Setting Up an SSH Honeypot Using Cowrie

Introduction to Honeypots in Cybersecurity

Hey everyone! Today, I want to share an exciting project I recently worked on: setting up a honeypot. If you’re not familiar with the term, a honeypot is a decoy system designed to attract and trap cyber attackers by mimicking a legitimate target. It’s like setting up a fake treasure chest to catch pirates!

What is a Honeypot?

In simple terms, a honeypot is a security tool that lures attackers away from real systems and gathers intelligence on their methods and behavior. There are two main types of honeypots:

1. Low-Interaction Honeypots: These simulate specific services or systems with limited functionality. They’re easier to set up and maintain but provide less detailed information.
2. High-Interaction Honeypots: These emulate fully functional systems, providing a more realistic environment for attackers to interact with. They require more resources and careful monitoring but offer deeper insights into attacker behavior.

Why Use a Honeypot?

Deploying honeypots offers several benefits:

• Early Detection of Attacks: Honeypots can detect and alert you about potential breaches before attackers can access critical systems.
• Threat Intelligence Gathering: By studying attackers’ behavior on honeypots, you can gain insights into their tactics, techniques, and procedures (TTPs), enabling you to improve security measures and develop new defense strategies.
• Identifying Vulnerabilities: Honeypots can help you identify network and system configuration vulnerabilities by simulating various environments and services.
• Training and Education: Security personnel can use honeypots to practice and improve their skills in identifying and responding to attacks in a controlled environment.

What is Cowrie?

Now, let’s talk about Cowrie. Cowrie is a medium to high-interaction SSH and Telnet honeypot designed to log brute-force attacks and record the shell interactions performed by attackers. It emulates a UNIX system in Python, providing a fake shell environment where attackers can execute commands, which are then logged for analysis.

Key Features of Cowrie

• Impersonation of SSH Servers: Cowrie pretends to be an SSH server with easily cracked credentials, attracting attackers.
• Detailed Logging: It logs all interactions, including commands executed and files transferred, giving you a clear picture of what the attacker is trying to do.
• Isolation: Cowrie runs in a sandboxed environment, ensuring that any malicious activity is contained and does not affect your real system.

Setting Up Cowrie

Here’s a step-by-step guide on how I set up Cowrie on my system:

Step 1: Prepare the Environment

First, I used a virtual machine (VM) to isolate the honeypot from my main network. This ensures that any potential threats are contained within the honeypot environment. You can use tools like VirtualBox or VMware for this.

Step 2: Install Dependencies

Next, I updated my system and installed the required packages:

Bash
sudo apt-get update
sudo apt-get install git python3-virtualenv libssl-dev libffi-dev build-essential

Step 3: Clone the Cowrie Repository

git clone https://github.com/cowrie/cowrie
cd cowrie

Step 4: Set Up a Virtual Environment

virtualenv -p python3 cowrie-env
source cowrie-env/bin/activate

Step 5: Install Cowrie

With the virtual environment set up, I installed Cowrie and its dependencies:

pip install -r requirements.txt

Step 6: Configure Cowrie

cp etc/cowrie.cfg.dist etc/cowrie.cfg

I edited etc/cowrie.cfg to enable logging, set up the fake filesystem, and customize other options.

Step 7: Start Cowrie

Finally, I started the Cowrie honeypot:

bin/cowrie start

Step 8: Monitor and Analyze Logs

Cowrie logs all interactions in the log directory. I accessed these logs to analyze attacker behavior and interactions with the honeypot.

Understanding the Logs

Cowrie logs various types of data, including:

• Commands Executed by Attackers: This helps you understand what the attacker is trying to achieve.
• Files Transferred: This can reveal the tools and scripts attackers use.

To analyze the logs, you can use tools like grep, awk, or log management solutions like the ELK Stack (Elasticsearch, Logstash, Kibana). Look for patterns, anomalies, and insights into the attackers’ techniques and motivations.Here’s an example log entry showing an attacker executing the uname -a command to gather information about the operating system:

2024-06-05T15:08:12+0000 [cowrie.session] Received command: uname -a
2024-06-05T15:08:12+0000 [cowrie.session] Sending command output: Linux testserver5 5.0.0-kali4-amd64 #1 SMP Debian 5.0.9 (2019-08-02) x86_64 GNU/Linux

Conclusion

Setting up Cowrie was a fascinating project that allowed me to gain valuable insights into attacker behavior and techniques. By deploying and monitoring Cowrie, you can enhance your organization’s security posture and stay ahead of emerging threats.
As a next step, consider further customizing Cowrie to simulate specific services or environments relevant to your organization. Additionally, continuously monitor and analyze the logs to identify potential vulnerabilities and refine your security measures accordingly.
For those interested in exploring the technical details, I’ve hosted the configuration files and custom scripts used in this setup on my GitHub repository.
Remember, honeypots are just one component of a comprehensive cybersecurity strategy. Combine them with other security measures, such as firewalls, intrusion detection systems, and regular security audits, to ensure a robust and multi-layered defense against cyber threats.