Skip to main content

Artillery - Binary Defense Project

Project Artillery is an open source project aimed at the detection of early warning indicators and attacks. The concept is that Artillery will spawn multiple ports on a system giving the attacker the idea that multiple ports are exposed. Additionally, Artillery actively monitors the filesystem for changes, brute force attacks, and other indicators of compromise. Artillery is a full suite for protection against attack on Linux and Windows based devices. It can be used as an early warning indicator of attackers on your network. Additionally, Artillery integrates into threat intelligence feeds which can notify when a previously seen attacker IP address has been identified. Artillery supports multiple configuration types, different versions of Linux, and can be deployed across multiple systems and events sent centrally.

Artillery is a combination of a honeypot, monitoring tool, and alerting system. Eventually this will evolve into a hardening monitoring platform as well to detect insecure configurations from nix systems. It's relatively simple, run ./setup.py and hit yes, this will install Artillery in /var/artillery and edit your /etc/init.d/rc.local to start artillery on boot up.



Features
  • It sets up multiple common ports that are attacked. If someone connects to these ports, it blacklists them forever (to remove blacklisted ip's, remove them from /var/artillery/banlist.txt)
  • It monitors what folders you specify, by default it checks /var/www and /etc for modifications.
  • It monitors the SSH logs and looks for brute force attempts.
  • It will email you when attacks occur and let you know what the attack was.
  • Be sure to edit the /var/artillery/config to turn on mail delivery, brute force attempt customizations, and what folders to monitor.

Project structure
  • For those technical folks you can find all of the code in the following structure:
  • src/core.py - main central code reuse for things shared between each module
  • src/monitor.py - main monitoring module for changes to the filesystem
  • src/ssh_monitor.py - main monitoring module for SSH brute forcing
  • src/honeypot.py - main module for honeypot detection
  • src/harden.py - check for basic hardening to the OS
  • database/integrity.data - main database for maintaining sha512 hashes of filesystem
  • setup.py - copies files to /var/artillery/ then edits /etc/init.d/artillery to ensure artillery starts per each reboot

Supported platforms
  • Linux
  • Windows

Video Installation of Artillery: https://vimeo.com/111456465

Download : https://github.com/trustedsec/artillery/
Labels:

Comments

Post a Comment

Popular posts from this blog

How To Enable DNS over HTTPS

  DNS over HTTPS (DoH) is a protocol for performing remote Domain Name System (DNS) resolution via the HTTPS protocol. A goal of the method is to increase user privacy and security by preventing eavesdropping and manipulation of DNS data by man-in-the-middle attacks by using the HTTPS protocol to encrypt the data between the DoH client and the DoH-based DNS resolver. An alternative to DoH is the DNS over TLS (DoT) protocol, a similar standard for encrypting DNS queries, differing only in the methods used for encryption and delivery. On the basis of privacy and security, whether or not a superior protocol exists among the two is a matter of controversial debate, while others argue the merits of either depend on the specific use case. Benefits DoH improves privacy by hiding domain name lookups from someone lurking on public WiFi, your ISP, or anyone else on your local network. DoH, when enabled, ensures that your ISP cannot collect and sell personal information related to your br...
Post a Comment
Read more

10 reasons Websites get Hacked

Below you will find list of top 10 web vulnerabilities classified by OWASP, here is also description of the problem and some examples. I will just give you the list in case you missed it before, i will not comment on any of these as there is already hot discussion about this matter on several sites/forums. So here it starts: 1. Cross site scripting (XSS) The problem: The “most prevalent and pernicious” Web application security vulnerability, XSS flaws happen when an application sends user data to a Web browser without first validating or encoding the content. This lets hackers execute malicious scripts in a browser, letting them hijack user sessions, deface Web sites, insert hostile content and conduct phishing and malware attacks. Attacks are usually executed with JavaScript, letting hackers manipulate any aspect of a page. In a worst-case scenario, a hacker could steal information and impersonate a user on a bank’s Web site, according to Snyder. Real-world example: PayPal was targete...
10 comments
Read more

The Five Eyes - Intelligence Alliance

 The Five Eyes intelligence alliance is a secretive coalition and surveillance arrangement of countries internationally which include the United States National Security Agency (NSA), Canada’s Communications Security Establishment Canada (CSEC), the United Kingdom’s Government Communications Headquarters (GCHQ), New Zealand’s Government Communications Security Bureau (GCSB) and the Australian Signals Directorate (ASD). A series of bilateral agreements were developed in the beginning of 1946 by an alliance of five English-speaking countries over a period of time and became to known as the UKUSA agreement. This agreement established the Five Eyes alliance to share intelligence especially signals intelligence (SIGINT). These five English-speaking countries for almost 70 years have been involved in the global surveillance spying on the communications all over the world and build an infrastructure to master the internet for surveillance.
Post a Comment
Read more