Search

Denna rapport syftar till att hitta en metod för effektivare felsökning av Cisco Nexus 3000 switchar. Företag utvecklas ständigt och behovet av flera nätverksenheter ökar, dock har metoder för felsökningen av nätverksenheter inte standardiserats. Den gamla metoden genom kommandorad där enskilda nätverksenheter granskas en i taget är inte längre lämplig i dagens IT-företag när antalet nätverksenheter uppgår till flera tiotusen. Rapporten görs i samarbete med IT-företaget Conscia. Metoden baseras på en simulering och en testuppkoppling med hjälp av nätverkshanteringsprotokollet NETCONF genom Python-biblioteket Ncclient. Resultatet bestod av flera parametrar och faktorer som kan indikera en förändring i nätverksenheten. Detta har resulterat i en metod som ger information om olika parametervärden och faktorer, vilket ger nätverksadministratören en klarare bild kring switchens tillstånd. Metoden har lett till effektivare felsökning av Cisco Nexus 3000 vid inträffandet av nätverksincidenter., This report aims to find a method for more efficient troubleshooting of Cisco Nexus 3000 switches. Companies are constantly developing and the need for multiple network devices is increasing, however, methods for troubleshooting network devices have not been standardized. The old method through the command line interface where individual network devices are reviewed one at a time is no longer suitable in today's IT companies when the number of network devices amounts to several tens of thousands. The report is made in collaboration with the IT company Conscia. The method is based on a simulation and a test connection using the network management protocol NETCONF through the Python library Ncclient. The result consisted of several parameters and factors that may indicate a change in the network device. This has resulted in a method that provides information on various parameter values and factors, which gives the network administrator a clearer picture of the state of the switch. The method has led to more efficient troubleshooting of the Cisco Nexus 3000 when network incidents occur.

Denna rapport syftar till att hitta en metod för effektivare felsökning av Cisco Nexus 3000 switchar. Företag utvecklas ständigt och behovet av flera nätverksenheter ökar, dock har metoder för felsökningen av nätverksenheter inte standardiserats. Den gamla metoden genom kommandorad där enskilda nätverksenheter granskas en i taget är inte längre lämplig i dagens IT-företag när antalet nätverksenheter uppgår till flera tiotusen. Rapporten görs i samarbete med IT-företaget Conscia. Metoden baseras på en simulering och en testuppkoppling med hjälp av nätverkshanteringsprotokollet NETCONF genom Python-biblioteket Ncclient. Resultatet bestod av flera parametrar och faktorer som kan indikera en förändring i nätverksenheten. Detta har resulterat i en metod som ger information om olika parametervärden och faktorer, vilket ger nätverksadministratören en klarare bild kring switchens tillstånd. Metoden har lett till effektivare felsökning av Cisco Nexus 3000 vid inträffandet av nätverksincidenter., This report aims to find a method for more efficient troubleshooting of Cisco Nexus 3000 switches. Companies are constantly developing and the need for multiple network devices is increasing, however, methods for troubleshooting network devices have not been standardized. The old method through the command line interface where individual network devices are reviewed one at a time is no longer suitable in today's IT companies when the number of network devices amounts to several tens of thousands. The report is made in collaboration with the IT company Conscia. The method is based on a simulation and a test connection using the network management protocol NETCONF through the Python library Ncclient. The result consisted of several parameters and factors that may indicate a change in the network device. This has resulted in a method that provides information on various parameter values and factors, which gives the network administrator a clearer picture of the state of the switch. The method has led to more efficient troubleshooting of the Cisco Nexus 3000 when network incidents occur.

Honeypots are a defensive cyber security countermeasure used to gather data on intruder activities. By analysing the data collected by honeypots, mitigation strategies for cyberattacks launched against cyber-enabled infrastructures can be developed. In this paper, intelligence gathered from six Secure Shell (SSH) honeypots is presented. The paper is part of an ongoing investigation into analysing malicious activities captured by the honeypots. This paper focuses on the time of day attempted intrusions have occurred. The honeypot data has been gathered from 18th July 2012 until 13th January 2016; a period of 1,247 days. All six honeypots have the same hardware and software configurations, located on the same IPv4/24 subnet. Preliminary analysis of the data from all six hosts has been combined to show the number of attempted intrusions recorded by each honeypot and the top 20 countries attacking IP addresses have originated from. However, there is a variation in the number of attempted intrusions recorded on each of the six hosts. Findings from the research conducted suggest, there is a pattern of organised attempted intrusions from attacking IP addresses originating from China and Hong Kong during an 8am to 6pm working day. An additional investigation into the possible use of organised attacking workforces was conducted.

