veyepar: OpenCanary: a new Python-based honeypot

Hi user

Admin Login:

Name: OpenCanary: a new Python-based honeypot
--client pyconza --show pyconza2015 --room room215 10318 --force
Prev: 11 Numberplate recognition using python, opencv and some other magic.
Next: 11 Thursday Lightning Talks

show more...

Author(s):	Azhar Desai
Location	Room 215
Date	oct Thu 01	Days Raw Files
Start	14:15	First Raw Start	14:10
Duration	00:45:00	Offset	0:04:40
End	15:00	Last Raw End	15:00
Chapters	00:00 0:00:30 0:32:12
Total cuts_time	41 min.

https://za.pycon.org/talks/10/
raw-playlist raw-mp4-playlist encoded-files-playlist host archive public tweet mp4 svg png

final audio

assets release.pdf OpenCanary_a_new_Pythonbased_honeypot.json
logs
Admin: episode episode list cut list raw files day marks day marks day image_files

State:
Locked:	clear this to unlock
Locked by:	user/process that locked.
Start:	initially scheduled time from master, adjusted to match reality
Duration:	length in hh:mm:ss
Name:	Video Title (shows in video search results)
Emails:	email(s) of the presenter(s)
Released:	has someone authorised pubication
Normalise:
Channelcopy:	m=mono, 01=copy left to right, 10=right to left, 00=ignore.
Thumbnail:	filename.png
Description:	Honeypots: a great idea tempered by over a decade of glorious misapplication resulting in a slow relegation to the realm of academia and slightly dubious research. But it doesn’t have to be that way. In August 2015 we released OpenCanary, the Open Source version of our commercial Python-based honeypot. Traditional honeypots aim to reveal attacker tools, techniques and procedures, by entrapping attackers through emulation (or instrumentation) of common protocols and services. They are typically installed standalone, and seldom updated. We argue that this honeypot approach is outdated; current organisations struggle far more with <em>identifying breaches</em> than identifying the version of some generic rootkit installed post-breach. OpenCanary changes that, treating the honeypot as an internal distributed sensor rather than a standalone alert generator. Each event reported is a high-quality indicator of investigation-worthy activity, and each OpenCanary instance feeds event data to a correlator which produces single alerts even in the face of network-wide scans. With such a high signal-to-noise ratio, every alert requires investigation. This is in contrast to the stream of alerts produced by tools such as anti-virus, network IDS or traditional honeypots. OpenCanary wound up relying on Python for the majority of the code. The Python eco-system provided support that sped up development and, more importantly, deployment. However it didn’t take us the full distance. In this talk, we provide a brief background on honeypots, discuss the design of OpenCanary, delve into the challenges experienced and our plans for the project. Along the way, we’ll demo the trivially installable OpenCanary, configure a few fake services and provide an outsider’s view of developing in Python. markdown
Comment:	production notes

2015-10-01/14_10_20.dv Apply: 14:10:20 - 14:17:22 ( 00:07:02 ) S: 14:10:20 - E: 14:17:22 D: 00:07:02 show more...

vlc ~/Videos/veyepar/pyconza/pyconza2015/dv/room215/2015-10-01/14_10_20.dv :start-time=00.0 --audio-desync=0

	Raw File	Cut List
	14:10:20		seconds: 0.0 Wall: 14:10:20
Duration	00:07:02
	14:17:22		seconds: 0.0 Wall: 14:10:20
Comments:
mp4 mp4.m3u	dv.m3u	Split: Sequence:: delete

audio viz

2015-10-01/14_17_23.dv Apply: 14:17:23 - 14:17:53 ( 00:00:30 ) S: 14:17:23 - E: 14:17:53 D: 00:00:30 show more...

vlc ~/Videos/veyepar/pyconza/pyconza2015/dv/room215/2015-10-01/14_17_23.dv :start-time=00.0 --audio-desync=0

	Raw File	Cut List
	14:17:23		seconds: 0.0 Wall: 14:17:23
Duration	00:00:30
	14:17:53		seconds: 0.0 Wall: 14:17:23
Comments:
mp4 mp4.m3u	dv.m3u	Split: Sequence:: delete

audio viz

2015-10-01/14_17_54.dv Apply: 14:17:54 - 14:19:32 ( 00:01:38 ) S: 14:17:54 - E: 14:19:32 D: 00:01:38 show more...

vlc ~/Videos/veyepar/pyconza/pyconza2015/dv/room215/2015-10-01/14_17_54.dv :start-time=00.0 --audio-desync=0

	Raw File	Cut List
	14:17:54		seconds: 0.0 Wall: 14:17:54
Duration	00:01:38
	14:19:32		seconds: 0.0 Wall: 14:17:54
Comments:
mp4 mp4.m3u	dv.m3u	Split: Sequence:: delete

audio viz

2015-10-01/14_19_32.dv Apply: 14:19:32 - 14:51:14 ( 00:31:42 ) S: 14:19:32 - E: 14:51:14 D: 00:31:42 show more...

vlc ~/Videos/veyepar/pyconza/pyconza2015/dv/room215/2015-10-01/14_19_32.dv :start-time=00.0 --audio-desync=0

	Raw File	Cut List
	14:19:32		seconds: 0.0 Wall: 14:19:32
Duration	00:31:42
	14:51:14		seconds: 0.0 Wall: 14:19:32
Comments:
mp4 mp4.m3u	dv.m3u	Split: Sequence:: delete

audio viz

2015-10-01/14_51_14.dv Apply: 14:51:14 - 15:00:08 ( 00:08:54 ) S: 14:51:14 - E: 15:00:08 D: 00:08:54 show more...

vlc ~/Videos/veyepar/pyconza/pyconza2015/dv/room215/2015-10-01/14_51_14.dv :start-time=00.0 --audio-desync=0

	Raw File	Cut List
	14:51:14		seconds: 0.0 Wall: 14:51:14
Duration	00:08:54
	15:00:08		seconds: 0.0 Wall: 14:51:14
Comments:
mp4 mp4.m3u	dv.m3u	Split: Sequence:: delete

audio viz

Rf filename:	root is .../show/dv/location/, example: 2013-03-13/13:13:30.dv
Sequence:
get this:	check and save to add this

2015-10-01/14_10_20.dv
audio viz

audio viz

2015-10-01/14_17_23.dv
audio viz

audio viz

2015-10-01/14_17_54.dv
audio viz

audio viz

2015-10-01/14_19_32.dv
audio viz

audio viz

2015-10-01/14_51_14.dv
audio viz

audio viz

Veyepar Video Eyeball Processor and Review