1 00:00:00,722 --> 00:00:04,942 You found the Backup Wrap-Up, your go-to podcast for all things backup, 2 00:00:04,982 --> 00:00:06,742 recovery, and cyber recovery. 3 00:00:07,512 --> 00:00:11,662 This episode, we take a look at honeypots and canary files, two 4 00:00:11,662 --> 00:00:15,572 tools that can tell you that a bad guy is poking around your network 5 00:00:15,622 --> 00:00:17,772 before they've done any real damage. 6 00:00:18,382 --> 00:00:23,702 Dr. Mike Saylor is back with me and Prasanna to break down how these work, 7 00:00:23,802 --> 00:00:28,892 uh, why layered security matters, and what the actual daf- difference is 8 00:00:28,892 --> 00:00:30,782 between a honeypot and a canary file. 9 00:00:31,472 --> 00:00:35,792 We also cover, uh, how to stand one up without spending a fortune, why 10 00:00:35,792 --> 00:00:41,292 clock synchronization matters more than you might think, uh, that is, if you 11 00:00:41,292 --> 00:00:43,072 ever want your evidence to hold up. 12 00:00:43,492 --> 00:00:46,912 And, uh, Mike and I also have, uh, a little bit of news about 13 00:00:46,912 --> 00:00:50,492 our new O'Reilly book, Learning Ransomware Response and Recovery. 14 00:00:51,062 --> 00:00:51,752 Hope you enjoy it 15 00:01:09,388 --> 00:01:10,618 welcome to the Backup wrap up. 16 00:01:10,618 --> 00:01:14,878 I'm your host, w Curtis Preston, AKA, Mr. Backup, and I have with me 17 00:01:14,878 --> 00:01:16,858 a guy who's apparently in a hurry. 18 00:01:17,008 --> 00:01:18,508 So we gotta get started. 19 00:01:18,688 --> 00:01:20,148 Prasanna Malaiyandi. 20 00:01:20,148 --> 00:01:20,878 How's it going, Prasanna? 21 00:01:21,172 --> 00:01:21,802 Let's go. 22 00:01:21,802 --> 00:01:22,222 Let's go. 23 00:01:22,222 --> 00:01:22,762 Let's go. 24 00:01:22,762 --> 00:01:23,332 Come on. 25 00:01:23,332 --> 00:01:23,872 Fast, fast, fast. 26 00:01:24,612 --> 00:01:26,382 you know how I do all my YouTube at two x? 27 00:01:26,382 --> 00:01:27,582 Can we do this at like two x? 28 00:01:28,338 --> 00:01:29,598 Yeah, I don't think we can do that. 29 00:01:29,968 --> 00:01:31,013 at least pretend to speak faster. 30 00:01:32,323 --> 00:01:32,863 Yeah. 31 00:01:33,853 --> 00:01:38,593 I think this episode, think maybe this episode might be quick. 32 00:01:38,593 --> 00:01:41,903 I always say that and then, next thing I know, 45 minutes later, 33 00:01:42,422 --> 00:01:43,112 One hour. 34 00:01:44,393 --> 00:01:44,993 yeah. 35 00:01:45,053 --> 00:01:46,313 run around with my hair on fire. 36 00:01:46,928 --> 00:01:48,638 Yeah, I see what you did there. 37 00:01:48,878 --> 00:01:51,078 And, speaking of, hair on fire. 38 00:01:51,108 --> 00:01:53,808 we have our guest with us once again, Dr. 39 00:01:53,808 --> 00:01:54,528 Mike Saylor. 40 00:01:54,528 --> 00:01:55,278 How's it going, Mike? 41 00:01:55,538 --> 00:01:56,088 Whoop, whoop. 42 00:01:57,183 --> 00:01:57,843 It's going well. 43 00:01:58,858 --> 00:02:04,588 and he, unlike me is the possessor of physical books. 44 00:02:04,708 --> 00:02:05,968 Could do you have it nearby? 45 00:02:05,968 --> 00:02:06,928 Can you hold it up? 46 00:02:07,633 --> 00:02:08,953 I don't have it nearby. 47 00:02:09,013 --> 00:02:11,833 Oh, so disappointed in you, Mike. 48 00:02:12,003 --> 00:02:14,973 so both of us have been waiting for the shipment, the physical 49 00:02:14,973 --> 00:02:18,543 shipment of the book that we just wrote, learning ransomware response 50 00:02:18,543 --> 00:02:20,613 and recovery, and he beat me. 51 00:02:20,923 --> 00:02:23,983 I, guess shipment to Texas is faster than shipment to California. 52 00:02:23,983 --> 00:02:25,243 I don't know, maybe it's 'cause 53 00:02:25,468 --> 00:02:26,488 I have pictures of it. 54 00:02:26,728 --> 00:02:27,178 although, yeah, 55 00:02:27,283 --> 00:02:27,808 pictures. 56 00:02:28,078 --> 00:02:28,378 of it. 57 00:02:29,548 --> 00:02:31,918 By the way, I like your offer and I'm gonna follow it up as well. 58 00:02:31,918 --> 00:02:33,568 I'm gonna do the same thing with my copies. 59 00:02:33,568 --> 00:02:37,318 We as authors, we get 10 copies and, we're looking for stories, we're 60 00:02:37,318 --> 00:02:40,168 looking for ransomware stories, ransomware events, things like that. 61 00:02:40,468 --> 00:02:44,618 And, we'll pick the best, basically send me a DM on LinkedIn, send Mike a 62 00:02:44,648 --> 00:02:49,098 DM on LinkedIn, and, and then, we'll pick the best ones and the best ones get 63 00:02:49,128 --> 00:02:50,863 a signed copy if that's what you want. 64 00:02:52,273 --> 00:02:52,573 and, 65 00:02:52,603 --> 00:02:55,803 Can you, can they can they get it made out to eBay? 66 00:02:59,419 --> 00:03:00,349 you're so funny. 67 00:03:00,629 --> 00:03:03,539 There's also audio, ver audio book versions for those that don't 68 00:03:03,539 --> 00:03:05,129 like to hold books while they 69 00:03:05,509 --> 00:03:06,469 I literally 70 00:03:06,569 --> 00:03:07,229 consume knowledge. 71 00:03:07,279 --> 00:03:09,649 to the audiobook version just a few minutes ago. 72 00:03:09,649 --> 00:03:10,759 It is very weird. 73 00:03:10,774 --> 00:03:12,274 I'm curious what voice they're using. 74 00:03:12,274 --> 00:03:12,904 is it good? 75 00:03:13,744 --> 00:03:14,524 The guy's fine. 76 00:03:14,574 --> 00:03:17,574 he's a professional audio book narrator. 77 00:03:17,814 --> 00:03:18,084 Mike 78 00:03:18,354 --> 00:03:18,714 Okay. 79 00:03:18,834 --> 00:03:19,164 name. 80 00:03:19,534 --> 00:03:21,964 I actually know a guy that does audio book narration. 81 00:03:21,964 --> 00:03:23,944 His name's William Shakespeare, believe it or not. 82 00:03:24,574 --> 00:03:25,534 and I know him. 83 00:03:25,534 --> 00:03:27,964 And then I have another friend whose name is Robert Lewis Stevenson. 84 00:03:28,174 --> 00:03:29,344 I introduced the two of them. 85 00:03:29,524 --> 00:03:30,784 I also know Stuart Little. 86 00:03:31,064 --> 00:03:32,834 I just know some random odd people. 87 00:03:33,709 --> 00:03:34,309 Anyway. 88 00:03:34,529 --> 00:03:37,109 so Mike, why don't you, why don't you give us a little, there, there was a 89 00:03:37,109 --> 00:03:40,719 little story I think that can help, an analogy here with, talking about 90 00:03:40,719 --> 00:03:42,429 doing alarms in the yard and stuff. 91 00:03:42,459 --> 00:03:43,629 why don't you tell us that story? 92 00:03:45,144 --> 00:03:46,824 Security's all about layers. 93 00:03:46,824 --> 00:03:50,484 Whether you're talking about cybersecurity or physical security, you don't want, 94 00:03:50,514 --> 00:03:55,854 you don't want the one bell or alarm that goes off, to indicate that you 95 00:03:55,854 --> 00:03:57,654 know a threat is right in your face. 96 00:03:57,904 --> 00:04:01,384 you'd prefer that, you know something off in the distance. 