Setting up a high-interaction SSH honeypot with Cowrie

// Overview of Cowrie

Cowrie is a high-interaction SSH and Telnet honeypot designed to log all interactions. By deploying Cowrie, you can capture attacker keystrokes, command execution, and any attempted exploits in real-time. This data can be invaluable for understanding threat actor behavior and improving your security posture.

// Installation Steps

Setting up Cowrie requires a dedicated environment, ideally a virtual machine or a containerized service. Here’s a detailed walkthrough:

1. Prepare the environment

Choose a clean installation of a Linux distribution. Ubuntu is a common choice for this purpose. Ensure your system is updated:

sudo apt update && sudo apt upgrade -y

2. Install dependencies

Cowrie requires several Python packages and dependencies. Use the following commands to install them:

sudo apt install python3-pip python3-dev libssl-dev libffi-dev build-essential git -y

3. Clone the Cowrie repository

Navigate to a suitable directory for installation and clone the Cowrie repository:

git clone https://github.com/cowrie/cowrie.git
cd cowrie

4. Create a virtual environment

It's a good practice to run applications in a virtual environment. Do this with:

python3 -m venv cowrie-env
source cowrie-env/bin/activate

5. Install Cowrie

Install Cowrie and its Python dependencies:

pip install -r requirements.txt

6. Configure Cowrie

Cowrie comes with a pre-configured setup, but you should customize it to suit your needs. Edit the configuration file:

nano cowrie.cfg

Here are some important parameters to modify:

• hostname: Set to a name that attackers would recognize, e.g., yourdomain.com.
• listen_port: Default is set to 2222; change if needed to avoid conflicts.
• database: Configure to either SQLite (default) or MySQL for storing logs.

7. Start Cowrie

To run Cowrie, execute the following command from the Cowrie directory:

./start.sh

This will initiate the honeypot, and you should begin to see log entries as attackers connect.

// Logging and Monitoring

Cowrie logs all interaction data in a structured format. The logs are located in the log directory. Key log files include:

• cowrie.log: General logging of connections and errors.
• cowrie.json: Detailed event-based logs of interactions.
• keystroke.log: Captures specific keystrokes from attackers.

Example log entry

For a typical SSH connection, you might see entries like:

{
    "log": "Connection from 192.168.1.100:54321",
    "eventid": "cowrie.session.connect",
    "timestamp": "2023-05-01T12:34:56Z"
}

// Analyzing Attack Behavior

Cowrie allows you to capture and analyze the commands executed by attackers. By reviewing the keystroke.log, you can gain insights into:

• Common attack vectors.
• Tools and methods used by attackers.
• Specific vulnerabilities targeted.

Attack Simulation

To test your honeypot, you can use a tool like Metasploit to simulate an attack:

msfconsole
use exploit/unix/ssh/ssh_login
set RHOST <your_honeypot_ip>
set USERNAME <username>
set PASSWORD <password>
exploit

Replace <your_honeypot_ip>, <username>, and <password> with the details of your honeypot. Monitor the Cowrie logs to see how it responds.

// Mistakes to Avoid

1. Running on a production server: Ensure Cowrie is deployed in a controlled environment to prevent unintended consequences.

2. Neglecting updates: Regularly check for updates to Cowrie to patch vulnerabilities and enhance functionality.

3. Ignoring log monitoring: Establish a routine to review logs for actionable insights. Automated scripts can help parse logs for unusual patterns.

// Defensive Implications

Understanding how attackers interact with your honeypot can significantly strengthen your defenses. You can:

• Identify frequently attempted passwords and block them on production systems.
• Analyze successful exploitation attempts to patch vulnerabilities.
• Develop better training materials for your incident response teams based on real-world attack patterns.

// Checklist Before Launching Cowrie

• [ ] Install and configure Cowrie in a dedicated environment.
• [ ] Customize cowrie.cfg for realistic engagements.
• [ ] Ensure logging is properly configured and monitored.
• [ ] Test with simulated attacks to validate functionality.
• [ ] Regularly review logs for insights and updates.

--- // FIELDOPS REPORT AUTHORIZED BY: Theodore O. //