific example recently is the UK creating their own DDS for higher website to attract potential customers, and a couple of years back, the FBI created a secure chatbot called Anim that led to over 800 arrests. And the way that they did this was, well, they had a private key or a backdoor with this encryption setting. So, our honeypots and honey nuts can provide extensive

Telemetry and perhaps distract um you know attackers in your network. Well, they're not actually on real-world hosts, and this isn't really representative of a real business network. So, to identify and to detect hackers in the network, you can use detection controls. So, detection controls such as security tools, and there's so many security tools out there that can provide extensive information about incoming and outgoing network connections in your computer network. So, tools such as logging, and while there's a lot of acronyms coming, uh, there's DLP, data loss prevention, data execution prevention, file integrity monitoring, intrusion detection system, and point detection response. All of these assortments of tools and many more, well, they can provide the necessary alerts and information for defenders to monitor and even prevent an attack, as well as completely lock down devices, depending on the capabilities of the tool. Unique identifiers such as the IP address, Mac address, or online brightcom data can also be used to detect unique devices, and even though these unique devices typically are anonymized through

proxy hopping services, VPN networks, and Tor network services. If there is one possible mistake that the hacker uses when connecting to one of these services, or the national government, for example, issues a legal warrant to request logs for various services, well, hackers can be tracked and caught. And even those VPN services that say they don't do any logging, well, they may. You never really know. So, the next tactic or technique is perhaps the biggest one when it comes to identifying hackers, and that is opsec, or operational security, and just general poor open-source intelligence, or OSINT. So, opsec is the practice of keeping your online identity and physical data secret, and open-source intelligence is the process of gathering information as publicly available, such as social media, websites, databases, government databases, historical records, and much more. So, poor OSINT is poor opsec, and bad opsec is bad security, and well, that can get you caught. So, opsec can and really often is the downfall of highly targeted attackers, specifically in the cybercriminal realm. Opsec can be anything from an IP address assigned to the

various devices that hackers use to the way one communicates or writes specific phrases and the physical habits that one has. Humans are valuable and oftentimes they're really highly predictable. Poor examples of opsec include the infamous dread pirate Roberts or Ross Ulbricht or however you pronounce his name, the founder of the Silk Road back in the early 2010s. He did a lot of things when it comes to poor opsec, but a culmination of just small little things that you don't think would add up to something big. He created online profiles with his real name, such as on Stack Overflow, even though he changed it like a minute later. He bragged about stuff on LinkedIn. All this led up to sufficient enough evidence to determine that it was Ross who was the one behind the Silk Road. Other notable examples include Strava, which is an online app you can track your fitness activity, and basically Army personnel were using their Fitbit watches and tracking that up into Strava, and that allowed them to well determine that there's certain secret

U.S. bases then a very recent example is a hacker who goes by Connor Fitzpatrick or by the handle Pom-Pom purin. He ran a popular cybercrime forum called breach forms, and this was an avenue where hackers could upload the sensitive data that was stolen. The TL;DR of this story is that he used an email address Conor Fitzpatrick 2002 you at gmail.com, and he referenced that when he was on his handle Pom-Pom purin or purin during a chat with one of the admins of a former form. This gave the FBI a lead to track down his activity through various accounts, including the VPN providers he was using, the cryptocurrency exchange, and the iCloud account that he had. So, opsec is the primary way that hacker identities get revealed, and poor opsec, it just takes one little small mistake. This tactic is often used by law enforcement in order to reveal anonymous identities and really come back after the hackers in terms of arrests. Next is tracking transactions, so

cyber crime. Ransom funds and just general transactions are often carried out through cryptocurrencies. The blockchain powers and facilitates, of course, the exchange of these cryptocurrencies. One of the capabilities of the blockchain, or features, is that it never lies. So, if a criminal uses a public, non-privacy-oriented cryptocurrency such as Bitcoin, transactions can often be tracked with a popular technique known as crypto mixing, where hackers can put their funds with legitimate Bitcoins and mix them all together and then route them all out to various addresses. Even though this makes it much harder to track them, it is still possible in some cases, and even through the use of centralized cryptocurrency exchanges. So, think like a Coinbase, for example. Law enforcement can issue warrants to see who created that account, where the IP address is coming from, and so there's a big downfall of just centralized cryptocurrency walls in general. Next is TTP knowledge bases and just the method of operations. So, tactics, techniques, and procedures are a collection of evidence and knowledge in real-world observations used to document adversary operations. So, if you haven't