Honeypots are a defensive cyber security countermeasure used to gather data on intruder activities. By analysing the data collected by honeypots, mitigation strategies for cyberattacks launched against cyber-enabled infrastructures can be developed. In this paper, intelligence gathered from six Secure Shell (SSH) honeypots is presented. The paper is part of an ongoing investigation into analysing malicious activities captured by the honeypots. This paper focuses on the time of day attempted intrusions have occurred. The honeypot data has been gathered from 18th July 2012 until 13th January 2016; a period of 1,247 days. All six honeypots have the same hardware and software configurations, located on the same IPv4/24 subnet. Preliminary analysis of the data from all six hosts has been combined to show the number of attempted intrusions recorded by each honeypot and the top 20 countries attacking IP addresses have originated from. However, there is a variation in the number of attempted intrusions recorded on each of the six hosts. Findings from the research conducted suggest, there is a pattern of organised attempted intrusions from attacking IP addresses originating from China and Hong Kong during an 8am to 6pm working day. An additional investigation into the possible use of organised attacking workforces was conducted.

This paper is an investigation focusing on activities detected by SSH honeypots that utilised kippo honeypot software. The honeypots were located across a variety of geographical locations and operational platforms. The honeynet has suffered prolonged, persistent and attack from a /24 network which appears to be of Chinese geographical origin. In addition to these attacks, other attackers have been successful in compromising real hosts in a wide range of other countries that were subsequently involved in attacking the honeypot machines in the honeynet.

This paper is an investigation focusing on activities detected by SSH honeypots that utilised kippo honeypot software. The honeypots were located across a variety of geographical locations and operational platforms. The honeynet has suffered prolonged, persistent and attack from a /24 network which appears to be of Chinese geographical origin. In addition to these attacks, other attackers have been successful in compromising real hosts in a wide range of other countries that were subsequently involved in attacking the honeypot machines in the honeynet.

This paper is an investigation focusing on activities detected by three SSH honeypots that utilise Kippo honeypot software. The honeypots were located on the same /24 IPv4 network and configured as identically as possible. The honeypots used the same base software and hardware configurations. The data from the honeypots were collected during the period 17th July 2012 and 26th November 2013, a total of 497 active day periods. The analysis in this paper focuses on the techniques used to attempt to gain access to these systems by attacking entities. Although all three honeypots are have the same configuration settings and are located on the same IPv4 /24 subnet work space, there is a variation between the numbers of activities recorded on each honeypots. Automated password guessing using wordlists is one technique employed by cyber criminals in attempts to gain access to devices on the Internet. The research suggests there is wide use of automated password tools and wordlists in attempts to gain access to the SSH honeypots, there are also a wide range of account types being probed.

This paper is an investigation focusing on activities detected by three SSH honeypots that utilise Kippo honeypot software. The honeypots were located on the same /24 IPv4 network and configured as identically as possible. The honeypots used the same base software and hardware configurations. The data from the honeypots were collected during the period 17th July 2012 and 26th November 2013, a total of 497 active day periods. The analysis in this paper focuses on the techniques used to attempt to gain access to these systems by attacking entities. Although all three honeypots are have the same configuration settings and are located on the same IPv4 /24 subnet work space, there is a variation between the numbers of activities recorded on each honeypots. Automated password guessing using wordlists is one technique employed by cyber criminals in attempts to gain access to devices on the Internet. The research suggests there is wide use of automated password tools and wordlists in attempts to gain access to the SSH honeypots, there are also a wide range of account types being probed.

Tato práce popisuje tvorbu modulu pro program Altap Salamander, který umožňuje bezpečný přenos souborů po šifrovaném kanále vytvořeném za pomoci protokolu Secure Shell. Modul je postavený na knihovně Libssh. Ta implementuje jednak protokol Secure Shell, tak i přenosové protokoly SCP a SFTP, které daný protokol pro přenos využívají. Vytvořený modul dovoluje soubory nejen přenášet, ale také je na vzdáleném serveru spravovat, jelikož pracuje v režimu vzdáleného souborového systému., This thesis describes creation of a module for Altap Salamanader, which allows secure file transfer over encrypted channel created using Secure Shell protocol. Module is based on Libssh library. It implements both the Secure Shell protocol and SCP and SFTP transfer protocols, which use it for transmission. The created module allows not only file transfer, but also remote file management.

