Opensource Content Management System (CMS) is very popular and widely used by web administrators around the world nowadays because of their simplicity for the instant web application solution. Consequently, web applications have increasingly been the focus of attackers because of the unintentional web vulnerabilities that comes from the newly introduced functionality. This project aims at enhancing the level of security for CMS inside the Universiti Teknologi MARA (UiTM) network by providing the most extensive way on developing Virtual CMS Honeypots. The outcome is hoped to ease the web administrators to monitor any kind of computer threats such as hackers, worms and viruses in more comfortable and efficient way. The results also will provide the administrator some form of countermeasures for security purposes and traffic analysis. Using Customize Awstats, Snort, AcidBase and Proxy will provide a Honeypot for a rapidly expandable network and suit for the web administrator especially at UiTM to monitor webserver traffic activity and any latest computer threats.

1. Krakow, April 24-25, 2010
Capturing Web Application
Threats Using virtual CMS
Honeypot
Saharudin Saat

2. Krakow, April 24-25, 2010
Why We Do It?
Which is the BEST CMS?
UiTM currently uses JOOMLA but too many exploits
• Current trends:
• PHP
• Ruby
• JSP
• ASP
?

3. Krakow, April 24-25, 2010
Why Honeypot?
• Capture live attacks
• Find solution for 0 day
• Hackers view the virtual honeypots as a real
server (playground)
• Honeypots cannot be used as a stepping stone to
do any harm (permit in, block out)

4. Krakow, April 24-25, 2010
The Architecture

5. Krakow, April 24-25, 2010
Tools
• Raw Honeypot (virtualbox)
• Proxy (pound – apache log format)
• Awstats (log analysis)
• Snort (signatures)
• ACID BASE (report )
• Tcpdump (record packets)
• Tcpreplay (crash - replay packets )

6. Krakow, April 24-25, 2010
What’s Different?
• Enhanced awstats error logs
• Detailed error message based on W3C
• Custom virus and worm signature
• Better report

7. Krakow, April 24-25, 2010
Results and Findings
Percentages of attack

8. Krakow, April 24-25, 2010
PHP CMS
• Default (welcome intruder)
• Cliché (admin)

9. Krakow, April 24-25, 2010
ASP CMS
• Windows virus and worm
• Not work on Linux (mod mono - .NET environment)

10. Krakow, April 24-25, 2010
JSP CMS
• unauthorized access (servlet manager)

11. Krakow, April 24-25, 2010
RUBY CMS
• Normal access

12. Krakow, April 24-25, 2010
Conclusion
Future plan  JSP/Ruby
• PHP most threats
• ASP high threats but less significant impact
• JSP less threats but high impact
• Ruby low impact

13. Krakow, April 24-25, 2010
Future Works
• Compiled attacks can be utilised for IDS/IPS
• Implement database monitoring

14. Krakow, April 24-25, 2010
Thank you!
Questions?