97 00:04:01,664 --> 00:04:06,974 trip wire smoke, something coming across the river and making noise in the water. 98 00:04:07,374 --> 00:04:12,414 there's some indication at some point out in the distance that gives you 99 00:04:12,474 --> 00:04:17,484 the idea that something is coming as well as the time necessary to 100 00:04:17,484 --> 00:04:19,464 identify the threat if it is a threat. 101 00:04:20,269 --> 00:04:21,469 respond appropriately. 102 00:04:21,499 --> 00:04:22,819 Like, how do I prepare for this? 103 00:04:23,189 --> 00:04:26,629 if you think about it, in the middle of the night, if you hear something, 104 00:04:26,869 --> 00:04:29,569 the first thing you do is you wake up and go, I think I heard something. 105 00:04:29,929 --> 00:04:33,169 And then you're gonna wait a second and then maybe you hear it again. 106 00:04:33,169 --> 00:04:35,939 And if not, you eventually, you may get up and check it out. 107 00:04:36,269 --> 00:04:38,189 But at that point. 108 00:04:39,074 --> 00:04:40,334 They're already in the house. 109 00:04:40,454 --> 00:04:43,344 And so what do you grab whatever's closest to you, whether it's 110 00:04:43,344 --> 00:04:45,324 your cat or a candlestick or 111 00:04:46,868 --> 00:04:47,468 Baseball bat. 112 00:04:47,574 --> 00:04:48,084 a shoe. 113 00:04:48,474 --> 00:04:51,474 You're not truly prepared for whatever that might be. 114 00:04:51,474 --> 00:04:53,754 You're reacting in the moment and that's not good. 115 00:04:54,054 --> 00:04:56,784 And so from a physical security perspective, typically. 116 00:04:57,204 --> 00:05:01,284 And like in a neighborhood, you've got the street, you've got a curb, sidewalk, 117 00:05:01,284 --> 00:05:06,084 yard fence, and then you got the perimeter of your house with, doors and windows. 118 00:05:06,474 --> 00:05:10,124 And then inside the house, maybe outside the house too, you've got motion lights 119 00:05:10,174 --> 00:05:12,184 and some other things that may trigger. 120 00:05:12,869 --> 00:05:13,979 awareness. 121 00:05:14,039 --> 00:05:18,039 and then you've got, maybe you've got, a door and window sensors. 122 00:05:18,039 --> 00:05:22,349 So if any of those, are interacted with you, maybe you get a beep or the alarm 123 00:05:22,349 --> 00:05:27,179 goes off, and then hopefully you've got other stuff in the house like a dog that's 124 00:05:27,179 --> 00:05:29,799 gonna bark, or more lights or more people. 125 00:05:31,059 --> 00:05:36,224 but the point is if a car, or somebody comes off the street. 126 00:05:36,579 --> 00:05:39,729 there, there's layer one, layer two is across the sidewalk. 127 00:05:39,759 --> 00:05:44,079 maybe that's how far out your motion sensors are, and now they're in the yard. 128 00:05:44,079 --> 00:05:47,289 Now the light goes off, or the dog starts barking. 129 00:05:47,599 --> 00:05:50,569 and so now there's other indicators that there's a threat approaching. 130 00:05:50,569 --> 00:05:52,519 and you, so now you're starting to respond. 131 00:05:52,569 --> 00:05:53,799 you're looking out the window. 132 00:05:54,109 --> 00:05:57,429 you're on the phone with nine one one or you're grabbing your weapon, or you're. 133 00:05:57,664 --> 00:06:01,574 You got your crew together, to respond to this threat if it comes through the door. 134 00:06:02,294 --> 00:06:03,254 So that's the idea. 135 00:06:03,254 --> 00:06:07,064 And si very similarly in cyber, we don't wanna wait until 136 00:06:07,064 --> 00:06:10,794 something gets to our laptop and, someone's moving our mouse around. 137 00:06:11,224 --> 00:06:15,094 we want other things between us and the bad guy, at least enough 138 00:06:15,094 --> 00:06:16,744 of them, more than one thing. 139 00:06:17,024 --> 00:06:22,544 so that we start to become aware of weird stuff much sooner than all 140 00:06:22,544 --> 00:06:25,124 of a sudden our files are encrypted and we can't use our computer. 141 00:06:25,988 --> 00:06:27,918 Mike, I love that analogy. 142 00:06:28,188 --> 00:06:33,198 one thing that I know people sometimes say is you just want to make your house 143 00:06:33,198 --> 00:06:37,458 look less appealing for a would be robber right than the house next door. 144 00:06:38,273 --> 00:06:41,723 and by having those motion lights or motion triggered lights and things like 145 00:06:41,723 --> 00:06:45,113 that, it's like, Hey, maybe I should go next door and see what's there. 146 00:06:45,143 --> 00:06:50,483 Rather than trying to go to your house, is there something similar, like 147 00:06:50,483 --> 00:06:55,253 does that analogy also apply in the cyber world as well, or not so much? 148 00:06:55,253 --> 00:06:55,913 At least that part. 149 00:06:56,213 --> 00:06:56,543 Okay. 150 00:06:56,639 --> 00:07:00,089 So in the physical world, we've got a much, a much more 151 00:07:00,089 --> 00:07:02,459 personal sense of risk, right? 152 00:07:02,699 --> 00:07:05,614 So if I'm on the street and I'm a bad guy and I'm on the street and I'm 153 00:07:05,614 --> 00:07:11,299 looking at house A and house B. I'm absolutely assessing the risk to myself, 154 00:07:11,329 --> 00:07:17,709 my health, my, my consciousness, per perhaps, being caught and going to jail. 155 00:07:18,489 --> 00:07:19,209 injury. 156 00:07:19,419 --> 00:07:20,199 Do they have a dog? 157 00:07:20,199 --> 00:07:21,669 I don't want, I don't like dogs, right? 158 00:07:21,669 --> 00:07:22,539 I don't wanna get bitten. 159 00:07:22,879 --> 00:07:25,759 or is there a sign in the yard that says there's an alarm system? 160 00:07:26,479 --> 00:07:29,214 there a car in the driveway that says, local police department? 161 00:07:29,889 --> 00:07:33,169 first Amendment, or Second Amendment, or, don't tread on me. 162 00:07:33,169 --> 00:07:35,689 And I like guns and we don't call the police. 163 00:07:35,689 --> 00:07:40,619 We, we call the landscaper, So I'm doing this assessment because I am 164 00:07:40,979 --> 00:07:44,869 personally, physically, personally involved in this threat, this crime. 165 00:07:45,889 --> 00:07:48,649 cybersecurity is much different for a couple of reasons. 166 00:07:48,649 --> 00:07:53,329 One, very rarely do bad guys sit back in their chair and they, look at 167 00:07:53,329 --> 00:07:57,229 company A and company or, victim A or victim B. they don't always do that. 168 00:07:57,319 --> 00:07:58,639 In fact, it's very rare. 169 00:07:59,499 --> 00:08:03,219 what they typically do is just cast a wide net using tools to 170 00:08:03,219 --> 00:08:08,229 find open windows and open doors in these victim networks and systems. 