had enough acronyms in this video. TTPs is another one. TTP's attempt to describe strategies used over time and build profiles of actions by threat groups. Now, we're going to use an example: take the infamous North Korean group, Lazarus group. It's an APT group, and over the years, security researchers and companies have observed routine actions taken by the Lazarus group. And by observing these commonalities, as well as the changes in their evolution of tactics and whatever they use, they can track the Lazarus group. Now, attribution can possibly be inferred through the certain type of malware specific to the Lazarus group, or maybe observing this step-by-step actions that they often take, or what they are attacking. So, similar to how incident responders have playbooks when an incident occurs, hacker groups often follow workflows to compromise hosts, and it depends on the typical hacker group what they are trying to achieve. Now, though TTP knowledge bases can't really attract the hacker's identities per se, they can help understand why an

institution is being hacked, and it often is used for APT groups or Advanced Persistent Threat groups. Another acronym there for you. Next one is national state intelligence. Now, this is inherently a technical control, but organizations such as Interpol have the ability to share intelligence and provide investigative support for the 194 member countries that are a part of Interpol. So, this International Organization functions as a network of law enforcement agencies spread throughout the entire world, and they all can share different information and data about threat actors maybe operating in a country or an industry within the country. Now, nation state intelligent organizations like Interpol can provide coordination opportunities to provide local law enforcement with sufficient enough evidence to actually go out and make the arrests. And even though Interpol as an organization doesn't have the jurisdiction to just go out and arrest whoever they want, they can help aid local authorities. And then finally, once again, another non-technical control, and that is just an inherent value of a target. There are too many individual threat actors, cyber crime groups, or just

advanced persistent threats and for adversaries who cause significant disruption to the operations of critical infrastructure businesses or pose National Security risks or even commit substantial Financial crime. Well, law enforcement and security researchers will focus their attention on those groups because those are the ones that are providing the most impact. Take the 2021 Colonial pipeline gas attack in the United States, for example. Since Gas Distribution was interrupted throughout parts of the country, law enforcement had the incentive to go after the dark side gang. So, these are just some of the many ways hackers, threat actors, and adversary groups can get caught hacking in networks. As I stated at the beginning of this video, I think this Reddit user puts it best in that the really good hackers, we don't know who they are, we don't know their identities because, well, they're really good at what they do. Humans are ultimately valuable, they're predictable, they make mistakes, and similar to how one vulnerability on a business Network can cause significant disruption to that business, attackers only need one way.

in well. It only takes one mistake for the hackers to expose their real identity. So, hopefully, you've enjoyed today's video, learned something new, and I do challenge you to go out, look at teapot. It's a fun little project, and uh, well, yeah, until the next video, have a good day.

How do hackers get caught? - the hunt for the hacker.

Grant Collins

Catching Hackers with Honeypots and Teapot

Honeypots, like the one hosted in the cloud using the Teapot project, run intentionally vulnerable Docker containers to catch hackers in the act.

Teapot provides extensive telemetry, Kibana dashboards, and an attack map to visualize and track attacks on the containers, all for free.

Poor operational security (opsec) and open-source intelligence (OSINT) can lead to hackers being tracked and caught, making opsec a crucial factor in identifying cybercriminals.

Honeypots and honey nuts are used to collect telemetry on exploits, identify vulnerable hosts, detect attackers, and distract them while defending the network.

They have various use cases, including helping cybersecurity companies develop threat intelligence databases and aiding nation-states in luring and attacking hackers.

Organizations like Interpol use the shared intelligence from honeypots to provide investigative support and coordinate local law enforcement efforts in making arrests.

Detection controls, such as security tools and unique device identifiers, are crucial for identifying and monitoring hackers in a network.

The use of cryptocurrencies and blockchain technology can complicate tracking criminal activities, but techniques like crypto mixing and centralized exchanges provide some level of traceability.

Tactics, techniques, and procedures (TTP) knowledge bases help document adversary operations, and law enforcement focuses on high-impact groups, such as those responsible for significant disruptions like the 2021 Colonial pipeline gas attack.

Revealing Hacker Identities: The Case of Connor Fitzpatrick

Connor Fitzpatrick, also known as Pom-Pom purin, ran a cybercrime forum and was tracked down by the FBI through his email and various accounts.

Poor operational security (opsec) and small mistakes can lead to the revelation of a hacker's identity.

Law enforcement uses tactics like tracking transactions and observing common actions to build profiles and attribute cybercrimes to specific hacker groups, such as the infamous Lazarus group.

Security researchers and companies use various techniques to catch hackers, including honeypots, honey nets, and intentionally vulnerable hosts.

Humans are predictable and make mistakes, which can be exploited by defenders.

Notable examples of poor operational security, like Ross Ulbricht and the use of fitness tracking apps by Army personnel, have led to the identification of hackers.