GPTHoney – New Linux Honeypot To Engage In Real Time With Threat Actors

⁤A honeypot is a ‘cybersecurity mechanism’ that is primarily designed to lure threat actors away from legitimate targets. ⁤

⁤While this mechanism is performed by simulating a valuable asset like a “server” or “application.” ⁤

⁤Not only that even it also serves as a lure that enables the organizations to “monitor” and “analyze” the ‘tactics’ and ‘techniques’ used by threat actors.

Christopher Schroeder, an ISC intern as part of the SANS[.]edu BACS program recently uncovered a new Linux honeypot to engage in real-time with threat actors, and this honeypot is dubbed “GPTHoney.”

Technical Analysis

GPTHoney is a groundbreaking advancement in honeypot technology by implementing the “LLMs” in a more convenient and professional way. 

This implementation enables them to do so by creating a smart and clever cybersecurity “research environment.”

Analyse Any Suspicious Links Using ANY.RUN’s New Safe Browsing Tool: Try for Free

This new approach mimics a “Linux-based operating system” to interface commands instead of simulating a terminal, which is capable of dealing with “SSH” connections on port 22 as the attacker’s executable input.

In contrast to traditional honeypots, GPTHoney provides individual, separate, self-contained shells for each IP address. Not only that even it also has, detailed command history logs which enables it to have session persistence. 

The system’s architecture incorporates three distinct plugin types:- 

• Type 1 for direct API communication.
• Type 2 for pre-API command processing.
• Type 3 for post-API response modification.

GPTHoney is adept at constructing the most convincing corporate environments focused on “financial,” “healthcare,” or “technology.” 

With the help of a sophisticated “prompt.yml” configuration file, it creates those convincing corporate environments with ‘realistic file systems,’ ‘user management,’ and ‘command execution rules.’

The system seamlessly integrates with the latest models of “OpenAI” and “Anthropic.” Now here at this point via a “handle_cmd” function they process the commands that manage ‘logging,’ ‘plugin interactions,’ and ‘response delivery.’

This creates an engaging and tricky environment that can maintain attacker interest for an extended period of time.

To make sure that the simulation maintains authenticity while collecting “comprehensive logs” of attacker behavior in a controlled environment, it offers “delayed ping responses” (0.3-1.8 seconds) and “customizable SSH banners.”

Here below we have mentioned all the key features of GPTHoney:-

• Ultra-lightweight (<20KB)
• AI-generated responses to commands
• Real-time, dynamic environments for each actor
• Custom command handling via plugins
• Detailed logging
• OS changes via plain English prompts

In the architecture of the OS, the command history log serves as a “critical memory management system.” Through a “sophisticated logging mechanism,” it’s designed to track and store user interactions.

The system generates dedicated text files following the naming convention “commands_<IP>.txt” automatically when the users connect via their unique “IP addresses.”

All the device commands and LLM responses were recorded carefully. For each user session, this implementation creates “isolated environments.”

By storing “command histories,” “environment configurations,” and “execution states” the system maintains the session persistence. 

Upon reconnection, the system automatically reloads the previous session’s state via “JSON-formatted” logs.

This contains important metadata like ‘timestamps’ (in “Zulu” time zone), ‘session IDs,’ ‘action types’ (like “command_execution”), and ‘detailed command outputs.’ 

This comprehensive logging architecture enables seamless session management by facilitating “debugging processes,” and “supports advanced features.” 

The features include ‘simulated privilege escalation’ through ‘sudo commands.’ This makes it valuable for ‘security monitoring’ and ‘system administration tasks.’ 

The system’s ability to maintain distinct, isolated environments for each IP address ensures reliable long-term interaction tracking while preserving the exact state of “user sessions,” “directory structures,” and “environment variables between connections.”

Strategies to Protect Websites & APIs from Malware Attack => Free Webinar