171 00:08:08,859 --> 00:08:12,679 And it's not until they start looking into, what does this door, 172 00:08:12,679 --> 00:08:15,019 what, who, where does this door go? 173 00:08:15,019 --> 00:08:16,099 Where does this window go? 174 00:08:16,099 --> 00:08:19,169 That then they determine, that's a, that's nasa, right? 175 00:08:19,169 --> 00:08:21,239 I don't want to, maybe I'm risk averse to. 176 00:08:21,694 --> 00:08:22,204 That, 177 00:08:22,253 --> 00:08:22,583 Yeah. 178 00:08:22,834 --> 00:08:26,204 versus, Joe Schmo dental office. 179 00:08:26,304 --> 00:08:29,714 so it's, it does happen, but not to the same degree and definitely 180 00:08:29,764 --> 00:08:31,504 not early on, like physical. 181 00:08:31,564 --> 00:08:32,104 I'm doing it. 182 00:08:32,194 --> 00:08:32,824 Step one. 183 00:08:32,824 --> 00:08:35,944 I'm assessing risk cyber, it's down the road a bit. 184 00:08:36,324 --> 00:08:38,304 as they get to know who the victims are. 185 00:08:39,294 --> 00:08:39,474 Yeah. 186 00:08:39,744 --> 00:08:40,104 And so 187 00:08:40,134 --> 00:08:40,524 Targets are. 188 00:08:41,604 --> 00:08:46,584 is, that determines like how you're going to do the kinds of things. 189 00:08:46,584 --> 00:08:50,764 It's a good analogy of the security, but how we're going to 190 00:08:50,764 --> 00:08:52,774 respond is a little bit different. 191 00:08:52,774 --> 00:08:55,174 But I think there are some. 192 00:08:55,374 --> 00:08:57,024 Analogous things. 193 00:08:57,264 --> 00:09:00,419 So you talked about, you literally used the word tripwire. 194 00:09:00,419 --> 00:09:01,529 You could have a trip wire. 195 00:09:01,579 --> 00:09:03,259 there's a product called Tripwire. 196 00:09:03,689 --> 00:09:07,719 the, there are, and they operate in much the same way. 197 00:09:07,719 --> 00:09:10,569 I think the thing, the primary thing that we're gonna talk about today. 198 00:09:10,969 --> 00:09:16,589 I don't think there's really an analogy to that in the, kinetic world. 199 00:09:16,949 --> 00:09:18,089 that word keeps coming up. 200 00:09:18,449 --> 00:09:21,059 I don't think there's really an analogy to this concept of a 201 00:09:21,059 --> 00:09:22,769 honey potter or a canary file. 202 00:09:22,979 --> 00:09:26,734 Before we talk about that, a persona, do you know why do 203 00:09:26,734 --> 00:09:28,669 we use the term canary files? 204 00:09:28,669 --> 00:09:30,064 Or why do we use the term canary? 205 00:09:31,008 --> 00:09:33,048 Of course I've watched movies. 206 00:09:35,568 --> 00:09:38,958 Did they not use a canary in Zoolander? 207 00:09:39,738 --> 00:09:40,408 I don't think they did. 208 00:09:41,989 --> 00:09:44,179 I don't think they did in Zoolander, but that's funny. 209 00:09:44,179 --> 00:09:46,159 I was like, what is he, why is he talking about Zoolander? 210 00:09:46,339 --> 00:09:46,759 Yeah. 211 00:09:46,809 --> 00:09:49,929 the, yeah, it's the cana The phrase is the canary in the coal mine. 212 00:09:49,929 --> 00:09:50,619 what was that? 213 00:09:51,513 --> 00:09:55,683 So when miners would go into these coal mines, of course at some 214 00:09:55,683 --> 00:09:57,963 point oxygen gets low, right? 215 00:09:57,963 --> 00:10:00,603 You have a good chance of suffocating. 216 00:10:00,603 --> 00:10:04,953 And so what they would do is they would bring a canary, which is a little bird 217 00:10:05,223 --> 00:10:07,173 with them along deep into the mines. 218 00:10:07,793 --> 00:10:11,453 And if a canary passed out or something else like that, then they 219 00:10:11,453 --> 00:10:13,463 knew, okay, there's less oxygen. 220 00:10:13,463 --> 00:10:15,173 Probably a buildup of carbon monoxide. 221 00:10:15,173 --> 00:10:17,573 We need to get out of here before we pass out. 222 00:10:17,573 --> 00:10:18,053 We die. 223 00:10:18,593 --> 00:10:20,003 So canary in a coal mine. 224 00:10:20,769 --> 00:10:22,239 Of course the honey pot. 225 00:10:22,304 --> 00:10:25,334 I think this is really just an analogy to, Winnie the Pooh. 226 00:10:25,814 --> 00:10:27,974 and, 'cause he cannot resist a honey pot. 227 00:10:28,244 --> 00:10:35,089 So let's talk about what the, so this idea, Mike is again that we're 228 00:10:35,089 --> 00:10:43,229 trying to, trying to figure out that somebody is doing something, before. 229 00:10:44,114 --> 00:10:48,494 actually do something, is that, I'm trying to take your analogy, which I really 230 00:10:48,494 --> 00:10:50,564 like, and then bring it into this world. 231 00:10:50,984 --> 00:10:55,694 We're trying to figure out that they're up to no good they 232 00:10:55,694 --> 00:10:57,494 actually get up to no good. 233 00:10:57,674 --> 00:10:59,054 Does that sound right? 234 00:10:59,054 --> 00:10:59,084 I. 235 00:11:00,434 --> 00:11:00,884 Close. 236 00:11:00,964 --> 00:11:04,404 it, that, that is one objective honeypots, actually serve a 237 00:11:04,404 --> 00:11:05,934 couple of different purposes. 238 00:11:06,804 --> 00:11:14,224 one of them, is, a blatantly vulnerable honeypot is designed to allow, entice, 239 00:11:15,064 --> 00:11:19,414 bad guys to attack it so that we learn about their tactics and techniques. 240 00:11:20,084 --> 00:11:24,374 So what's the newest way bad guys are attacking the newest version of Windows 241 00:11:24,374 --> 00:11:27,134 or Apple io Mobile, iOS or whatever. 242 00:11:27,134 --> 00:11:33,054 So we put these honeypots out there to figure out why or how, bad guys are doing 243 00:11:33,054 --> 00:11:38,014 it, and we use that information to make our products better, or it's also a good 244 00:11:38,014 --> 00:11:41,844 way to, attribute, a given attacker's. 245 00:11:42,639 --> 00:11:46,099 Techniques and tactics and procedures, we call those TTPs. 246 00:11:46,529 --> 00:11:50,659 so how do we attribute then, because maybe we've got this open case, comp all these 247 00:11:50,659 --> 00:11:54,169 victims, they're getting attacked and we underst, we've documented those TTPs, 248 00:11:54,169 --> 00:11:55,669 but we can't figure out who's doing it. 249 00:11:56,249 --> 00:11:59,429 so we can put a honeypot out there with similar victim. 250 00:11:59,739 --> 00:12:03,469 attributes, something that looks like the profile of a company these bad guys are 251 00:12:03,469 --> 00:12:08,209 attacking and we learn from that and it gives us an opportunity to potentially 252 00:12:08,209 --> 00:12:10,549 tra track that activity in real time. 253 00:12:10,819 --> 00:12:11,449 So there's that. 254 00:12:12,194 --> 00:12:17,354 So it's a learning tool to try and get, more, familiarity with bad guy TTPs. 255 00:12:18,074 --> 00:12:23,324 the other one is a distraction, I've got this very valuable production network. 