The Honeynet Project

We where glad to announce yet another tool during our annual workshop in San Francisco. Glaspot is the third version of the web application honeypot Glastopf and it come with some very powerful new features:

• A build-in PHP sandbox for code injection emulation, allowing us to bring vulnerability emulation to a new level
• Hooked up to the HPFeeds generic data feed system for centralized data collection and tight integration into our sandbox and web server botnet monitoring system
• Modular implementation: Turn your web application into a honeypot with a few easy steps
• Runs in his own lightweight Python server or as a WSGI module in common web server environments
• Automated attack surface generation and expansion

Beta version is out and the install instructions are available at the project webpage. The new features are:

• Prevent some emulator evasion techniques
• Added visualization of analysis results
• Automated app installation and execution
• Displaying analysis information about the APK
• Static pre-check extracts the app's registered Intents

The following figures show the new visualization added to the beta version.

The Android application sandbox is now ready for an alpha release. Details on how to get DroidBox running are available at the project webpage.

At the moment, the following actions are logged during runtime:

• File read and write operations
• Cryptography API activity
• Opened network connections
• Outgoing network traffic
• Information leaks through the following sinks: network, file, sms
• Attempts to send SMS
• Phone calls that have been made

One of the very first Android malwares, Geinimi has been analyzed in the application sandbox DroidBox that is currently being developed. The project is part of GSoC 2011 in collaboration with Honeynet and as a master thesis. The Geinimi application uses DES encryption, and it's possible to uncrypt statically the content, see picture below.