Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cymmetria (YC S15) Uses Virtual Machines to Decoy and Detect Hackers

techcrunch.com

Post reply on HN
Print view View original

11–20 of 31 posts

Re: Cymmetria (YC S15) Uses Virtual Machines to Decoy and Detect Hackers

#11

Post by wglb »

ddiinn wrote: post #7

Hi all, Gadi here (CEO of Cymmetria). We are here on Hacker News and would be happy to answer any questions, technical or otherwise, and discuss.

So two questions, really. First, given We generate one because our decoys are real machines and nothing should run on them except for what we put on them., won't that machine look a little different from the outside, that is, the next machine over in the horizontal network than all the other machines? And thus the attacker would be suspicious?

Secondly, who is to say that the attacking army doesn't have a lab simulating an enterprise environment with one or two of your installs there, learning how to detect/avoid/silently compromise them?

Re: Cymmetria (YC S15) Uses Virtual Machines to Decoy and Detect Hackers

#12

Post by lawl »

It's an interesting concept. But there's one thing that bugs me. If an attacker is already in the network, I think we need to distinguish between two types of boxes. Servers, and clients. Honeypots are nothing new, so having a few servers that are honeypots in the network doesn't seem that interesting to me.

If someone wants to break into your network, they'll probably target a small amount of users and try to get a RAT on their box to spread from their, I don't know but that's what I'd do.

If you want honeypot Clients, things get a bit harder, since you will need to mimic user interaction. But even if a box clicks every link for a decoy email account a drive-by exploit or something can easily fingerprint the system and bail out if it's a VM since it's unlikely for clients to be VMs. Depending on the exploit, that could be hard to detect.

So, we're back to honeypots as servers? I don't want to sound negative, but the article is just so vague and that seems to be the only plausible thing.

Re: Cymmetria (YC S15) Uses Virtual Machines to Decoy and Detect Hackers

#13

Post by ddiinn2 »

wglb wrote: post #11
ddiinn wrote: post #7

Hi all, Gadi here (CEO of Cymmetria). We are here on Hacker News and would be happy to answer any questions, technical or otherwise, and discuss.

So two questions, really. First, given We generate one because our decoys are real machines and nothing should run on them except for what we put on them. , won't that machine look a little different from the outside, that is, the next machine over in the horizontal network than all the other machines? And thus the attacker would be suspicious? Secondly, who is to say that the attacking army doesn't have a lab simula…

Hi, dean here (Cymmetria CTO). Two great questions:

1. The concept being that from looking at the machine on the network we don't do anything different then regular machines, so the goal is to prevent fingerprinting.

2. If the attacker actually attacks the decoy then we are able to capture what that attack looks like, send it to threat management while it's happening and mitigate. At that point if the attacker has found out it's too late. When Attackers will have our systems installed in his labs he'll have to find some way of identifying our machines without attacking them and that's what we've been developing to prevent.

Re: Cymmetria (YC S15) Uses Virtual Machines to Decoy and Detect Hackers

#14

Post by wglb »

ddiinn2 wrote: post #13
wglb wrote: post #11

Earlier quoted context omitted.

So two questions, really. First, given We generate one because our decoys are real machines and nothing should run on them except for what we put on them. , won't that machine look a little different from the outside, that is, the next machine over in the horizontal network than all the other machines? And thus the attacker would be suspicious? Secondly, who is to say that the attacking army doesn't have a lab simula…

Hi, dean here (Cymmetria CTO). Two great questions: 1. The concept being that from looking at the machine on the network we don't do anything different then regular machines, so the goal is to prevent fingerprinting. 2. If the attacker actually attacks the decoy then we are able to capture what that attack looks like, send it to threat management while it's happening and mitigate. At that point if the attacker has fo…

Thanks for the reply.

So I am unclear on the meaning of "attack". Is this more than a series of pings, or an attempt to do a pexec or remote viewing of the event log?

Secondly, if the sensor is placed in a pool of developer machines, does it have to have the whole development environment loaded up, for example, and occasionally do compiles?

"Doing anything different" seems to require close emulation of whatever is going on in the rest of the environment, no?

Further, if he has your machines installed in a controlled lab with properly tied off alarm end points (the things you trigger when you see something odd), what is to prevent an attack analogous to a virus writer having a lab full of each kind of antivirus hammering at his samples?