256 00:12:23,324 --> 00:12:27,734 So maybe I'm a, an IOT network and IOT's very vulnerable, especially 257 00:12:27,734 --> 00:12:30,884 the older ones where we didn't really build secure architecture. 258 00:12:30,884 --> 00:12:33,244 It's, I can ping a wellhead from a conference room. 259 00:12:33,244 --> 00:12:33,994 That's not good. 260 00:12:34,384 --> 00:12:38,949 If I build a very similar, potentially even simulated, honeypot 261 00:12:38,949 --> 00:12:43,269 environment, bad guys compromise it, and it looks and reacts just 262 00:12:43,269 --> 00:12:46,599 like my production environment, then they're gonna stop looking. 263 00:12:46,659 --> 00:12:49,119 They think they've achieved their goal, right? 264 00:12:49,449 --> 00:12:50,949 And so it's a distraction. 265 00:12:52,179 --> 00:12:56,489 And then lastly, honeypots can be used as a test environment. 266 00:12:57,409 --> 00:12:58,309 so I can. 267 00:12:59,359 --> 00:13:02,119 If it's only used for that, then we wouldn't call it a honeypot. 268 00:13:02,149 --> 00:13:05,059 But because we've already created this simulated environment that's 269 00:13:05,059 --> 00:13:08,899 supposed to replicate and behave like production, why don't I also use that 270 00:13:08,899 --> 00:13:12,439 for testing my changes, like change management, other stuff, right? 271 00:13:13,159 --> 00:13:17,709 so there's a couple of different thing, ways we can use honeypots and a real world 272 00:13:17,769 --> 00:13:20,589 kinetic, example would be like bait cars. 273 00:13:20,909 --> 00:13:22,459 we, the, the auto. 274 00:13:23,104 --> 00:13:25,084 auto theft division of police departments. 275 00:13:25,134 --> 00:13:28,464 how are bad guys stealing the brand new Cadillac when it's supposed to have these 276 00:13:28,464 --> 00:13:30,144 coated keys and this, that, and the other? 277 00:13:30,574 --> 00:13:33,844 they'll put one out on the street and they'll make people, they'll let the 278 00:13:33,844 --> 00:13:38,204 right people know that car's gonna be there for a while and then they observe 279 00:13:38,204 --> 00:13:42,104 bad guys and how they attempt to steal it and then they steal it and now we 280 00:13:42,104 --> 00:13:45,344 can track it and figure out all this stuff and those bad guys get caught. 281 00:13:47,264 --> 00:13:47,819 and then back on the. 282 00:13:49,569 --> 00:13:50,529 gone in 60 seconds. 283 00:13:50,529 --> 00:13:51,789 That's what's, it's a good show. 284 00:13:52,139 --> 00:13:53,909 and they do that with a variety of different things. 285 00:13:53,909 --> 00:13:54,809 It's not just cars. 286 00:13:54,809 --> 00:13:59,579 They do it with bikes and computers and that's, of value that they've 287 00:13:59,579 --> 00:14:01,949 got this high volume of theft with. 288 00:14:01,949 --> 00:14:07,129 they'll create these bait, bait situations where, they want bad guys 289 00:14:07,129 --> 00:14:12,189 to take it so they can learn from it and track 'em and, potentially curb, 290 00:14:12,279 --> 00:14:15,059 curb the, The volume of that crime. 291 00:14:15,503 --> 00:14:20,543 So a non sequitur, I'm going to comment on one of my favorite bait sort of 292 00:14:20,543 --> 00:14:24,653 things that people do is a porch Pirates where they do the glitter bombs. 293 00:14:25,139 --> 00:14:25,469 Yep. 294 00:14:26,729 --> 00:14:28,049 So that's also a honeypot, right? 295 00:14:28,274 --> 00:14:29,774 Yeah, it's like a honey pot. 296 00:14:29,834 --> 00:14:32,199 A honey pot with a exploding honey. 297 00:14:33,789 --> 00:14:36,169 yeah, I do love the Porch Pirate glitter bomb, folks. 298 00:14:36,509 --> 00:14:36,989 and. 299 00:14:37,829 --> 00:14:38,519 Yeah, I do. 300 00:14:38,519 --> 00:14:39,839 I do love that very much. 301 00:14:39,999 --> 00:14:43,989 and I think the idea with the honeypot, especially given what you're saying, 302 00:14:43,989 --> 00:14:48,819 that not just a matter of alerting us, But, it's also a matter of, 303 00:14:49,159 --> 00:14:51,709 learning about the attacker and also. 304 00:14:52,004 --> 00:14:55,304 their techniques and also potentially slowing them down. 305 00:14:55,514 --> 00:14:57,704 That is, I hadn't actually thought about that second one. 306 00:14:57,704 --> 00:15:02,834 The idea that if we do a good enough honeypot, that it, they 307 00:15:02,834 --> 00:15:05,444 actually might think that they've accomplished their objective. 308 00:15:05,444 --> 00:15:07,734 That's a really interesting, method. 309 00:15:07,734 --> 00:15:11,854 And of course, I'm assuming that it would also activate some sort 310 00:15:11,854 --> 00:15:17,224 of notification, so that we know that something has happened. 311 00:15:17,274 --> 00:15:18,239 did we talk, go 312 00:15:18,353 --> 00:15:18,893 but yeah. 313 00:15:18,923 --> 00:15:20,453 Just a question on a honeypot though, right? 314 00:15:20,693 --> 00:15:24,383 It all boils down to though how realistic of a honeypot you create. 315 00:15:24,953 --> 00:15:29,283 Because if a bad guy knows, hey, it's like I think Mike, in one of the previous 316 00:15:29,283 --> 00:15:32,283 episodes, you talked about, okay, if malware runs and it's Hey, this is running 317 00:15:32,283 --> 00:15:36,723 within a virtual machine or a sandbox machine, I think on prior episodes, right? 318 00:15:36,723 --> 00:15:38,133 It's okay, maybe the ransomware. 319 00:15:38,873 --> 00:15:41,813 Or malware doesn't operate in a certain way. 320 00:15:42,143 --> 00:15:47,633 And so I think in order for a honeypot to be useful, it needs to really 321 00:15:47,633 --> 00:15:53,023 emulate a real world, example use case such that a bad guy doesn't know, 322 00:15:53,023 --> 00:15:55,513 Hey, I am in this isolated network. 323 00:15:55,513 --> 00:15:59,393 I am attacking a machine which doesn't have any value because then 324 00:15:59,633 --> 00:16:00,713 they'll just move on from that. 325 00:16:00,713 --> 00:16:00,723 Right? 326 00:16:03,124 --> 00:16:08,204 And it and honeypots are not, to your point, they're easy to set up, 327 00:16:08,204 --> 00:16:11,674 but they, it takes some time to, and management to, care and feeding. 328 00:16:12,694 --> 00:16:16,034 but if you're a, a sizable organization that has a test development 329 00:16:16,034 --> 00:16:17,754 environment, it's a similar. 330 00:16:18,464 --> 00:16:19,424 Exercise, right? 331 00:16:19,424 --> 00:16:23,349 So you've got, you wanna replic, replicate to a degree or mirror 332 00:16:23,409 --> 00:16:26,759 your production environment so that your testing is, is applicable. 333 00:16:27,099 --> 00:16:30,249 if you can then take that test dev environment and mirror 334 00:16:30,249 --> 00:16:34,359 that in your honeypot, whenever you update test dev just. 335 00:16:35,364 --> 00:16:36,864 the copy in the honeypot. 