해커를 잡는 기술: 허니팟과 운영 보안

### 해커 잡기: 사이버 보안을 위한 기술 및 도구
* 🔍 해커를 식별하기 위해 사이버 보안 전문가들은 **허니팟, 허니넷, 의도적으로 취약한 호스트 등 다양한 기술**을 활용하여 악의적인 활동을 탐지하고 분석합니다.
* 💻 허니팟은 취약한 시스템을 모방하여 미끼 역할을 함으로써 **방어자가 공격 방법에 대한 데이터를 수집**하는 동시에 잠재적인 침입자의 주의를 실제 공격 대상에서 돌릴 수 있도록 합니다.
* 🤖 실크로드 설립자 로스 울브리히트의 사례에서 알 수 있듯이 노련한 해커도 온라인 행동이나 신원 관리의 작은 실수로 인해 적발될 수 있기 때문에 **운영 보안(opsec)의 개념은 매우 중요한 역할**을 합니다.
* 📊 침입 탐지 시스템 및 데이터 손실 방지 기술과 같은 보안 도구는 **네트워크 트래픽을 모니터링**하고 의심스러운 활동에 대한 경고를 제공하는 데 필수적입니다.
* 💸 암호화폐는 암호화 혼합을 통한 난독화 시도에도 불구하고 **블록체인 기술을 통해 거래를 추적**할 수 있기 때문에 해커를 추적하는 데 있어 도전과 기회가 동시에 존재합니다.
* 🌐 인터폴과 같은 조직은 **사이버 범죄자 추적을 위한 국제 협력을 촉진**하여 현지 법 집행 기관에 중요한 정보를 제공합니다.
* 🛡 보안 연구자가 적의 행동을 이해하고 지속적인 위협에 대한 방어 전략을 강화하는 데 도움이 되는 **TTP(전술, 기법 및 절차) 지식 베이스의 중요성**은 아무리 강조해도 지나치지 않습니다.
* 📈 이러한 다양한 전략의 궁극적인 목표는 점점 더 디지털화되는 세상에서 **사이버 보안 방어를 강화**하고 사이버 위협으로 인한 위험을 완화하는 것입니다.

해커는 예측 가능한 실수를 통해 자신을 노출하는 경우가 많기 때문에 탐지 및 체포에 취약합니다.

Here in front of me is a honeypot, one of the many ways and techniques that cyber defenders can catch hackers while hacking a network. Now, this honeypot is specifically hosted in the cloud on a cloud provider and is using an open-source project called teapot. Teapot provides various types of Docker containers that run intentionally vulnerable code packages or misconfigured devices, and they have all types of Docker containers. Now, honeypots may vary in form and complexity, and they may have different goals, but they really ultimately have one overarching goal, and that is to catch hackers in the act. Now, teapot specifically provides extensive telemetry into the different types of attacks, source IPs, and it provides these awesome Kibana dashboards to visualize what's going on out in the world, who is attacking your Docker containers. Teapot also offers an attack map, which shows active attacks on your Docker containers and various other tools, and it's all free. So, I do recommend that you check out the teapot project. So, this all

leads to the question of how do security researchers or cybersecurity companies or just companies in general how do they catch hackers and how do they identify them well in this video I'm going to be going over some of the many techniques that defenders can use to well at least attempt to try to get the hacker so this product user puts it best in my opinion and that is we don't know who the best hackers are because they didn't get caught so far but humans are inherently valuable they are predictable they make mistakes and while those can be exploited just like attackers or hackers can do the same starting off with the many techniques and tactics going over today's video we are going to just go and overview honeypots honey nets and just intentionally vulnerable hosts so as I said at the beginning of the video honeypots are intentionally vulnerable hosts running intentionally vulnerable packages or misconfigured durations and there's honey nuts which are a network of honeypots and again it's an intentionally vulnerable network the

purpose of honey pots and honey nuts is to collect extensive telemetry on what's going on in the wild in terms of exploits in the wild, identifying and analyzing intentionally vulnerable hosts, detecting any attackers on your network, and distracting attackers while you are extensively defending your network. So, different honeypots have different use cases, including cybersecurity companies, which may deploy honeypots to see the different types of exploits in the wild, and that would help them develop their own threat intelligence databases. There are real-world companies that are trying to maybe detect and perhaps distract attackers, and then there are nation-states which probably use this to lure and attack hackers and hacking groups. A specific example recently is the UK creating their own DDS for higher website to attract potential customers, and a couple of years back, the FBI created a secure chatbot called Anim that led to over 800 arrests. And the way that they did this was, well, they had a private key or a backdoor with this encryption setting. So, our honeypots and honey nuts can provide extensive

