Blog postings from honeynet.org

Malwr.com: powered by Cuckoo

guillaume.arcas — Wed, 25 Jan 2012 10:29:26 -0600

We are proud and happy to announce that a new free malware analysis online service is born.

Malwr.com is based on Cuckoo Sandbox, a project mentored by the Honeynet Project, sponsored by GSoC and developped by Claudio "nex" Guarnieri (@botherder), Dario Fernandes and Alessandro "jekil" Tanasi (@jekil). Malwr.com hosting is provided by ShadowServer.

If you want to test Cuckoo's flavor before installing it or if you're too lazy to deploy your own sandbox, just go there ! :-)

http://malwr.com/
http://cuckoobox.org/

2012 Honeynet Project Security Workshop @ Facebook, Inc. - SF Bay Area, CA, USA - March 19th/20th 2012

christian.seifert — Mon, 23 Jan 2012 22:16:15 -0600

The Honeynet Project will hold its 2nd public security workshop at Facebook, Inc. in the San Francisco Bay Area. The workshop is going to be a two day event filled with technical presentations and hands-on tutorial training. On day 1 of the workshop, Honeynet Project members and Facebook will present on a wide range of information security topics: from honeypots and social networks to cybercrime and mobile malware. Day 2 will be a day of hands-on tutorial training. Our members will teach a total of 8 courses in forensics, honeypots, and visualization. For those who want to further hone their skills in a competitive setting, we will also host a capture-the-flag event on day 2.

Event details and registration information can be found at https://honeynet.org/SecurityWorkshops/2012_SF_Bay_Area. We hope to see you there!

Share:

Cuckoo 0.3.1 released

guillaume.arcas — Tue, 03 Jan 2012 01:10:50 -0600

Cuckoo Sandbox 0.3.1 has been released.

The most interesting improvements include:

Extensive book guiding from setup to customization.
Improved analysis results processing engine.
Modular reporting engine with default HTML, TXT and JSON reports being generated.
Minimal web server/interface that allows you to browse, search and view HTML reports.
Introduction of support to URL submission.
UDP connections extraction.
A cool new logo. :-)
A lot of other things you can find listed in the CHANGELOG file.

Forensic Challenge 10 - "Attack Visualization" - Deadline Extended

angelo.dellaera — Mon, 19 Dec 2011 08:01:25 -0600

Taking a look at the first submissions, it seems like more time is needed in order to solve the Forensic Challenge 10 - "Attack Visualization". For this reason we decided to extend the submission deadline to 2012, January 22th.

Have fun!

Angelo Dell'Aera
The Honeynet Project

HoneySpider Network Capture-HPC NG is out!

guillaume.arcas — Wed, 07 Dec 2011 06:49:54 -0600

Client honeypots are tools that actively search servers for malicious data like malware, exploits, malicious PDF files, etc.

The Polish Chapter just released a new version of Capture-HPC originally developed by Christian Seifert and Ramon Steenson of the New Zealand Chapter. Capture-HPC focuses primarily on attacks against, or involving the use of, Web browsers.

It is available for download as binary Debian package on Polish Chapter webpage:
http://pl.honeynet.org

Source code is made available via github:

A new Cuckoo hatched his egg!

guillaume.arcas — Fri, 25 Nov 2011 06:09:43 -0600

Overview

Cuckoo Sandbox is an Open Source automated dynamic malware analysis system designed to analyze and report on suspicious files.
Cuckoo started as a Google Summer of Code project in 2010 within The Honeynet Project. It was designed and developed by Claudio Guarnieri who still maintains the project and lead its development efforts.

Cuckoo has been selected again this year for Google Summer of Code 2011 with The Honeynet Project and with Dario Fernandes who joined the team. The work being done in the last months lead to the release of the 0.2 version.

WireShnork - A Snort plugin for Wireshark

guillaume.arcas — Thu, 17 Nov 2011 01:43:45 -0600

GSoC 2011 #8 project's goal was to add forensics features to the popular Wireshark network analyzer.

Overview

Wireshark is an open source network analyzer widely used for network debugging as well as security analysis. Wireshark provides network
analyzer with graphical interface as well as command line tools.
Wireshark also provides network protocol decoders and support filters that allow to search through packets with keywords.

GSoC plugins extend Wireshark capabilities when Wireshark is used to analyze network traffic with security and forensic in mind.

Android Reverse Engineering (A.R.E.) Virtual Machine available for download now!

christian.seifert — Mon, 31 Oct 2011 22:11:20 -0500

The Honeynet Project is happy to announce the release of the Android Reverse Engineering (A.R.E.) Virtual Machine.

Do you need to analyze a piece of Android malware, but dont have all your analysis tools at hand? The Android Reverse Engineering (A.R.E.) Virtual Machine, put together by Anthony Desnos from our French chapter, is here to help. A.R.E. combines the latest Android malware analysis tools in a readily accessible toolbox.

Tools currently found on A.R.E. are:

Androguard
Android sdk/ndk
APKInspector
Apktool
Axmlprinter

Forensic Challenge 10 - "Attack Visualization"

angelo.dellaera — Mon, 31 Oct 2011 17:47:17 -0500

I am pleased to announce the next forensic challenge: Forensic Challenge 10 - "Attack Visualization".

The challenge has been created by Ben Reardon from Australia Chapter.

Submission deadline is December 18th and we will be announcing winners around the last week of January 2012. We have a few small prizes for the top three submissions.

Have fun!

Angelo Dell'Aera
The Honeynet Project

Forensic Challenge 9 – “Mobile Malware” - And the winners are...

angelo.dellaera — Mon, 31 Oct 2011 04:26:05 -0500

Folks,
Frank, Mahmud, Azizan and Matt have judged all submissions and results have been posted on the challenge web site. The winners are:

1. Emilien Girault
2. Yuhao Luo, Wenbo Yang and Juanru Li
3. José Lopes Esteves

Really congratulations to the winners and thanks to the other partecipants.

Stay tuned because a new challenge is going to start in the next hours!

Angelo Dell'Aera
The Honeynet Project