French Chapter Status Report 2012

ORGANIZATION

Active members: - Sébastien Tricaud - Guillaume Arcas - Anthony Desnos - Franck Guénichot - François-René Hamelin - Christophe Grenier

DEPLOYMENTS We have following technologies deployed:

- Kippo on honeycloud. Goal of this deployment is to provide a centralized instance of Kippo & share findings, logs, collected data. - HoneyProxy on honeycloud. - Honeeebox

RESEARCH AND DEVELOPMENT

* New tools => HoneyProxy as part of GSoC 2012. => FAUP (formerly furl) => OpenNormalizer => PhotoRec/TestDisk => A.R.E. / AndroGuard

Enhanced tools: => minor HPfeeds patches. => TestDisk & PhotoRec: Too many improvements to list them (More than 150 commits) => minor (not-yet-committed) modifications for Kippo: make kippo randomly accept/reject login/passwords & work without prepopulated password database.

PROJECTS

=> Centralized Kippo Honeypot This project’s goal is to provide members with a standard Kippo server and allow them to redirect incoming SSH scan to this server instead of dropping them.

FINDINGS

=> Analysis of country wide DNS Traffic => Analysis of HTTP usage by malware

PAPERS AND PRESENTATIONS

=> S. Tricaud - Hack.lu 2011 - How Visualization makes it possible => S. Tricaud - HES - Capture me if you can => S. Tricaud / CIRCL LU - CanSecWest 2012 - Scrutinizing a country using passive DNS and PicViz => Honeynet Worksho, Network Training, Visualization Training => S. Tricaud, FIRST Malte 2012 => A. Desnos, Android: Static Analysis Using Similarity Distance (HICSS) => A. Desnos,Android : from reversing to decompilation (Blackhat Abu Dhabi) => A. Desnos,Analyzing Android Applications (Computer Security Congress - Mexico City) => A. Desnos,Android Malwares: is it a dream ? (EICAR)

GOALS

=> GSoC mentoring => Workshop => Enhancing tools

=> Focus on analysis: OSINT, dedicated tools including Timeline Builder. => “HoneyCIF” based on HPFeeds. As described here[http://threatthoughts.com/2012/05/07/introduction-to-the-collective-intelligence-framework/], “CIF allows you to run queries against many data sources at once. If you have other private data sources available, particularly via XML (RSS), JSON, or in a file (e.g. CSV), you can incorporate those, as well as additional OSINT sources.”

MISC ACTIVITIES

=> A.R.E. / AndroGuard funded by Rapid7 => Franck Guénichot co-authored Forensic Challenge #9 (Mobile malware) => ongoing discussion with french botnets.fr community on collaboration on specific areas => new website, twitter account

MENTORING

=> HoneyProxy - G. Arcas - GSoC 2012 => Automated Attack Community Graph Construction #1 & #2 - F.Guénichot (Backup mentor) - GSoC 2012