Telemetry and perhaps distract um you know attackers in your network. Well, they're not actually on real-world hosts, and this isn't really representative of a real business network. So, to identify and to detect hackers in the network, you can use detection controls. So, detection controls such as security tools, and there's so many security tools out there that can provide extensive information about incoming and outgoing network connections in your computer network. So, tools such as logging, and while there's a lot of acronyms coming, uh, there's DLP, data loss prevention, data execution prevention, file integrity monitoring, intrusion detection system, and point detection response. All of these assortments of tools and many more, well, they can provide the necessary alerts and information for defenders to monitor and even prevent an attack, as well as completely lock down devices, depending on the capabilities of the tool. Unique identifiers such as the IP address, Mac address, or online brightcom data can also be used to detect unique devices, and even though these unique devices typically are anonymized through

proxy hopping services, VPN networks, and Tor network services. If there is one possible mistake that the hacker uses when connecting to one of these services, or the national government, for example, issues a legal warrant to request logs for various services, well, hackers can be tracked and caught. And even those VPN services that say they don't do any logging, well, they may. You never really know. So, the next tactic or technique is perhaps the biggest one when it comes to identifying hackers, and that is opsec, or operational security, and just general poor open-source intelligence, or OSINT. So, opsec is the practice of keeping your online identity and physical data secret, and open-source intelligence is the process of gathering information as publicly available, such as social media, websites, databases, government databases, historical records, and much more. So, poor OSINT is poor opsec, and bad opsec is bad security, and well, that can get you caught. So, opsec can and really often is the downfall of highly targeted attackers, specifically in the cybercriminal realm. Opsec can be anything from an IP address assigned to the

various devices that hackers use to the way one communicates or writes specific phrases and the physical habits that one has. Humans are valuable and oftentimes they're really highly predictable. Poor examples of opsec include the infamous dread pirate Roberts or Ross Ulbricht or however you pronounce his name, the founder of the Silk Road back in the early 2010s. He did a lot of things when it comes to poor opsec, but a culmination of just small little things that you don't think would add up to something big. He created online profiles with his real name, such as on Stack Overflow, even though he changed it like a minute later. He bragged about stuff on LinkedIn. All this led up to sufficient enough evidence to determine that it was Ross who was the one behind the Silk Road. Other notable examples include Strava, which is an online app you can track your fitness activity, and basically Army personnel were using their Fitbit watches and tracking that up into Strava, and that allowed them to well determine that there's certain secret

U.S. bases then a very recent example is a hacker who goes by Connor Fitzpatrick or by the handle Pom-Pom purin. He ran a popular cybercrime forum called breach forms, and this was an avenue where hackers could upload the sensitive data that was stolen. The TL;DR of this story is that he used an email address Conor Fitzpatrick 2002 you at gmail.com, and he referenced that when he was on his handle Pom-Pom purin or purin during a chat with one of the admins of a former form. This gave the FBI a lead to track down his activity through various accounts, including the VPN providers he was using, the cryptocurrency exchange, and the iCloud account that he had. So, opsec is the primary way that hacker identities get revealed, and poor opsec, it just takes one little small mistake. This tactic is often used by law enforcement in order to reveal anonymous identities and really come back after the hackers in terms of arrests. Next is tracking transactions, so

cyber crime. Ransom funds and just general transactions are often carried out through cryptocurrencies. The blockchain powers and facilitates, of course, the exchange of these cryptocurrencies. One of the capabilities of the blockchain, or features, is that it never lies. So, if a criminal uses a public, non-privacy-oriented cryptocurrency such as Bitcoin, transactions can often be tracked with a popular technique known as crypto mixing, where hackers can put their funds with legitimate Bitcoins and mix them all together and then route them all out to various addresses. Even though this makes it much harder to track them, it is still possible in some cases, and even through the use of centralized cryptocurrency exchanges. So, think like a Coinbase, for example. Law enforcement can issue warrants to see who created that account, where the IP address is coming from, and so there's a big downfall of just centralized cryptocurrency walls in general. Next is TTP knowledge bases and just the method of operations. So, tactics, techniques, and procedures are a collection of evidence and knowledge in real-world observations used to document adversary operations. So, if you haven't

had enough acronyms in this video. TTPs is another one. TTP's attempt to describe strategies used over time and build profiles of actions by threat groups. Now, we're going to use an example: take the infamous North Korean group, Lazarus group. It's an APT group, and over the years, security researchers and companies have observed routine actions taken by the Lazarus group. And by observing these commonalities, as well as the changes in their evolution of tactics and whatever they use, they can track the Lazarus group. Now, attribution can possibly be inferred through the certain type of malware specific to the Lazarus group, or maybe observing this step-by-step actions that they often take, or what they are attacking. So, similar to how incident responders have playbooks when an incident occurs, hacker groups often follow workflows to compromise hosts, and it depends on the typical hacker group what they are trying to achieve. Now, though TTP knowledge bases can't really attract the hacker's identities per se, they can help understand why an