336 00:16:37,644 --> 00:16:40,404 and you should be using scrubbed or simulated data 337 00:16:40,404 --> 00:16:41,724 in your test dev environment. 338 00:16:42,094 --> 00:16:46,774 so all that stuff could, if you're doing it the right way, be pretty easy to 339 00:16:46,774 --> 00:16:48,019 replicate or mirror in your honeypot. 340 00:16:48,869 --> 00:16:52,949 it, and that, that takes me back, takes me back, back in the day. 341 00:16:52,999 --> 00:16:57,949 once again, and I remember that we had, we had a naming convention 342 00:16:58,879 --> 00:17:04,179 would very much, to the purpose of the server, and it would allude to 343 00:17:04,179 --> 00:17:07,629 the fact that it was a production server or a test or a dev server. 344 00:17:07,989 --> 00:17:12,589 And in this case, if the test of dev is also gonna be acting as a honeypot. 345 00:17:12,619 --> 00:17:14,659 then you would definitely not want to do that, right? 346 00:17:14,659 --> 00:17:15,349 You would want it to 347 00:17:15,539 --> 00:17:17,519 Yeah, don't call your honeypot assets. 348 00:17:17,549 --> 00:17:20,539 don't start their names with honeypot, or test dev. 349 00:17:20,539 --> 00:17:20,749 Yeah, 350 00:17:21,549 --> 00:17:22,119 Yeah, honey. 351 00:17:23,239 --> 00:17:23,659 one. 352 00:17:23,979 --> 00:17:24,969 honey pot one. 353 00:17:24,969 --> 00:17:25,269 Yeah. 354 00:17:25,269 --> 00:17:25,689 Don't do 355 00:17:25,759 --> 00:17:26,869 Someone call that a clue. 356 00:17:27,709 --> 00:17:31,944 it does the idea is that it's gonna be something like it's still running. 357 00:17:32,299 --> 00:17:38,969 windows 2003 server, with SMB turned on with no authentication. 358 00:17:39,209 --> 00:17:43,959 RDP my favorite, the ransomware de deployment protocol, RDP is 359 00:17:43,959 --> 00:17:45,789 turned on and it's available. 360 00:17:45,939 --> 00:17:50,439 All of the things that we're not supposed to do in our production environment, 361 00:17:50,489 --> 00:17:53,819 it's expected that you would do that in a hunting pot environment. 362 00:17:54,819 --> 00:17:58,089 one of the things too, bad guys are absolutely gonna jump at the opportunity 363 00:17:58,089 --> 00:18:01,694 to get into a network like that, but at the same time, they're gonna go. 364 00:18:02,934 --> 00:18:06,444 They're gonna go cautiously because of how blatantly obvious it is. 365 00:18:06,804 --> 00:18:10,489 So if you're gonna, if you're gonna, if you're gonna really walk outside 366 00:18:10,489 --> 00:18:15,759 with your robe open, make sure that you sprinkle in some documentation, for maybe 367 00:18:15,759 --> 00:18:18,664 there's a text file that says, we really shouldn't be putting this online yet. 368 00:18:19,319 --> 00:18:24,729 Or, some false artifacts, that, that would state risk or identify risk or, 369 00:18:25,109 --> 00:18:29,499 my favorite is, emails from executives telling it, I don't care what the 370 00:18:29,499 --> 00:18:31,299 risk is, we've gotta do it this way. 371 00:18:31,969 --> 00:18:36,329 stuff like that would help, further the story and potentially keep, 372 00:18:36,429 --> 00:18:38,169 bad guys engaged a little longer. 373 00:18:38,644 --> 00:18:42,334 Interesting that, so the social engineering aspect of 374 00:18:42,334 --> 00:18:43,864 this is quite interesting. 375 00:18:43,894 --> 00:18:48,469 I'm thinking about, I'm actually thinking about, the, when they, in World War 376 00:18:48,469 --> 00:18:53,739 ii, when they staged the attack for D-Day and they had that entire other. 377 00:18:54,139 --> 00:18:57,199 fake army and they had plans and all of that, right? 378 00:18:57,229 --> 00:18:59,269 and they really did, they fooled them, right? 379 00:18:59,349 --> 00:19:01,684 that they thought that this, that this was happening. 380 00:19:01,714 --> 00:19:04,094 at, it was, but they thought it was happening in a completely different 381 00:19:04,094 --> 00:19:05,474 place at a completely different time. 382 00:19:05,684 --> 00:19:06,314 I've actually been 383 00:19:06,364 --> 00:19:06,574 Yep. 384 00:19:06,614 --> 00:19:09,254 location where they states that it was really cool that the 385 00:19:09,254 --> 00:19:10,804 fake, tanks and things like that. 386 00:19:11,398 --> 00:19:12,148 Are there. 387 00:19:13,903 --> 00:19:18,283 Tools people can use for creating honeypots and configuring. 388 00:19:18,283 --> 00:19:22,473 I know you said it's probably e not too bad to set it up, but to actually 389 00:19:22,473 --> 00:19:25,263 like configure it and getting it more legitimate and all the rest 390 00:19:25,623 --> 00:19:27,513 takes time, caring and feeding. 391 00:19:28,113 --> 00:19:31,043 And so I was just wondering what are some of the tools out 392 00:19:31,043 --> 00:19:32,783 there people may use for this? 393 00:19:34,459 --> 00:19:36,159 there's a couple, you can just Google it. 394 00:19:37,129 --> 00:19:38,929 you'll find open source projects there. 395 00:19:38,929 --> 00:19:41,149 There's one called the Honeypot Project. 396 00:19:42,169 --> 00:19:45,129 and so there's, Image files there, there's pretty much everything you 397 00:19:45,129 --> 00:19:47,689 would need, to set up your own honeypot. 398 00:19:49,579 --> 00:19:53,329 but really a honeypot is just an environment that, segmented 399 00:19:53,329 --> 00:19:54,679 away from everything else. 400 00:19:55,909 --> 00:20:00,349 and it could just be a, literally a mirror of your test dev environment. 401 00:20:01,339 --> 00:20:04,369 or if you've got a backup of a production environment from 402 00:20:05,269 --> 00:20:07,139 years ago, just spin that up. 403 00:20:07,619 --> 00:20:09,539 'cause all that stuff isn't gonna be patched. 404 00:20:10,733 --> 00:20:12,353 So you don't need, necessarily need. 405 00:20:12,383 --> 00:20:12,653 Okay. 406 00:20:12,683 --> 00:20:16,253 That's actually good to know because that means you don't need something special. 407 00:20:16,253 --> 00:20:20,003 You could use whatever you already have for the most part 408 00:20:20,183 --> 00:20:21,923 in order to spin up honeypots. 409 00:20:22,679 --> 00:20:22,949 Yep. 410 00:20:23,429 --> 00:20:26,449 So there's free stuff and there's also services, mostly 411 00:20:26,449 --> 00:20:28,159 for the research part of that. 412 00:20:28,579 --> 00:20:35,154 I think Tea teapot, tea dash pot, it's, it's European or it's somewhere overseas. 413 00:20:35,154 --> 00:20:36,684 It's foreign service. 414 00:20:37,134 --> 00:20:39,679 and I think there's a pay for version of that, and there's a free version of that. 415 00:20:41,769 --> 00:20:44,329 I, I need to go find the link that IS that. 416 00:20:44,329 --> 00:20:47,199 I, I sent to you guys, I don't know, a week or two ago. 417 00:20:47,389 --> 00:20:51,789 I'm seeing advertised people on budgets or time constraints. 