Like many other open source organizations, The Honeynet Project’s members have been excitedly waiting to hear if Google would be running their Google Summer of Code (GSoC) initiative again this year. Well, the wait the over and GSoC 2013 has officially been announced on Google’s Open Source Blog. This is great news!

The timing of Google’s announcement was perfect, since the Honeynet Project were holding our Annual Workshop in Dubai the same week, which gave us time to hit the ground running and kick off internal preparations. We ran a GSoC recap session with our members who were present (plus live streaming for those who could not make it) and are busy preparing our application to be a mentoring organization again this year, as well as drawing up an internal list of potential student project topics. We also discussed lessons learned from our past four (excellent) years of GSoC experience, particularly how we might standardize and improve our student selection process, and make better use of the community bonding period. It was particularly satisfying to have many of last years successful GSoC students attending the workshop, presenting what they worked on and continuing to become involved in our community and other non-GSoC projects too.

Ready for the Honeynet Project Meeting in February, we are pleased to announce our second release of HoneyProxy!

Started as a Google Summer of Code 2012 project, HoneyProxy is a lightweight tool that allows live HTTP and HTTPS traffic inspection and analysis. This release features a new Report Editor which allows you to analyze your flows, aggregate data or search for anomalies in your traffic dumps. It is our first independent release after GSoC 2012 and I’m happy to say that HoneyProxy has grown steadily over the last months.

ORGANIZATION
• Brian Hay (Chapter Lead, Full Member)
• Kara Nance (BoD Member, Full Member)
• Chris Hecker
• Clark Harshbarger
• Matt Bishop
• Wesley McGrew
• Lucas McDaniel

DEPLOYMENTS
• 1 Honeeebox in Alaska
• Purchased multiple other Honeeeboxes available for third party deployments
• Periodic Dionaea deployments in both public and private clouds for student and demonstration use.

RESEARCH AND DEVELOPMENT

1. Ongoing development of hypervisor-based honeypot monitoring using virtual machine introspection (VMI) on Xen and KVM platforms.
2. Tools for deployment and management of virtual machines

Finally it is good enough to announce my GSoC project - HpfeedsHoneyGraph which is a Splunk APP to display attack graph for hpfeeds logs. It is not a easy project for me to complete in short time. During the last three months, I have to learn several skills for implementation including HPfeeds logs correlation of several hpfeeds channels, Splunk frameworks, Splunk REST API , D3.v2.js graph library and fast-fluxing modules. The most difficult challenge for me is to write javascript code. I SUPER hate javascript.

The updated version of APKInspector is a powerful static analysis tool for Android Malicious applications. It provide convenient and various features for smartphone security engineers. With the sensitive permission analysis, static instrumentation and easy-to-use graph-code interaction .etc, they can get a thorough and deep understanding of the malicious applications on Android. The improvement mainly focus on two categories: User Interface and Security Analysis. The goal is to build an easy-to-use tool with strong security analysis features. For the UI part, we made the following progress: 1) Automatically installation In last version, user need to install many packages APKInspector depended on in order to run this tool which might be an obstacle for the widely distribution of APKInspector. With the updated version, user only have to run a script to install the tool. 2）Fine-grained Graph View to Source View The new version of APKInspector have fine-grained graph-code interaction. In the past, we only provide the interaction at the block level, now we can identify each phase of the code. It supports instruction level interaction between graph view and code view now.

1 Introduction

As the end of GSoC 2012 will come in the next few days, i am proud to announce IPv6-guard. IPv6-guard is an IPv6 attack detector tool including some defense mechanisms to protect against most of recent attacks on ipv6 protocol suite.

2 IPv6-Guard

2.1 How it works

At first, the tool will gather “genuine” informations of connected network. Those information includes IP and MAC address of neighbors and routers on the network.After first time run, IPv6-guard will save this information to use later, if anything has change,it will ask for confirmation ( User can edit “/data/genuine.info” to add more interface if need). If the network is under attack, some invalid information might be detected and it will ask you to verify what information is “genuine”. IPv6-Guard will use collected information and signatures against every received packet to detect and mitigate IPv6 attacks from the network.

I’m announcing the new features of Android dynamic analysis tool DroidBox as GSoC 2012 approaches the end. In this release, I would like to introduce two parts of my work: DroidBox porting and APIMonitor.

DroidBox for Android 2.3

Based on TaintDroid 2.3, I’ve ported DroidBox to support Android 2.3 and fixed some bugs.

• Download bata version: http://droidbox.googlecode.com/files/DroidBox23.tar.gz
• Source code repository: https://github.com/kelwin

Usage is same with the previous version. You can check the project page.

AfterGlow cloud has evolved further into another release; with many improvements added to the initial version. With GSoC 2012 approaching an end, we’ve covered all the additional features we planned for in the second phase of development, post mid-term. Building up on the initial version, this post will run you through the general features and additional improvements covered.

A live demo of this release can be found here: http://andromeda.ayrus.net:8080/

Data sources: In addition to the initial method of uploading AfterGlow compatible CSV file, the application now supports two new methods of visualizing your data. You can now upload your logs straight from the source and have it parsed (to a CSV file) and then, rendered on the fly. Additionally, AfterGlow Cloud is now integrated with Loggly.com’s API. Loggly is a service which is used collect log data for monitoring and analyzing the data. With an account at Loggly, you can now search and import your logs straight from Loggly and have it visualized. Your authorization to the application to access your account at Loggly remains on our end for about a hundred days, beyond which you’ll have to re-authenticate the application again. You can however revoke access to the application anytime. Both of these new additions, require you to specify a parsing scheme which is covered below.

As the GSOC approaches the end. I would like to publish a beta version of my project for Network Malware Simulation.

The name for the new open source software is Imalse, which is the acronym of Integrated MALware Simulator & Emulator

The website for the project is http://people.bu.edu/wangjing/open-source/imalse/html/index.html, in which you can get detailed description, instructions for installation and demos.

I recorded two videos which are available at http://www.youtube.com/watch?v=CZ91McFlIvo&feature=relmfu and http://www.youtube.com/watch?v=PSXyEXFRSYs

The ultimate goal of Imalse is “Write once, Run Everywhere”. You can just write one copy of code for Malware Simulation(Now I focus on botnet based malware) and it can run at different levels of abstraction, from complete simulation to real testbed.

Hi everyone, I am announcing an initial release of the Ovizart, Network Analyzer Project. Ovizart (OV - Open VİZual Analsis foR network Traffic ) is a web based application that will let users upload captured traffic in a PCAP format, analyze the traffic, and present the traffic in an intuitive manner. The current development branch is located on Github: https://github.com/oguzy/ovizart.

In this initial release, I am rolling out the basic GUI that people can start using, and then within the next week, I will enable the upload of PCAPs for analysis and visualization.