Escape from Monkey Island: Evading High-Interaction Honeyclients

Alexandros Kapravelos; Marco Cova; Christopher Kruegel; Giovanni Vigna

doi:10.1007/978-3-642-22424-9_8

Escape from Monkey Island: Evading High-Interaction Honeyclients

Alexandros Kapravelos
, Marco Cova
, Christopher Kruegel
, Giovanni Vigna

Computer Science

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

17 Citations (Scopus)

Abstract

High-interaction honeyclients are the tools of choice to detect malicious web pages that launch drive-by-download attacks. Unfortunately, the approach used by these tools, which, in most cases, is to identify the side-effects of a successful attack rather than the attack itself, leaves open the possibility for malicious pages to perform evasion techniques that allow one to execute an attack without detection or to behave in a benign way when being analyzed. In this paper, we examine the security model that high-interaction honeyclients use and evaluate their weaknesses in practice. We introduce and discuss a number of possible attacks, and we test them against several popular, well-known high-interaction honeyclients. Our attacks evade the detection of these tools, while successfully attacking regular visitors of malicious web pages.

Original language	English
Title of host publication	Detection of Intrusions and Malware, and Vulnerability Assessment
Subtitle of host publication	8th International Conference, DIMVA 2011, Amsterdam, The Netherlands, July 7-8, 2011, Proceedings
Editors	Thorsten Holz, Herbert Bos
Publisher	Springer
Pages	124-143
Number of pages	20
Edition	1
ISBN (Electronic)	9783642224249
ISBN (Print)	9783642224232
DOIs	https://doi.org/10.1007/978-3-642-22424-9_8
Publication status	Published - 30 Jun 2011
Event	8th Conference on Detection of Intrusions and Malware & Vulnerability Assessment - Amsterdam, Netherlands Duration: 7 Jul 2011 → 8 Jul 2011

Publication series

Name	Lecture Notes in Computer Science
Publisher	Springer
Volume	6739
ISSN (Print)	0302-9743
ISSN (Electronic)	1611-3349

Conference

Conference	8th Conference on Detection of Intrusions and Malware & Vulnerability Assessment
Abbreviated title	DIMVA 2011
Country/Territory	Netherlands
City	Amsterdam
Period	7/07/11 → 8/07/11

Keywords

Virtual Machine
Malicious Code
USENIX Security Symposium
Malicious Site
Cache Poisoning Attack

Access to Document

10.1007/978-3-642-22424-9_8

Cite this

Kapravelos, A., Cova, M., Kruegel, C., & Vigna, G. (2011). Escape from Monkey Island: Evading High-Interaction Honeyclients. In T. Holz, & H. Bos (Eds.), Detection of Intrusions and Malware, and Vulnerability Assessment: 8th International Conference, DIMVA 2011, Amsterdam, The Netherlands, July 7-8, 2011, Proceedings (1 ed., pp. 124-143). (Lecture Notes in Computer Science; Vol. 6739). Springer. https://doi.org/10.1007/978-3-642-22424-9_8

Kapravelos, Alexandros ; Cova, Marco ; Kruegel, Christopher et al. / Escape from Monkey Island : Evading High-Interaction Honeyclients. Detection of Intrusions and Malware, and Vulnerability Assessment: 8th International Conference, DIMVA 2011, Amsterdam, The Netherlands, July 7-8, 2011, Proceedings. editor / Thorsten Holz ; Herbert Bos. 1. ed. Springer, 2011. pp. 124-143 (Lecture Notes in Computer Science).

@inproceedings{3f52064045594949818a62aa756d42a4,

title = "Escape from Monkey Island: Evading High-Interaction Honeyclients",

abstract = "High-interaction honeyclients are the tools of choice to detect malicious web pages that launch drive-by-download attacks. Unfortunately, the approach used by these tools, which, in most cases, is to identify the side-effects of a successful attack rather than the attack itself, leaves open the possibility for malicious pages to perform evasion techniques that allow one to execute an attack without detection or to behave in a benign way when being analyzed. In this paper, we examine the security model that high-interaction honeyclients use and evaluate their weaknesses in practice. We introduce and discuss a number of possible attacks, and we test them against several popular, well-known high-interaction honeyclients. Our attacks evade the detection of these tools, while successfully attacking regular visitors of malicious web pages.",

keywords = "Virtual Machine, Malicious Code, USENIX Security Symposium, Malicious Site, Cache Poisoning Attack",

author = "Alexandros Kapravelos and Marco Cova and Christopher Kruegel and Giovanni Vigna",

year = "2011",

month = jun,

day = "30",

doi = "10.1007/978-3-642-22424-9\_8",

language = "English",

isbn = "9783642224232",

series = "Lecture Notes in Computer Science",

publisher = "Springer",

pages = "124--143",

editor = "Thorsten Holz and Herbert Bos",

booktitle = "Detection of Intrusions and Malware, and Vulnerability Assessment",

edition = "1",

note = "8th Conference on Detection of Intrusions and Malware \& Vulnerability Assessment, DIMVA 2011 ; Conference date: 07-07-2011 Through 08-07-2011",

