David, thanks for this information. Finally a bit of useful commentary regarding CodeRed and perhaps a partial rebuttal to it.
-Joe
-----Original Message-----
From: M. David Leonard [mailto:mdl@equinox.shaysnet.com]
Sent: Sunday, August 19, 2001 5:38 PM
To: nanog@nanog.org
Subject: LaBrea tarpit info and URL
I have received a few requests for more information on LaBrea, so
I am forwarding the e-mail describing it to the nanog list. I apologize
if this is off-topic.
David Leonard
ShaysNet
-------- Original Message --------
From: "Tom Liston" <tliston@premmag.com> (by way of Matt Fearnow
<matt@incidents.org>)
Subject: [unisog] New tool: LaBrea
To: unisog@sans.org
OK folks, the time has come to fight back...
Following up on my original work on CodeRedneck, I'm pleased to announce a
new tool to let us *ethically* take a stand. Come on... let's build us
some tarpits.
Announcing: LaBrea
LaBrea is a Linux boot disk, based on the Trinux/Linux distribution
(http://www.trinux.org), combined with the techniques used by CodeRedneck
to set up a "tarpit" on your netblock. Essentially, what LaBrea does is
to create "virtual machines" on your unused IP addresses, firewall them,
and then latch onto any inbound traffic by using TCP/IP's tenacity against
anyone who tries to connect.
You have a bunch of unused IPs? Here's what you do:
Get yourself an old machine and a generic NIC. The machine doesn't need
to be a barn burner (see below). Heck, it doesn't even need a hard drive!
LaBrea is run from a RAM disk.
Hook your old doorstop machine up to the network, somewhere where the
portscanners will be sure to find it...
Download the LaBrea boot disk image from
http://www.threenorth.com/LaBrea
(Many, *many* thanks to Tim Rushing for hosting this for me!)
Create a real, live boot disk from the image. See instructions at:
http://trinux.sourceforge.net/install.html
(Don't worry... it's easy. You can do it from Windows or Linux...)
You'll need to pick a main IP address for the LaBrea machine. This IP
address will temporarily need HTTP access to download the packages needed
by Trinux to boot. You'll also need to know the netmask of the IPs you
want to use, as well as your gateway address and the address of a DNS
server.
Now, using any text editor, create a list of the IPs (one per line) that
you want to teergrube and save it on the boot floppy under /tux/config as
a file named "LaBrea". (Note: DON'T include the "main" IP address in this
list... it will be taken care of automatically.)
Pop the LaBrea disk into your machine, and boot 'er up.
It *should* recognize your NIC and fire off. If it doesn't... well, look
around at the Trinux site for help. (I've fired it up on three machines
here with three different NICs and it recognized every one of them...)
It'll ask you some questions. First of all, DON'T DO DHCP ADDRESS
RESOLUTION. It won't work, I disabled it, but I didn't feel like digging
through the innards of the Trinux boot disk to remove the question. So
just don't do it... OK? Since it can't use DHCP, here's where you'll need
to know the IP address, netmask, gateway, etc... (Remember? I told you
that you'd need to know that...)
Answer the questions, and the boot disk will set up the network connection
and then it'll go out and grab any additional files that it needs to set
up and run. The machine will then alias itself to all of the IPs that you
listed. It will use iptables to DROP all inbound TCP connections, and then
it will launch LaBrea to teergrube ALL connection attempts to those IP
addresses.
*ALL* TCP CONNECTION ATTEMPTS. ON **EVERY** PORT. :-) :-) :-)
To make the process more automatic the next time you boot, drop into BASH
and run the command "savecfg". That'll save your IP address, netmask,
etc... back out to the floppy so it won't have to ask you about it if you
reboot.
How well does it work? Well, currently I have a 50 IP "tarpit" running on
an old Pentium 233 that was sitting around without a HDD. From the
logfiles, I pulled the following information after booting it up and
running it for about 45 minutes. I picked a pretty generic 10 minute
"chunk" of time and followed all of the initial connections that came in:
During my 10 minute sample, I had 54 inbound connections. Now remember,
these are previously *UNUSED* IP addresses. There is no reason for
anything to come after them. All inbound connections were to port 80.
(Gee, I wonder what that's from ;-)
I held onto those 54 connections for an average of 1 minute 41 seconds
each. Therefore, in that 10 minute period, I wasted 1 hour 30 minutes and
32 seconds of CodeRed scanning time. But folks, CodeRed is running on NT,
and NT has a *short* TCP time out. What this does to CodeRed connections
ain't nothin' compared to what it'll do to a Linux based RPCPortmapper
scanner: TWENTY FOUR MINUTES a connection!
Did I mention that LaBrea is set up to minimize impact on your network?
Using TCP window advertisement, LaBrea chokes down the inbound packets to
10 data bytes each. Let's see... I held onto that RPC scanner for 24
minutes, and all he got to send me was 170 bytes of data...
This is fun.... Man, this is fun. I can't think of a time I've enjoyed my
job more...
Some background:
My original proposal can be found here:
http://www.incidents.org/archives/intrusions/msg01215.html
Mihnea Stoenescu's validation of the idea is described here:
http://www.incidents.org/archives/intrusions/msg01239.html
The announcement of CodeRedneck:
http://www.incidents.org/archives/intrusions/msg01262.html
Many thanks to Mihnea Stoenescu, Donald Smith, and Tim Rushing for all
of their
help on this.
-TL