SIG2 SOHO Honeynet

How to get Joe Sixpack to run a honeynet

What we will cover

The history of the project?

Theory of operation

Getting and hacking the hardware

Custom firmware and OpenWRT

VPN

Firewall and routing

Call for participation

History of the project

Officially started 11th January 2005

Real work started beginning of March

Project leader:

Michael Boman

Project members:

Rick Zhong

Eugene Teo

Project goals

Using cheap off-the-shelf hardware to increase the network size of honeynets

Make use of everyday people's always-on Internet (IE: Cable / ADSL)

Make the system as simple as possible to configure and maintain

Must not interfere with normal Internet usage

Theory of Operation

Use a router running Linux

Open Source = Easy to Customize

Linux has a wide range of already existing tools

Project members are already familiar with Linux

Establish a VPN to central honeynet

Redirect all traffic that should have been dropped by the firewall to central honeynet

Choosing hardware

Linksys WRT54G

125Mhz MIPS CPU

16 Mb RAM

4 Mb Flash

Linksys WRT54GS

125 Mhz MIPS CPU

16 Mb RAM

8 Mb Flash

Hacking the stock firmware

Using the Linksys ping bug to enable boot_wait

;cp${IFS}*/*/nvram${IFS}/tmp/n

;*/n${IFS}set${IFS}boot_wait=on

;*/n${IFS}commit

;*/n${IFS}show>tmp/ping.log

Uploading custom firmware

Configure tftp client

Power cycle the router

Upload the firmware using tftp

First boot

Boot router in failsafe mode

Run the firstboot script to initialize the jffs2 partition

Using ipkg

ipkg update

Downloads the list of all available packages

ipkg list

List all available packages

ipkg install

Installs a package

ipkg remove

Removes a package

Installing required software

bridge

zlib

dnsmasq

dropbear

kmod-tun

lzo

openssl

openvpn

interface-wrt

kmod-iptables-extra

iptables-extra

iptables

ntpclient

Current known or suspected
issues (aka the ToDo List)

TTL inconstancy

Installation is not as simple as we want

Configuration is not as simple as we want

Call for participation

Developers

C (Applications / Linux kernel)

Ash shell script (Web GUI, helpers etc)

Beta testers

Have the required hardware

Willing to test new firmware and packages

Submit bug reports

Documentation authors

Thank you

Any questions?

Temporarily project home

http://proxy.11a.nu/iwfc-soho-honeynet/