Scribd Logo
Upload

Welcome to Scribd!

  • 23 views

    SinE Muhammad Ihtisamul Hasan

    Uploaded by

    samul hasan
    The document discusses the implementation and analysis of a network security system using multiple honeypots at Deutsche Telekom Security T-Pot on the Central BMKG network. The goals were to improve network security, monitor attack activities, and assist with intrusion analysis. T-Pot was installed on VLANs 50 and 15 and included honeypots like Cowrie and Dionaea. Network testing validated proper system functionality and logging. Security analysis of the honeypot data identified the most common attack sources, ports, malware, credentials, and operating systems targeted.

    Copyright:

    © All Rights Reserved
    Download as PPTX, PDF, TXT or read online from Scribd

    SinE Muhammad Ihtisamul Hasan

    Uploaded by

    samul hasan
    23 views34 pages
    The document discusses the implementation and analysis of a network security system using multiple honeypots at Deutsche Telekom Security T-Pot on the Central BMKG network. The goals were to improve network security, monitor attack activities, and assist with intrusion analysis. T-Pot was installed on VLANs 50 and 15 and included honeypots like Cowrie and Dionaea. Network testing validated proper system functionality and logging. Security analysis of the honeypot data identified the most common attack sources, ports, malware, credentials, and operating systems targeted.

    Original Title

    PPT SinE Muhammad Ihtisamul Hasan

    Copyright

    © © All Rights Reserved

    Available Formats

    PPTX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    The document discusses the implementation and analysis of a network security system using multiple honeypots at Deutsche Telekom Security T-Pot on the Central BMKG network. The goals were to improve network security, monitor attack activities, and assist with intrusion analysis. T-Pot was installed on VLANs 50 and 15 and included honeypots like Cowrie and Dionaea. Network testing validated proper system functionality and logging. Security analysis of the honeypot data identified the most common attack sources, ports, malware, credentials, and operating systems targeted.

    Copyright:

    © All Rights Reserved
    Download as PPTX, PDF, TXT or read online from Scribd
    Download as pptx, pdf, or txt
    23 views34 pages

    SinE Muhammad Ihtisamul Hasan

    Uploaded by

    samul hasan
    The document discusses the implementation and analysis of a network security system using multiple honeypots at Deutsche Telekom Security T-Pot on the Central BMKG network. The goals were to improve network security, monitor attack activities, and assist with intrusion analysis. T-Pot was installed on VLANs 50 and 15 and included honeypots like Cowrie and Dionaea. Network testing validated proper system functionality and logging. Security analysis of the honeypot data identified the most common attack sources, ports, malware, credentials, and operating systems targeted.

    Copyright:

    © All Rights Reserved
    Download as PPTX, PDF, TXT or read online from Scribd
    Download as pptx, pdf, or txt
    of 34

    THESIS

    IMPLEMENTATION AND ANALYSIS OF NETWORK SECURITY


    SYSTEMS USING MULTIPLE HONEYPOTS DEUTSCHE TELEKOM
    SECURITY T-POT ON THE CENTRAL BMKG NETWORK

    Supervisor By:
    Andri Setiaji.S.SI..M.T.I . Muhammad Ihtisamul Hasan Bin Almahdi
    NIP. 198310022006041002 NPT. 41.19.0081

    INSTRUMENTATION STUDY PROGRAM


    STATE COLLAGE OF METEOROLOGY CLIMATOLOGY AND GEOPHYSICS
    Background of The Problems
    Security Report sangfor April 2023
    Background of
    The Problems
    Background of
    The Problems
    Background of
    The Problems
    Research Purpose and Benefit

    Purpose Benefit
    Designing and implementing a network Improve the security of BMKG's internal
    security system using IPS and multiple network infrastructure and systems from
    Honeypot T-Pot at BMKG external and internal threats.