418 00:20:51,789 --> 00:20:55,449 I've been seeing this advertised, this basically honey pot in a box, and 419 00:20:55,449 --> 00:20:59,444 it's literally, it looks around the same size As like the, the firewall, 420 00:20:59,534 --> 00:21:01,274 which is a product I like a lot. 421 00:21:01,334 --> 00:21:04,194 and, it's, it is just literally tiny little box. 422 00:21:04,194 --> 00:21:05,484 It is just plug and play. 423 00:21:05,584 --> 00:21:06,184 honeypot. 424 00:21:06,234 --> 00:21:09,874 I don't know much about how it works, but that's a tool that I've seen out there. 425 00:21:09,874 --> 00:21:12,544 I gotta see if I can find that and put that in the episode description. 426 00:21:13,204 --> 00:21:17,524 I think just the idea is like having the go back to, and we say this a lot, 427 00:21:17,524 --> 00:21:19,714 something's better than nothing, right? 428 00:21:19,814 --> 00:21:23,444 and, you can walk before you can or crawl before you can walk 429 00:21:23,444 --> 00:21:24,524 and walk before you can run. 430 00:21:24,974 --> 00:21:26,444 anything is better than nothing. 431 00:21:27,409 --> 00:21:28,759 about this idea? 432 00:21:28,789 --> 00:21:29,689 Mike, go ahead. 433 00:21:30,494 --> 00:21:32,294 As long as you train with it. 434 00:21:32,394 --> 00:21:33,924 we don't have a whole lot, but I have this thing. 435 00:21:35,074 --> 00:21:38,224 have you ever used that thing for that purpose? 436 00:21:38,314 --> 00:21:41,224 A great example of that is having a cat. 437 00:21:42,394 --> 00:21:42,964 I have a cat. 438 00:21:42,994 --> 00:21:44,044 I love cats. 439 00:21:44,914 --> 00:21:47,824 Hypothetically, I'm actually allergic to cats, but, let's just, 440 00:21:48,454 --> 00:21:48,834 You don't 441 00:21:48,904 --> 00:21:49,709 let's say you're a cat person. 442 00:21:49,929 --> 00:21:50,769 example. 443 00:21:51,574 --> 00:21:53,044 No, a cat is a great example. 444 00:21:53,044 --> 00:21:57,004 I could use a dog, but after I get through this, you'll understand why I didn't pick 445 00:21:57,004 --> 00:21:58,734 a, maybe a chihuahua, but not my dog. 446 00:22:00,354 --> 00:22:01,674 all right, so you have a cat. 447 00:22:01,704 --> 00:22:04,224 You love your cat, you pet your cat, you take care of your cat. 448 00:22:04,224 --> 00:22:05,514 Your cat is company. 449 00:22:05,544 --> 00:22:07,074 it's a domesticated animal. 450 00:22:07,794 --> 00:22:11,124 You don't have any other security controls in your house. 451 00:22:11,884 --> 00:22:13,054 maybe you're a good fighter. 452 00:22:13,054 --> 00:22:13,984 You've got nails. 453 00:22:13,984 --> 00:22:14,944 you can scream. 454 00:22:15,314 --> 00:22:18,824 you can run fast, but no other real security controls. 455 00:22:18,824 --> 00:22:22,604 If someone breaks into your house, if you think about it 456 00:22:22,874 --> 00:22:26,354 and you're comfortable doing it, throw your cat at the bad person. 457 00:22:27,074 --> 00:22:30,614 'cause the first thing the cat's gonna do is claws first towards 458 00:22:30,614 --> 00:22:32,924 whatever it's heading towards. 459 00:22:34,124 --> 00:22:35,834 And bad it. 460 00:22:36,224 --> 00:22:37,634 Put yourself in the bad guy's shoes. 461 00:22:37,634 --> 00:22:38,894 Someone just threw a cat at you. 462 00:22:39,314 --> 00:22:42,044 Are you still coming forward or you're stopping to like, 463 00:22:42,134 --> 00:22:43,724 defend yourself against his cat? 464 00:22:44,444 --> 00:22:47,684 that gives you a couple of seconds at least to, to get away. 465 00:22:47,714 --> 00:22:48,854 'cause maybe you are fast. 466 00:22:51,314 --> 00:22:54,154 but again, because I'm not a cat person, I'm, I like cats. 467 00:22:54,154 --> 00:22:55,024 I just, I'm allergic. 468 00:22:55,174 --> 00:22:56,254 I couldn't use dogs. 469 00:22:56,284 --> 00:23:01,384 'cause obviously in that example, dogs are heavier and dogs, if again, if you've 470 00:23:01,384 --> 00:23:05,744 trained them or you've put them in that situation would attack or at least. 471 00:23:06,164 --> 00:23:06,974 Growl and 472 00:23:07,054 --> 00:23:07,354 Yeah, it 473 00:23:07,429 --> 00:23:08,149 make a scene. 474 00:23:08,389 --> 00:23:09,649 Make someone think twice. 475 00:23:10,609 --> 00:23:14,479 I used to have great Pyrenees, 160 pound, great Pyrenees, super 476 00:23:14,479 --> 00:23:17,489 sweet dude, big male, great Pyrenees, and I was outta town. 477 00:23:17,489 --> 00:23:20,759 Once he set off the motion alarm in the house, called the police. 478 00:23:20,759 --> 00:23:23,879 Police showed up to check to make sure nothing was in the house. 479 00:23:24,119 --> 00:23:24,629 And. 480 00:23:25,029 --> 00:23:28,209 He got to the side door and this big great py, he is just sitting 481 00:23:28,269 --> 00:23:30,759 on his butt, looking out the door, head down a little bit. 482 00:23:30,759 --> 00:23:32,469 And the police, I was on the phone with the officer, he is yeah, 483 00:23:32,469 --> 00:23:33,609 no one's going in that house. 484 00:23:34,359 --> 00:23:35,229 that's different. 485 00:23:35,889 --> 00:23:36,549 That's different. 486 00:23:36,579 --> 00:23:40,059 but if all you have is a cat and you think about it and 487 00:23:40,109 --> 00:23:41,369 you've actually done a little. 488 00:23:42,334 --> 00:23:44,014 Maybe mental exercise. 489 00:23:44,374 --> 00:23:48,304 Throwing your cat at a bad person is a, next best thing to nothing, to 490 00:23:48,304 --> 00:23:50,134 Curtis's point, it's better than nothing. 491 00:23:50,479 --> 00:23:50,869 Right. 492 00:23:51,064 --> 00:23:55,834 but you have to have at least put yourself in that situation so that 493 00:23:55,834 --> 00:24:01,924 you can think of or do, whatever that one thing is that's better than 494 00:24:02,108 --> 00:24:03,258 Don't try it with the goldfish. 495 00:24:04,654 --> 00:24:04,864 it. 496 00:24:04,914 --> 00:24:09,409 the throwing a, a goldfish bowl at somebody is probably good. 497 00:24:10,129 --> 00:24:12,799 the another important thing about a honeypot and on the, we're 498 00:24:12,799 --> 00:24:13,909 in the action items part here. 499 00:24:13,909 --> 00:24:16,459 So if we're gonna do something right, if we're gonna do a honeypot 500 00:24:17,539 --> 00:24:22,669 there, part of that needs to be that a notification, right? 501 00:24:22,699 --> 00:24:26,779 And so you do need to create a type of notification that won't easily 502 00:24:26,779 --> 00:24:30,859 be noticed, 'cause You want to be notified that somebody has hit the 503 00:24:30,859 --> 00:24:32,429 trip wire that somebody has put their. 