Tato práce popisuje tvorbu modulu pro program Altap Salamander, který umožňuje bezpečný přenos souborů po šifrovaném kanále vytvořeném za pomoci protokolu Secure Shell. Modul je postavený na knihovně Libssh. Ta implementuje jednak protokol Secure Shell, tak i přenosové protokoly SCP a SFTP, které daný protokol pro přenos využívají. Vytvořený modul dovoluje soubory nejen přenášet, ale také je na vzdáleném serveru spravovat, jelikož pracuje v režimu vzdáleného souborového systému., This thesis describes creation of a module for Altap Salamanader, which allows secure file transfer over encrypted channel created using Secure Shell protocol. Module is based on Libssh library. It implements both the Secure Shell protocol and SCP and SFTP transfer protocols, which use it for transmission. The created module allows not only file transfer, but also remote file management.

Tato práce popisuje tvorbu modulu pro program Altap Salamander, který umožňuje bezpečný přenos souborů po šifrovaném kanále vytvořeném za pomoci protokolu Secure Shell. Modul je postavený na knihovně Libssh. Ta implementuje jednak protokol Secure Shell, tak i přenosové protokoly SCP a SFTP, které daný protokol pro přenos využívají. Vytvořený modul dovoluje soubory nejen přenášet, ale také je na vzdáleném serveru spravovat, jelikož pracuje v režimu vzdáleného souborového systému., This thesis describes creation of a module for Altap Salamanader, which allows secure file transfer over encrypted channel created using Secure Shell protocol. Module is based on Libssh library. It implements both the Secure Shell protocol and SCP and SFTP transfer protocols, which use it for transmission. The created module allows not only file transfer, but also remote file management.

Cabral, W., Valli, C., Sikos, L., & Wakeling, S. (2019). Review and analysis of Cowrie artefacts and their potential to be used deceptively. In 2019 International Conference on Computational Science and Computational Intelligence (CSCI) (pp. 166-171). IEEE. https://doi.org/10.1109/CSCI49370.2019.00035

Valli, C., Rabadia, P., & Woodard, A. (2015). A Profile of Prolonged, Persistent SSH Attack on a Kippo Based Honeynet. Annual Conference on Digital Forensics, Security and Law. 23 - 32 Available here

Originally published in the Proceedings of the 12th Australian Digital Forensics Conference. Held on the 1-3 December, 2014 at Edith Cowan University, Joondalup Campus, Perth, Western Australia.Available here

Tato práce popisuje tvorbu modulu pro program Altap Salamander, který umožňuje bezpečný přenos souborů po šifrovaném kanále vytvořeném za pomoci protokolu Secure Shell. Modul je postavený na knihovně Libssh. Ta implementuje jednak protokol Secure Shell, tak i přenosové protokoly SCP a SFTP, které daný protokol pro přenos využívají. Vytvořený modul dovoluje soubory nejen přenášet, ale také je na vzdáleném serveru spravovat, jelikož pracuje v režimu vzdáleného souborového systému., This thesis describes creation of a module for Altap Salamanader, which allows secure file transfer over encrypted channel created using Secure Shell protocol. Module is based on Libssh library. It implements both the Secure Shell protocol and SCP and SFTP transfer protocols, which use it for transmission. The created module allows not only file transfer, but also remote file management.

Tato práce popisuje tvorbu modulu pro program Altap Salamander, který umožňuje bezpečný přenos souborů po šifrovaném kanále vytvořeném za pomoci protokolu Secure Shell. Modul je postavený na knihovně Libssh. Ta implementuje jednak protokol Secure Shell, tak i přenosové protokoly SCP a SFTP, které daný protokol pro přenos využívají. Vytvořený modul dovoluje soubory nejen přenášet, ale také je na vzdáleném serveru spravovat, jelikož pracuje v režimu vzdáleného souborového systému., This thesis describes creation of a module for Altap Salamanader, which allows secure file transfer over encrypted channel created using Secure Shell protocol. Module is based on Libssh library. It implements both the Secure Shell protocol and SCP and SFTP transfer protocols, which use it for transmission. The created module allows not only file transfer, but also remote file management.

Tato práce popisuje tvorbu modulu pro program Altap Salamander, který umožňuje bezpečný přenos souborů po šifrovaném kanále vytvořeném za pomoci protokolu Secure Shell. Modul je postavený na knihovně Libssh. Ta implementuje jednak protokol Secure Shell, tak i přenosové protokoly SCP a SFTP, které daný protokol pro přenos využívají. Vytvořený modul dovoluje soubory nejen přenášet, ale také je na vzdáleném serveru spravovat, jelikož pracuje v režimu vzdáleného souborového systému., This thesis describes creation of a module for Altap Salamanader, which allows secure file transfer over encrypted channel created using Secure Shell protocol. Module is based on Libssh library. It implements both the Secure Shell protocol and SCP and SFTP transfer protocols, which use it for transmission. The created module allows not only file transfer, but also remote file management.