    Monitoring and analyzing network Assist network security administrators to


    attack activities at BMKG carry out network intrusion monitoring and
    analysis.
    Kosasi and Sandy, 2018
    Theory of Network Development Life Cycle (NDLC)

    Literature Zymberi and Ilirjana, 2021


    Review Research on designing and analyzing T-Pot honeypot sensor logs

    Zulkifli Yasin, 2021


    The research designed and analyzed a network security system
    using multiple honeypots in the Central BMKG Network, the
    honeypots used were Dionaea and Cowrie.
    Theory

    T-Pot (Thread-Pot) is an open-source project that provides a


    complex honeypot environment where T-Pot can run various
    types of honeypots on one server at once and also comes
    with tools for other network security analysis.
    Theory
    Theory

    T-Pot Architecture Honeypot running on T-Pot

    • adbhoney, • honeypots,
    • ciscoasa, • honeytrap,
    • citrixhoneypot, • ipphoney,
    • conpot, • log4pot,
    • cowrie, • mailoney,
    • ddospot,s • medpot,
    • dicompot, • redishoneypot,
    • dionaea, • sentrypeer,
    • elasticpot, • snare,
    • endlessh, • tanner
    • glutton,
    • Heralding

    • hellpot,
    Network Topology

    The system was installed on the operational VLAN,


    first on VLAN 50 and continued on VLAN 15.
    Block Diagram
    Flowchart
    Black Box Test Website

    No Configuration Test Status


    1 Login Succesful
    2 Homepage Succesful
    3 Cockpit Succesful
    4 Cyberchef Succesful
    7 Elasticvue Succesful
    8 Kibana Succesful
    9 Spiderfoot Succesful
    10 Attack Map Succesful

    10
    𝑇𝑒𝑠𝑡 Succcess = × 100 %= 100 %
    10
    Data Logging Test

    The image shows the test of sending logging from logsatash to elasticsearch and vice versa. Testing is
    done by sniffing using tcpdump, the process is done by running the command "sudo tcpdump -i br-
    037c238b3268 -nnNN tcp port 9200",
    Penetration Testing Test

    Testing Response
    Penetration Testing NESSUS
    Penetration Testing ZAP
    Penetration Testing Nmap
    Response
    Testing

    Penetration testing using command


    “nmap -p22 --script ssh-brute --script-args userdb=rockyou.txt, passdb=rockyou.txt 192.168.15.250 -vvv “
    Penetration Testing Metasploit FTP (Port 21)

    Testing Response
    Penetration Testing mssql (port 1433)

    Testing Response
    Penetration Testing PTPP (Port 1723)

    Testing Response
    Penetration Testing Metasploit mysql (3306)

    Testing Response
    Network Security Analysis
    Total attack by date

    Attacks
    14000
    12000
    10000
    8000
    6000
    4000
    2000
    0
    0 0 0 0 0 0 0
    0 : 0:0 0:0 0:0 0:0 0:0
    23 023 023 23 023 023
    /20 4/2 4/2 /20 4/2 4/2
    4/4 4 /1 4 /2 5/4 5 /1 5 /2
    Network Security Analysis
    Total attack by IP remote host

    No IP address Location Total attack

    1 202.90.198.154 Indonesia 48.290


    2 202.90.198.158 Indonesia 36.125
    3 202.90.198.66 Indonesia 26.821
    4 192.168.15.66 Indonesia 18.536
    5 192.168.15.240 Indonesia 13.957
    6 192.168.14.228 Indonesia 11.648
    7 103.60.180.18 Indonesia 3.005
    8 202.90.199.215 Indonesia 2.254
    9 192.168.15.114 Indonesia 1.806
    10 172.26.0.1 Internal IP 1.048
    159.550
    Network Security Analysis
    Network Security Analysis