institution is being hacked, and it often is used for APT groups or Advanced Persistent Threat groups. Another acronym there for you. Next one is national state intelligence. Now, this is inherently a technical control, but organizations such as Interpol have the ability to share intelligence and provide investigative support for the 194 member countries that are a part of Interpol. So, this International Organization functions as a network of law enforcement agencies spread throughout the entire world, and they all can share different information and data about threat actors maybe operating in a country or an industry within the country. Now, nation state intelligent organizations like Interpol can provide coordination opportunities to provide local law enforcement with sufficient enough evidence to actually go out and make the arrests. And even though Interpol as an organization doesn't have the jurisdiction to just go out and arrest whoever they want, they can help aid local authorities. And then finally, once again, another non-technical control, and that is just an inherent value of a target. There are too many individual threat actors, cyber crime groups, or just

advanced persistent threats and for adversaries who cause significant disruption to the operations of critical infrastructure businesses or pose National Security risks or even commit substantial Financial crime. Well, law enforcement and security researchers will focus their attention on those groups because those are the ones that are providing the most impact. Take the 2021 Colonial pipeline gas attack in the United States, for example. Since Gas Distribution was interrupted throughout parts of the country, law enforcement had the incentive to go after the dark side gang. So, these are just some of the many ways hackers, threat actors, and adversary groups can get caught hacking in networks. As I stated at the beginning of this video, I think this Reddit user puts it best in that the really good hackers, we don't know who they are, we don't know their identities because, well, they're really good at what they do. Humans are ultimately valuable, they're predictable, they make mistakes, and similar to how one vulnerability on a business Network can cause significant disruption to that business, attackers only need one way.

in well. It only takes one mistake for the hackers to expose their real identity. So, hopefully, you've enjoyed today's video, learned something new, and I do challenge you to go out, look at teapot. It's a fun little project, and uh, well, yeah, until the next video, have a good day.

How do hackers get caught? - the hunt for the hacker.

Grant Collins

허니팟과 찻주전자로 해커 잡기

Teapot 프로젝트를 사용해 클라우드에서 호스팅되는 것과 같은 허니팟은 해커의 공격을 포착하기 위해 의도적으로 취약한 Docker 컨테이너를 실행합니다.

Teapot은 컨테이너에 대한 공격을 시각화하고 추적할 수 있는 광범위한 원격 분석, Kibana 대시보드, 공격 지도를 모두 무료로 제공합니다.

운영 보안(opsec)과 오픈 소스 인텔리전스(OSINT)가 부실하면 해커를 추적하고 적발할 수 있으므로, 운영 보안은 사이버 범죄자를 식별하는 데 중요한 요소입니다.

허니팟과 허니넛은 익스플로잇에 대한 원격 분석을 수집하고, 취약한 호스트를 식별하고, 공격자를 탐지하고, 네트워크를 방어하는 동안 공격자의 주의를 분산시키는 데 사용됩니다.

사이버 보안 회사가 위협 인텔리전스 데이터베이스를 개발하고 국가가 해커를 유인하고 공격하는 데 도움을 주는 등 다양한 사용 사례가 있습니다.

인터폴과 같은 조직은 허니팟에서 공유된 인텔리전스를 사용하여 수사 지원을 제공하고 현지 법 집행 기관의 체포 노력을 조율합니다.

네트워크에서 해커를 식별하고 모니터링하려면 보안 도구와 고유한 디바이스 식별자 등의 탐지 제어 기능이 필수적입니다.

암호화폐와 블록체인 기술을 사용하면 범죄 활동 추적이 복잡해질 수 있지만, 암호화폐 혼합 및 중앙 집중식 거래소와 같은 기술은 어느 정도 추적성을 제공합니다.

전술, 기술 및 절차(TTP) 지식 기반은 적의 작전을 문서화하는 데 도움이 되며, 법 집행 기관은 2021년 콜로니얼 파이프라인 가스 공격과 같은 중대한 혼란을 일으킨 그룹과 같이 영향력이 큰 그룹에 초점을 맞추고 있습니다.

해커의 신원 공개: 코너 피츠패트릭의 사례

사이버 범죄 포럼을 운영하던 코너 피츠패트릭은 이메일과 다양한 계정을 통해 FBI에 의해 추적당했습니다.

부실한 운영 보안(운영 보안)과 사소한 실수로 해커의 신원이 노출될 수 있습니다.

법 집행 기관은 거래를 추적하고 일반적인 행동을 관찰하는 등의 전술을 사용하여 프로필을 작성하고 악명 높은 라자루스 그룹과 같은 특정 해커 그룹에 사이버 범죄의 원인을 돌립니다.

보안 연구자와 기업은 허니팟, 허니넷, 의도적으로 취약한 호스트 등 해커를 잡기 위해 다양한 기법을 사용합니다.

인간은 예측 가능하고 실수를 저지르기 때문에 방어자가 이를 악용할 수 있습니다.

로스 울브리히트나 육군 장병의 피트니스 트래킹 앱 사용과 같은 부실한 운영 보안의 대표적인 사례는 해커의 신원을 밝혀냈습니다.