After getting a working HoneyD environment I wanted to better dig into the information provided by the system. First up was a quick script to get a feel for where the attacks/connections originate from. For location functionality GeoIP is the package for the job, as we’re using both Debian and Python installing the required tools is as simple as ‘apt-get install python-geoip’.
At first glance I really like the log format that is used by honeyd.log, it is nice an easy to parse from. From this I quickly knocked up a python script to parse the honeyd.log file, collect a list of unique source addresses and finally use GeoIP to determine (and count) the county of origin. The script (below) is basic, and most likely full of bugs but shows the ease with which tools can be forged to quickly gain the full value from the information collected by the HoneyD environment.
Version 0.01 is below; ignoring any likely bugs that need fixing the one thing that it definitely needs is to order the output, although I’m undecided if this should be alphabetically by country or by hit-count. Source Code:
#!/usr/bin/python
import GeoIP
import sys
#log file location hard coded, change to suit environment
logfile = open(‘/var/log/honeypot/honeyd.log’, ‘r’)
source = []
for line in logfile:
source.append(line.split(‘ ‘)[3])
#http://www.maxmind.com/app/python
#http://code.google.com/p/pygeoip/
gi = GeoIP.new(GeoIP.GEOIP_MEMORY_CACHE)
src_country = []
src_count = []
for src in set(source):
country = gi.country_name_by_addr( src )
try:
pos = src_country.index( country )
src_count[pos] += 1
except:
src_country.append( country )
src_count.append( 1 )
for i in range( 0, ( len( src_country ) – 1 ) ):
sys.stdout.write( “%s:\t%i\n” %( src_country[i], src_count[i] ) )
Sample output:
# ./honeyd-geoip.py
Uruguay: 12
None: 249
Australia: 17
Lithuania: 11
Austria: 4
Russian Federation: 43
Jordan: 3
Taiwan: 29
Hong Kong: 3
Brazil: 39
United States: 54
Hungary: 23
Latvia: 10
Morocco: 1
Macedonia: 3
Serbia: 4
Romania: 44
Argentina: 23
United Kingdom: 12
India: 10
Egypt: 2
Italy: 33
Switzerland: 2
Germany: 43
France: 13
Poland: 27
Canada: 12
China: 23
Malaysia: 8
Panama: 1
Colombia: 6
Japan: 14
Israel: 9
Bulgaria: 9
Turkey: 6
Vietnam: 2
Mexico: 1
Chile: 1
Pakistan: 1
Spain: 7
Portugal: 4
Moldova, Republic of: 1
Antigua and Barbuda: 1
Venezuela: 3
Singapore: 1
United Arab Emirates: 1
Philippines: 2
Croatia: 1
Korea, Republic of: 4
Ukraine: 5
Georgia: 2
Bahamas: 1
Ecuador: 1
South Africa: 1
Peru: 1
Kazakhstan: 2
Costa Rica: 1
Bolivia: 1
Iran, Islamic Republic of: 2
Greece: 1
Bahrain: 1
— Andrew Waite
Leave a comment