Download fulltext - DiVA Portal

1
1
Introduction
Introduction
A computer connected to the Internet today is more or less pre-destined to be
hit by malicious trac. Worms targeting random computers on the Internet will
many times nd and attack a newly connected system before it has a chance
to download the latest updates. Long gone are the days when attackers only
focused on servers with vulnerable services running on standard ports. One of
the most exposed machines on the Internet today is a client computer running
a web browser controlled by a careless human being. That's not to say that
a careless person is necessarily the weakest link as there are several creative
distribution methods for malware. Malicious code can for example be hidden
in dynamic content served to websites via ad-networks, user-created content
like forum posts or code uploaded to otherwise trusted sites via security holes
in the site's software. This means that no website can be fully trusted at all
times and thus makes the argument that as long as one only visits well known
and professional sites you are safe, untrue. To make it even worse; weaknesses
in browser software, browser plugins and operating systems makes it possible
for malware to install itself on the client machine silently without the need
to prompt the user and fool him/her to give it install permissions. Antivirus
programs and blacklist services can constitute good protection but antivirus
evasion techniques exists and blacklists are often general and might not include
all sites visited by users.
What if you had a scapegoat computer, one that visits the same sites as you
do, search them and follow links on those pages just like you would and then
report back to you if there was any suspicious activity or malware installed
when visiting any of the pages? You would simply tell it what sites you are
visiting and it would follow and continue ahead, recklessly open, download and
view everything it nds while monitoring its own status. All this just to warn
you about malicious sites, documents and links so that you won't need to take
the risk. Apply this to a bigger network with several users browsing sites at
their own will all while the integrity of the internal network and the data stored
there depends on a malware free environment. Maybe this kind of scapegoat
computer could be a sensible addition as another layer of security in what should
be a defense in depth approach to protect networks. The idea is explored in this
thesis both in a theoretical way discussing the possibilities and in a practical
way by creating proof-of-concept code, evaluating it and discussing problems
that arise.
1.1
Overview
The idea is to investigate the honeyclient concept and the possibility to use it in
a practical way as a security measure against malware hidden in content found
while browsing the web.
Figure 1 illustrates how a practical implementation is thought out to work.
Trac from the clients at the internal network out to the Internet is routed
through a proxy which monitors URLs visited. The URLs are forwarded to a
honeyclient machine which spiders the Internet based on the URLs it receives.
The honeyclient machine reports its ndings to a database, creating a blacklist
of URLs containing malicious code. The same database is queried by the proxy
to decide if a request should be allowed or not.
There are several possible congurations, for example the proxy, database and
1