}

Kapravelos, A, Cova, M, Kruegel, C & Vigna, G 2011, Escape from Monkey Island: Evading High-Interaction Honeyclients. in T Holz & H Bos (eds), Detection of Intrusions and Malware, and Vulnerability Assessment: 8th International Conference, DIMVA 2011, Amsterdam, The Netherlands, July 7-8, 2011, Proceedings. 1 edn, Lecture Notes in Computer Science, vol. 6739, Springer, pp. 124-143, 8th Conference on Detection of Intrusions and Malware & Vulnerability Assessment, Amsterdam, Netherlands, 7/07/11. https://doi.org/10.1007/978-3-642-22424-9_8

Escape from Monkey Island: Evading High-Interaction Honeyclients. / Kapravelos, Alexandros; Cova, Marco; Kruegel, Christopher et al.
Detection of Intrusions and Malware, and Vulnerability Assessment: 8th International Conference, DIMVA 2011, Amsterdam, The Netherlands, July 7-8, 2011, Proceedings. ed. / Thorsten Holz; Herbert Bos. 1. ed. Springer, 2011. p. 124-143 (Lecture Notes in Computer Science; Vol. 6739).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

TY - GEN

T1 - Escape from Monkey Island

T2 - 8th Conference on Detection of Intrusions and Malware & Vulnerability Assessment

AU - Kapravelos, Alexandros

AU - Cova, Marco

AU - Kruegel, Christopher

AU - Vigna, Giovanni

PY - 2011/6/30

Y1 - 2011/6/30

N2 - High-interaction honeyclients are the tools of choice to detect malicious web pages that launch drive-by-download attacks. Unfortunately, the approach used by these tools, which, in most cases, is to identify the side-effects of a successful attack rather than the attack itself, leaves open the possibility for malicious pages to perform evasion techniques that allow one to execute an attack without detection or to behave in a benign way when being analyzed. In this paper, we examine the security model that high-interaction honeyclients use and evaluate their weaknesses in practice. We introduce and discuss a number of possible attacks, and we test them against several popular, well-known high-interaction honeyclients. Our attacks evade the detection of these tools, while successfully attacking regular visitors of malicious web pages.

AB - High-interaction honeyclients are the tools of choice to detect malicious web pages that launch drive-by-download attacks. Unfortunately, the approach used by these tools, which, in most cases, is to identify the side-effects of a successful attack rather than the attack itself, leaves open the possibility for malicious pages to perform evasion techniques that allow one to execute an attack without detection or to behave in a benign way when being analyzed. In this paper, we examine the security model that high-interaction honeyclients use and evaluate their weaknesses in practice. We introduce and discuss a number of possible attacks, and we test them against several popular, well-known high-interaction honeyclients. Our attacks evade the detection of these tools, while successfully attacking regular visitors of malicious web pages.

KW - Virtual Machine

KW - Malicious Code

KW - USENIX Security Symposium

KW - Malicious Site

KW - Cache Poisoning Attack

U2 - 10.1007/978-3-642-22424-9_8

DO - 10.1007/978-3-642-22424-9_8

M3 - Conference contribution

SN - 9783642224232

T3 - Lecture Notes in Computer Science

SP - 124

EP - 143

BT - Detection of Intrusions and Malware, and Vulnerability Assessment

A2 - Holz, Thorsten

A2 - Bos, Herbert

PB - Springer

Y2 - 7 July 2011 through 8 July 2011

ER -

Kapravelos A, Cova M, Kruegel C, Vigna G. Escape from Monkey Island: Evading High-Interaction Honeyclients. In Holz T, Bos H, editors, Detection of Intrusions and Malware, and Vulnerability Assessment: 8th International Conference, DIMVA 2011, Amsterdam, The Netherlands, July 7-8, 2011, Proceedings. 1 ed. Springer. 2011. p. 124-143. (Lecture Notes in Computer Science). Epub 2011 Jun 21. doi: 10.1007/978-3-642-22424-9_8

Escape from Monkey Island: Evading High-Interaction Honeyclients

Abstract

Publication series

Conference

Keywords

Access to Document

Fingerprint

Cite this