504 00:24:32,869 --> 00:24:36,599 their hands in the honey pot, but you don't want the, the bad guys 505 00:24:36,599 --> 00:24:39,269 to know that they've been caught with their hands in the honey pot. 506 00:24:39,749 --> 00:24:42,059 wanna monitor the honeypot just like you would. 507 00:24:43,029 --> 00:24:45,729 parts of your network because you, you need to know, you need to know 508 00:24:45,729 --> 00:24:48,639 bad guys are attacking your honeypot so that you can better prepare 509 00:24:48,639 --> 00:24:53,119 for the iop, the scenario where they attack your real network, if 510 00:24:53,119 --> 00:24:54,499 you're using it to learn from them. 511 00:24:54,499 --> 00:24:56,829 Obviously you're gonna collect all that telemetry data. 512 00:24:57,309 --> 00:25:00,969 and if they start taking things from you, that's a great place 513 00:25:00,969 --> 00:25:02,259 to put those canary files. 514 00:25:02,259 --> 00:25:04,179 So now you can track where it goes. 515 00:25:05,124 --> 00:25:09,534 going to just ask about Canaries, 'cause we talked about it at the very beginning 516 00:25:09,534 --> 00:25:11,304 and then we moved off to honeypots and. 517 00:25:11,435 --> 00:25:15,185 So yeah, so Canary files would be something just, it is like a 518 00:25:15,185 --> 00:25:16,865 honey pot within a server, right? 519 00:25:16,865 --> 00:25:20,145 So you have a regular server, and then you've got, these files that 520 00:25:20,145 --> 00:25:24,005 were very, very, but does that, are you okay with that description that 521 00:25:24,005 --> 00:25:26,075 it's like a honeypot within a server? 522 00:25:26,075 --> 00:25:26,705 Does that sound okay? 523 00:25:26,705 --> 00:25:26,975 Mike 524 00:25:29,555 --> 00:25:29,795 doesn't 525 00:25:29,900 --> 00:25:33,870 so a honey pot is really just anything that a honey pot's, anything that, that, 526 00:25:33,940 --> 00:25:35,590 looks appealing, it's gonna attract. 527 00:25:35,620 --> 00:25:38,550 So you're attracting bees, you're attracting things to the honey. 528 00:25:38,910 --> 00:25:42,420 So yeah, the canary file could be the honey for sure. 529 00:25:42,680 --> 00:25:45,050 So it's just a, it is just, I think it's just a different 530 00:25:45,050 --> 00:25:47,000 term for kind of the same thing. 531 00:25:47,000 --> 00:25:50,570 It's just a, it's a file as opposed to an entire server. 532 00:25:50,670 --> 00:25:51,210 And that file 533 00:25:51,380 --> 00:25:52,850 the objective is a little different. 534 00:25:52,850 --> 00:25:58,170 So the honeypot in general is designed to capture, it's designed to distract, 535 00:25:58,350 --> 00:26:03,860 it's designed to attract, and capture activity and learn from and keep them away 536 00:26:03,860 --> 00:26:07,620 from, the beehive, but the canary file. 537 00:26:08,985 --> 00:26:13,245 Adds a couple of other objectives to that one. 538 00:26:14,595 --> 00:26:19,035 because it's a file, a particular object, and that object is typically a file, 539 00:26:19,035 --> 00:26:21,675 like a spreadsheet or a Word document or. 540 00:26:22,270 --> 00:26:26,170 a file, it's not a folder, it's not a volume, it's a file. 541 00:26:26,950 --> 00:26:31,870 That file has its own little trip wires and a couple of things that, that are 542 00:26:31,870 --> 00:26:38,110 going to trip them is any change to the attributes and metadata of that file. 543 00:26:38,470 --> 00:26:43,660 So if when we set that file two days ago, the last accessed and 544 00:26:43,660 --> 00:26:46,250 created date was, two days ago. 545 00:26:47,480 --> 00:26:51,530 If any of the metadata changes today, that trips the Canary file, so we'll get an 546 00:26:51,530 --> 00:26:53,390 alert that says, Hey, someone touched it. 547 00:26:54,480 --> 00:26:57,000 then in addition to that, if someone takes it. 548 00:26:58,260 --> 00:26:59,310 We can track that. 549 00:26:59,520 --> 00:27:05,040 So wherever it lands that hosted, that rented, command and control server, bad 550 00:27:05,040 --> 00:27:07,260 guy's, cell phone, bad guy's, laptop. 551 00:27:07,530 --> 00:27:09,990 It goes from here to there, it calls home. 552 00:27:09,990 --> 00:27:12,660 It beacons, to the extent possible. 553 00:27:12,660 --> 00:27:14,940 if a bad guy really knew what he was doing, he would prevent that. 554 00:27:14,970 --> 00:27:16,620 But the canary, 555 00:27:16,624 --> 00:27:16,844 It. 556 00:27:17,100 --> 00:27:17,610 excuse me. 557 00:27:19,945 --> 00:27:20,095 yeah. 558 00:27:20,095 --> 00:27:23,585 Canary, Canary files, could be classified as malware because the 559 00:27:23,585 --> 00:27:29,405 recipient fully aware of the intent or behavior of what they took. 560 00:27:30,275 --> 00:27:32,375 So that would be classified as malware. 561 00:27:32,775 --> 00:27:32,870 it's not. 562 00:27:33,345 --> 00:27:36,885 It says it's, it says it's the financial spreadsheet, but really it's Canary file, 563 00:27:36,885 --> 00:27:38,325 so that would be classified as malware. 564 00:27:38,325 --> 00:27:40,365 It's not presenting itself as what it really is. 565 00:27:41,475 --> 00:27:45,435 but yeah, Canary files do a little bit more, and it's designed to, to go 566 00:27:45,435 --> 00:27:50,875 with, outside your honeypot, go with the bad guy, and hopefully report back 567 00:27:50,919 --> 00:27:51,159 It. 568 00:27:51,609 --> 00:27:54,099 It's like what in all those TV shows where it's like someone downloaded 569 00:27:54,099 --> 00:27:57,699 the file, oh, I can track 'em with GPS at this particular location. 570 00:27:57,729 --> 00:27:59,409 Okay, let's go bust it and grab them. 571 00:28:01,155 --> 00:28:01,875 Sort of, yeah. 572 00:28:02,175 --> 00:28:02,355 Yeah. 573 00:28:03,375 --> 00:28:06,975 But one final thing, just to note, if you're in, if you're looking 574 00:28:06,975 --> 00:28:11,015 at implementing a honeypot or a canary files, it's important to 575 00:28:11,015 --> 00:28:12,875 have your clocks synchronized. 576 00:28:13,125 --> 00:28:16,295 So use NTP, to make sure that all your clocks are the same. 577 00:28:16,295 --> 00:28:17,915 Why would that matter, Mike? 578 00:28:20,255 --> 00:28:23,855 synchronization in general is just, important from a networking 579 00:28:23,855 --> 00:28:25,775 perspective so that things work. 580 00:28:26,095 --> 00:28:30,815 in, misaligned time sync is actually a vulnerability. 581 00:28:30,845 --> 00:28:35,355 And so that, you could use that as an enticement, but you're looking 582 00:28:35,355 --> 00:28:40,455 at collecting data for evidence and for behavior and for tracking, that 583 00:28:40,455 --> 00:28:42,450 information needs to be correct. 