It seems the challenge for building a static alert system or sensor is that engineering talent from a team larger than yours in some other time zone is going to do the equivalent of sending a drone over your island to see what your radar response looks like. As in if they find the destination of your alerts before tickling your box and compromise that first. Or figure out how to set off an fake alarm or nine.

EDIT: typo

Re: Cymmetria (YC S15) Uses Virtual Machines to Decoy and Detect Hackers

#15

Post by ddiinn2 »

zorked wrote: post #10
ddiinn wrote: post #7

Hi all, Gadi here (CEO of Cymmetria). We are here on Hacker News and would be happy to answer any questions, technical or otherwise, and discuss.

How does it work, really? Do you provide a plausible-looking virtualized fake enterprise network that will look like a real thing to outsiders? Or do you put honeypot servers alongside other production servers, running whatever applications are really being used by the company? Do you intend to protect against inside threats as well?

Each decoy is configured to look exactly the way that makes sense for the network it's in. An example is a git server with interesting code or an employees pc that shares files that are crafted to draw attackers to that decoy. The decoys themselves can be placed within the customers network or hosted in the cloud by us.

The real trick is "breadcrumbs" which is specific data/files that you can place on the real machines that directs the attackers towards the decoys.

Re: Cymmetria (YC S15) Uses Virtual Machines to Decoy and Detect Hackers

#17

Post by ddiinn2 »

wglb wrote: post #14
ddiinn2 wrote: post #13

Earlier quoted context omitted.

Hi, dean here (Cymmetria CTO). Two great questions: 1. The concept being that from looking at the machine on the network we don't do anything different then regular machines, so the goal is to prevent fingerprinting. 2. If the attacker actually attacks the decoy then we are able to capture what that attack looks like, send it to threat management while it's happening and mitigate. At that point if the attacker has fo…

Thanks for the reply. So I am unclear on the meaning of "attack". Is this more than a series of pings, or an attempt to do a pexec or remote viewing of the event log? Secondly, if the sensor is placed in a pool of developer machines, does it have to have the whole development environment loaded up, for example, and occasionally do compiles? "Doing anything different" seems to require close emulation of whatever is go…

- What is alerted on (or "attack") is configurable and can range from code being executed (which is the true positive alert) to connecting to ports(which has more noise)

- It needs to look like the machine an attacker will be after when he's looking around on the network and that's much simpler then a whole loaded up environment.

- Yes, the decoys look like an integral part of the network

- It could be within every segment of the network and not in it's own island. But it's true that every security solution depends on it's management interface not being compromised :)

Re: Cymmetria (YC S15) Uses Virtual Machines to Decoy and Detect Hackers

#18

Post by ejcx »

I actually built an identical project following watching Rob Fuller's talk "Attacker Ghost Stories". I've actually built it twice.

First was a Java based service for each service I wanted as a honeypot. FTP, SSH, MySQL, etc. They basically were low interaction honeypots, for example MySQL. Prompt for password, do the handshake, say failure, and report to admin.

Second was a Go logtailer and bash script that would securely set up services, tail the logs, and notify admins when there was suspicious activity (err...any activity).

It was a ton of fun building it and very straightforward. Gen1 in Java was the most fun implementing all the authentication schemes, but Gen2 worked way better, faster, and easier. I wanted to try to turn it into a company but chickened out that nobody would ever want it. Awesome to see literally the exact same use-case software here! I guess it was a good idea! =]

Good luck to you Cymmetria!

Re: Cymmetria (YC S15) Uses Virtual Machines to Decoy and Detect Hackers

#19

Post by baudehlo »

ddiinn wrote: post #7

Hi all, Gadi here (CEO of Cymmetria). We are here on Hacker News and would be happy to answer any questions, technical or otherwise, and discuss.

Nothing much to add except good luck Gadi. There's always going to be bad actors in this world and the more techniques the better.

(Slight disclaimer: I know Gadi well from the anti-spam world)

Re: Cymmetria (YC S15) Uses Virtual Machines to Decoy and Detect Hackers

#20

Post by wslh »

ddiinn wrote: post #7

Hi all, Gadi here (CEO of Cymmetria). We are here on Hacker News and would be happy to answer any questions, technical or otherwise, and discuss.

Are you also hooking OS APIs or the machine feels almost completely real? I mean, if the attacker can detect that some APIs are hooked they can infer you are using some kind of honeypot.
Post reply on HN