    Total attack by Ports


    6%

    12%

    45%
    17%

    20%

    22 1433 3306 445 23


    Network Security Analysis
    Total attack by malware type

    No Attackers IP Malware Total


    1 202.90.198.154 57a71607bb704159d230dda1e0ff0147 6,582
    2 202.90.198.158 ae12bb54af31227017feffd9598a6f5e 4,346
    3 202.90.198.66 f1bf7b7e83b98c38aa837bc545c502d2 2,890
    4 192.168.15.66 1a325fb47f8940e8ef70579e8d1e0755 1,345
    5 192.168.15.240 7e200b0061585e88a11d5a5212d8dbeb 753
    6 192.168.14.228 0930533c53dd75bb142081752f42284c 678
    7 192.168.14.228 b294e857dbc07134be8c0624b94e6b69 100
    8 202.90.198.154 ae12bb54af31227017feffd9598a6f5e 89
    13,454
    Network Security Analysis
    Most common usernames and passwords used

    No Username Total No Password Total


    1 root 16,139 1 (empty) 3,205
    2 admin 3,073 2 123456 942
    3 sa 2,983 3 1234 594
    4 user 499 4 password 507
    5 guest 349 5 admin 503
    6 user2 243 6 12345 437
    7 supervisor 220 7 1111 257
    8 ubnt 182 8 pass 250
    9 Admin 177 9 user 243
    10 test 172 10 1234567890 242
    Network Security Analysis
    Total attack by OS used
    No OS Location Total Attack
    1 Linux 2.2.x-3.x Indonesia 46,072
    2 Windows NT kernel Indonesia 36,867
    3 Linux 3.11 and newer Indonesia 20,553
    4 Windows 7 or 8 Indonesia 16,494
    5 Linux 2.2.x-3.x (barebone) Indonesia 6,906
    6 Linux 3.x Indonesia 2,742
    7 Linux 3.1-3.10 Indonesia 1,873
    8 Linux 2.4.x-2.6.x Indonesia 1,070
    9 Linux 2.2.x-3.x (no timestamps) Indonesia 716
    10 Windows NT kernel 5.x Internal IP 405
    133,698
    Network Security Analysis
    CVE deteced

    No CVE ID Description level


    Treck TCP/IP stack Out-of-Bounds Read 4.8
    1 CVE-2020-11899 Vulnerability Medium
    TCP Urgent Pointer state confusion due to 8.1
    2 CVE-2019-12263 race condition High
    ICMPv4 Out-of-bounds Read in Treck TCP/IP 5.3
    3 CVE-2020-11910 stack (Ripple20) Medium
    4 CVE-1999-0016 Land IP denial of service. N/A
    CP Urgent Pointer state confusion during 9.8
    5 CVE-2019-12261 connect() to a remote host High
    TCP Urgent Pointer state confusion caused 9.8
    6 CVE-2019-12260 by malformed TCP AO option High
    Heap overflow in DHCP Offer/ACK parsing 9.8
    7 CVE-2019-12255 inside ipdhcpc High

    Source:
    Conclusion and Suggestion

    The system has been This system has been


    The system has been successfully
    successfully implemented to
    implemented by applying a multiple successfully implemented to monitor and analyze attack
    monitor and analyze attack data on the Pusjarkom BMKG
    honeypot system and IPS to the
    network.
    Pusjarkom BMKG network. data on the Pusjarkom
    BMKG network.
    Conclusion and Suggestion

    Further research development can Closing unused ports and installing Further research development can
    add more honeypot sensors antivirus on office devices and servers implement NAT on the server so that it
    so that they are not infected with can be accessed by outside networks
    malware and viruses. and BMKG.
    Thank You

    PROGRAM STUDI INSTRUMENTASI MKG


    SEKOLAH TINGGI METEOROLOGI KLIMATOLOGI DAN GEOFISIKA

    You might also like

    pFad - Phonifier reborn

    Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

    Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


    Alternative Proxies:

    Alternative Proxy

    pFad Proxy

    pFad v3 Proxy

    pFad v4 Proxy