-: Defense deception methods.
This is another way that you can secure your network.
So when we talk about defense deception methods,
we're talking about cybersecurity
professionals putting in
something that's beyond standard defense, right?
And we're trying to actually lure an attacker
to a specific target.
And the two most common things we're gonna talk about here
are honeypots and DNS sinkholes.
And we'll talk about each of those
and explain them here in this lecture.
Now remember, we're trying to lure an attacker there
to a specific target so they don't hit
our good part of our network.
That's the idea.
So when we talk about a honeypot,
this is a system that's designed
to look like a lucrative target
based on the types of services being run
or the vulnerabilities contained.
In the old days people would actually put up
vulnerable systems with things that are missing patches
so that attacker will go after those
and we can either collect on that attacker
of how they're doing things
or we can just hope that they're attacking that
and not the rest of our network.
In reality, honeypots are designed
to falsely appear vulnerable and to fool malicious attackers
to waste their time going after them.
And some really good honeypots
will actually simulate successful attacks
and allow us to monitor the attacker techniques
and collect on them and get signatures
so we can better protect our network.
There is entire honeypot networks out there
and if you Google honeypot
you'll find some good sites on that
that are run by a lot of these antivirus companies
and malware companies because they have to be able
to collect the malware in the wild
to write signatures to fix them in our production networks.
And that's the whole idea of a honeypot.
Collect on the bad guys
so we can make ourselves even more safe.
Now, when we talk about DNS sinkhole,
this is a little bit different.
This is gonna work by providing
false DNS information to malicious software.
So if you have a compromised system,
the way it works is it's gonna request
its DNS information from the server
and the server is gonna detect
that the suspicious request is there
and it's gonna give a false IP of the sinkhole
instead of back to the command and control server.
Now, that's a lot of words.
Let me show you in a picture what that really means.
So here we go.
I've got an infected host there in the bottom right.
And if you see, the first thing it's gonna do
is it's gonna request
where is my command and control server?
In this case, Malware.com, right?
And I go to the DNS server and say,
"Where's Malware.com?"
The DNS server knows that's a bad thing
and so we black holed it
and instead we'll come back and say,
hey, that's actually at 7.7.7
as opposed to 6.6.6, which is the real Malware.com.
And so, me, as the infected host,
I now connect to the internet
and instead of going to the C2 server
for the Malware at 6.6.6.6, I'm gonna go to the sinkhole,
which is 7.7.7.7.
Now what does that effectively do?
Well, it stops the command and control of the botnet,
or the Malware, from being able to be used.
So the bad guy, even though my computer is infected,
he can't talk to my computer
because my computer is not
making the call back to him, right?
That's the idea here with the DNS sinkhole.
It's to stop it until I can get around
to go cleaning that infected host.
And now this works when you know
where the bad guy's C2 servers are, right?
And you know what those call back domains are.
If you don't know them,
this technique is not gonna work for you.
But it is something you should have in your system
so that you can quickly modify things
based on the issues you see out in the wild
and based on the cybersecurity reports.
And as a cybersecurity analyst,
it's something you're gonna feed into.
If you find a malicious piece of software beaconing out,
you'll add it into your DNS sinkhole
so that it is gonna be protected as you move forward.