584 00:28:43,335 --> 00:28:47,295 It happened on this day and time, and you can tie that together with 585 00:28:47,295 --> 00:28:50,145 other, so if I'm gonna, if I'm gonna catch a bad guy and I said, you 586 00:28:50,145 --> 00:28:56,235 hacked my system last Tuesday, all the logs and event data is from 1999. 587 00:28:57,345 --> 00:28:58,200 You're gonna have trouble in court. 588 00:28:59,295 --> 00:29:00,975 or January 1st, 1970. 589 00:29:01,245 --> 00:29:01,465 Yep. 590 00:29:02,710 --> 00:29:05,265 all right, I think we've talked about canary files enough. 591 00:29:05,435 --> 00:29:06,795 person, any final thoughts? 592 00:29:07,659 --> 00:29:09,104 you should go watch Zoolander. 593 00:29:09,945 --> 00:29:10,365 Go watch. 594 00:29:12,305 --> 00:29:13,865 I think I got the black long pop. 595 00:29:14,285 --> 00:29:15,285 and, how about you, Mike? 596 00:29:15,285 --> 00:29:16,635 Any fi any final thoughts? 597 00:29:18,445 --> 00:29:22,550 I think canary files and honeypots are useful tools if you've got the 598 00:29:22,550 --> 00:29:27,360 time to deploy them and to keep them updated, along with the playbook for 599 00:29:27,360 --> 00:29:30,980 what happens when bad guys actually, start to, and it's not always bad guys. 600 00:29:30,980 --> 00:29:33,390 Sometimes it's just, we call 'em script kitties. 601 00:29:33,730 --> 00:29:38,020 just the curious, low level, people that, that are just getting into 602 00:29:38,020 --> 00:29:39,640 cyber are curious about cyber. 603 00:29:39,690 --> 00:29:41,400 they're running queries across the internet with the 604 00:29:41,400 --> 00:29:42,360 tools they have access to. 605 00:29:42,360 --> 00:29:43,620 They're gonna find your honeypot. 606 00:29:44,170 --> 00:29:45,360 and so what do you do? 607 00:29:45,390 --> 00:29:48,445 What do you do when, When, when they do it is kinda like back in the day when 608 00:29:48,445 --> 00:29:49,885 your house is on fire, what do you do? 609 00:29:49,915 --> 00:29:52,915 You closest to exit, stop, drop and roll, get outta the house. 610 00:29:52,915 --> 00:29:53,935 We don't do that anymore. 611 00:29:54,275 --> 00:29:56,765 I don't think my kids would know what to do if my house caught on fire. 612 00:29:56,795 --> 00:29:59,225 'cause there's no commercials, there's no public service announcements. 613 00:30:00,095 --> 00:30:03,425 but quite similarly, if you're gonna build something to attract bad guys, 614 00:30:03,425 --> 00:30:06,120 make sure you've got a plan for how to handle that when it does happen. 615 00:30:07,244 --> 00:30:08,734 Mike, I have one question for Mike. 616 00:30:09,454 --> 00:30:13,774 Since you engage with a lot of people who've been attacked by ransomware, 617 00:30:13,774 --> 00:30:20,314 malware, et cetera, how often do you see cases where the honeypot 618 00:30:20,314 --> 00:30:24,814 exposes the attack, the trip wire before the main attack comes in? 619 00:30:26,410 --> 00:30:31,250 Very often, if it, if it's a, if it's a, a representative honeypot, in other words. 620 00:30:32,015 --> 00:30:34,985 Everything the bad guy did to this honeypot network would 621 00:30:35,045 --> 00:30:37,745 have been similar to what they did to the production network. 622 00:30:38,265 --> 00:30:41,235 if they're not the same, then you've got some indication of how a bad 623 00:30:41,235 --> 00:30:44,785 guy operated and got where they got where they, where they ended up. 624 00:30:45,145 --> 00:30:48,895 You can compare that to how that would've gone against the production environment. 625 00:30:49,205 --> 00:30:51,785 but very often, you bad guy tactics. 626 00:30:52,400 --> 00:30:56,190 From one type of bad guy, one group, one, one skillset. 627 00:30:56,340 --> 00:31:00,450 It's kinda the real world, we call, what's their mo, what's their modus operandi? 628 00:31:00,450 --> 00:31:04,080 some bad guys on, on the cyber side, they use the same tools. 629 00:31:04,080 --> 00:31:05,550 they follow the same process. 630 00:31:05,550 --> 00:31:09,240 They do this first and this second, or, there's this decision tree, but 631 00:31:09,240 --> 00:31:13,135 it's, it's almost always the same from one, one victim to the next. 632 00:31:13,479 --> 00:31:18,699 So is it safe to say though, if a bad guy attacks a honeypot, you detect it, there's 633 00:31:18,699 --> 00:31:23,979 a high likelihood that your production environment is going to be safe. 634 00:31:25,315 --> 00:31:26,425 it's gonna be next. 635 00:31:26,959 --> 00:31:27,289 Okay. 636 00:31:28,279 --> 00:31:28,639 Okay. 637 00:31:28,639 --> 00:31:29,869 That's yes. 638 00:31:30,235 --> 00:31:32,430 yeah, so the hunts, because at some point they're gonna go. 639 00:31:33,205 --> 00:31:34,285 Why aren't they reacting? 640 00:31:34,285 --> 00:31:35,485 Why aren't they shutting this down? 641 00:31:35,485 --> 00:31:37,135 Why aren't they shutting me out? 642 00:31:37,190 --> 00:31:39,040 I'm just in here having a good time. 643 00:31:39,040 --> 00:31:40,240 I'm gonna invite some friends. 644 00:31:40,540 --> 00:31:42,160 At some point they're gonna, this is weird. 645 00:31:42,190 --> 00:31:43,420 I wonder if we're in a honey pot. 646 00:31:44,665 --> 00:31:47,965 Now they're probably, there's a good chance they're gonna get upset about that. 647 00:31:48,415 --> 00:31:51,595 back to Curtis's point, we've gotta monitor that honeypot so that you're 648 00:31:51,595 --> 00:31:52,945 aware when they're attacking you. 649 00:31:52,975 --> 00:31:53,935 that's your defense. 650 00:31:53,935 --> 00:31:55,195 That's one of those layers. 651 00:31:55,195 --> 00:31:58,495 That's gonna give you time now to really put focus on your 652 00:31:58,495 --> 00:32:01,585 production environment, 'cause it's likely gonna be the next target. 653 00:32:02,215 --> 00:32:05,850 And you, now you've got a chance to be ready and prepared and maybe 654 00:32:05,850 --> 00:32:10,620 even, add some staff call, call a friend, start blocking stuff 655 00:32:10,620 --> 00:32:12,030 that you don't narrow necessarily. 656 00:32:12,030 --> 00:32:16,420 Block, start, shutting remote access down and things like that. 657 00:32:16,660 --> 00:32:19,980 Turn off all your third party vendors that don't need access right now. 658 00:32:20,040 --> 00:32:24,550 And maybe for the next six weeks, really put focus on that 'cause. 659 00:32:25,180 --> 00:32:27,300 If they find out that there was a honeypot, yeah. 660 00:32:27,300 --> 00:32:31,040 They're gonna, they're gonna look for your real network, your real environment. 661 00:32:31,505 --> 00:32:32,135 Call a friend. 662 00:32:32,135 --> 00:32:32,795 Call a mic. 663 00:32:33,605 --> 00:32:34,025 right. 664 00:32:34,075 --> 00:32:36,415 with that, I will say that is a wrap.