Honeypot

Sponsor: Michael Wallmannsberger

Staff Support: Campbell Gardiner

Status: Active   

Description:

Victoria University project to undertake an environmental scan of the .nz domain name space to detect malicious web content using client honeypot technology created by them.

InternetNZ receives the following reporting from the project:

• Comparisons of various other country codes specific domains.
• Lists of malicious URLs with additional information about the nature of the URLs and the malware downloaded (e.g. report on whether antivirus technology catches the malware).
• Additional analysis which determines where exploits originate from (often they are from other sites such as adverts running on a news site). Is it a select few servers that feed exploits to malicious URLs (e.g. through iframe directives). It could also perform an analysis on the malicious -URLs identified. e.g. is it specific type of content (adult, gambling); is it hosted by a specific ISP, etc.
• Report on trends on the NZ domain. are we seeing an increase of malicious URLs.
  

InternetNZ may use the reports for its own and for public purposes. We also receive the following reports which are confidential and provided only for information to the InternetNZ Council, NZOC and NZRS.

• Weekly report on zero day exploits; this includes the URLs.
• Report on Snort IDS signatures for the URLs that contain exploits.
  

Cost:

The total project cost is approximately $42,000. InternetNZ will contribute up to $20,000 towards this cost, as approved by Council on 16 June 2007.

Overall Progress Summary:

Victoria University has completed its Stage 1, Stage 2 and Final Honeypot reports. These can be viewed below:

Stage 1 Honeypot Report (PDF)

Stage 2 Honeypot Report (PDF)

Final Honeypot Report (PDF)

History:

March - August 2009:

• Vic Uni finalising Stage 3 (Final) results.
• Debbie Monahan presented on the Honeypot Project at APTLD Beijing (20 - 21 August 2009).   
  

February 2009:

• ED presentation to the APTLD meeting, enthusiasm that APTLD staff should take ownership of encouraging APccTLDs and others to participate in a more global honeypot project.
  

September 2008 - February 2009:

• Honeypot Study continued.
  

August 2008:

• Stage 2 Honeypot Report received.
  

June 2008:

• Council updated on Honeypot at its 13 June meeting.

• Keith presented an overview of the Honeypot project at the ICANN Paris meeting.

April 2008:

• Invited Victoria University comp sci researchers to update June Council meeting on latest results from the Honeypot Project. 

March 2008:

• Stage 1 Honeypot Report received.
  

January 2008:

• Progressed application from Victoria University with DNC for .nz zone file application.
  

December 2007:

• Computers delivered. Presentation from Victoria University to Council meeting on project start-up.
  

October - November 2007:

• Ordered computers for project.
  

September 2007

• InternetNZ signed the project agreement with Victoria University.
  

June – August 2007

• Discussions held with Victoria University and project initiated.