Having being very pleased to be accepted once again by Google as one of the lucky mentoring organization for GSoC 2013, we had eagerly awaited the student application period starting and the excitement (and occasional drama) that always brings. Once again we were not disappointed, with a steady stream of students getting in touch with us via our public mailing list or IRC channel (#gsoc-honeynet on irc.freenode.net) and exploring project ideas with us.

Google had made a number of changes to the usual process for GSoC 2013, including moving the program start date (and therefore also the student application period) backwards by about a month, and reducing the number of individual student applications to a maximum of five per student. These changes were likely to make the program more attractive to European students (who generally have later summer holidays), and also hopefully reduce the amount of last minute spam applications by encouraging more detailed proposal writing.

With less that 24 hours now remaining until the official deadline for Google Summer of Code (GSoC) 2013 student applications (19:00 UTC Friday May 3rd 2013), this is our final call for interested and eligible GSoC students. If you are interested or intend to get involved, please apply now.

For anyone new to the GSoC program, or anyone who has already talked to us on IRC (#gsoc-honeynet on irc.freenode.net) or on our public GSoC mailing list, please remember that you must still submit your student application the Google’s official GSoC 2013 form in Melange for it to be official.

After a tense few days for all of the organizations who applied, The Honeynet Project is delighted to announce that it has once again been selected as one the participating mentoring organizations in Google Summer of Code (GSoC) 2013. This is great news and should make for another very exciting summer for many students, mentors and team members, so many thanks to Google’s and their Open Source Projects Office for their continued support of both us and free open source software (FLOSS) in general. We all really appreciate the support :-)

Like many other open source organizations, The Honeynet Project’s members have been excitedly waiting to hear if Google would be running their Google Summer of Code (GSoC) initiative again this year. Well, the wait the over and GSoC 2013 has officially been announced on Google’s Open Source Blog. This is great news!

The timing of Google’s announcement was perfect, since the Honeynet Project were holding our Annual Workshop in Dubai the same week, which gave us time to hit the ground running and kick off internal preparations. We ran a GSoC recap session with our members who were present (plus live streaming for those who could not make it) and are busy preparing our application to be a mentoring organization again this year, as well as drawing up an internal list of potential student project topics. We also discussed lessons learned from our past four (excellent) years of GSoC experience, particularly how we might standardize and improve our student selection process, and make better use of the community bonding period. It was particularly satisfying to have many of last years successful GSoC students attending the workshop, presenting what they worked on and continuing to become involved in our community and other non-GSoC projects too.

Ready for the Honeynet Project Meeting in February, we are pleased to announce our second release of HoneyProxy!

Started as a Google Summer of Code 2012 project, HoneyProxy is a lightweight tool that allows live HTTP and HTTPS traffic inspection and analysis. This release features a new Report Editor which allows you to analyze your flows, aggregate data or search for anomalies in your traffic dumps. It is our first independent release after GSoC 2012 and I’m happy to say that HoneyProxy has grown steadily over the last months.

ORGANIZATION
• Brian Hay (Chapter Lead, Full Member)
• Kara Nance (BoD Member, Full Member)
• Chris Hecker
• Clark Harshbarger
• Matt Bishop
• Wesley McGrew
• Lucas McDaniel

DEPLOYMENTS
• 1 Honeeebox in Alaska
• Purchased multiple other Honeeeboxes available for third party deployments
• Periodic Dionaea deployments in both public and private clouds for student and demonstration use.

RESEARCH AND DEVELOPMENT

1. Ongoing development of hypervisor-based honeypot monitoring using virtual machine introspection (VMI) on Xen and KVM platforms.
2. Tools for deployment and management of virtual machines

Finally it is good enough to announce my GSoC project - HpfeedsHoneyGraph which is a Splunk APP to display attack graph for hpfeeds logs. It is not a easy project for me to complete in short time. During the last three months, I have to learn several skills for implementation including HPfeeds logs correlation of several hpfeeds channels, Splunk frameworks, Splunk REST API , D3.v2.js graph library and fast-fluxing modules. The most difficult challenge for me is to write javascript code. I SUPER hate javascript.

The updated version of APKInspector is a powerful static analysis tool for Android Malicious applications. It provide convenient and various features for smartphone security engineers. With the sensitive permission analysis, static instrumentation and easy-to-use graph-code interaction .etc, they can get a thorough and deep understanding of the malicious applications on Android. The improvement mainly focus on two categories: User Interface and Security Analysis. The goal is to build an easy-to-use tool with strong security analysis features. For the UI part, we made the following progress: 1) Automatically installation In last version, user need to install many packages APKInspector depended on in order to run this tool which might be an obstacle for the widely distribution of APKInspector. With the updated version, user only have to run a script to install the tool. 2）Fine-grained Graph View to Source View The new version of APKInspector have fine-grained graph-code interaction. In the past, we only provide the interaction at the block level, now we can identify each phase of the code. It supports instruction level interaction between graph view and code view now.

1 Introduction

As the end of GSoC 2012 will come in the next few days, i am proud to announce IPv6-guard. IPv6-guard is an IPv6 attack detector tool including some defense mechanisms to protect against most of recent attacks on ipv6 protocol suite.

2 IPv6-Guard

2.1 How it works

At first, the tool will gather “genuine” informations of connected network. Those information includes IP and MAC address of neighbors and routers on the network.After first time run, IPv6-guard will save this information to use later, if anything has change,it will ask for confirmation ( User can edit “/data/genuine.info” to add more interface if need). If the network is under attack, some invalid information might be detected and it will ask you to verify what information is “genuine”. IPv6-Guard will use collected information and signatures against every received packet to detect and mitigate IPv6 attacks from the network.

I’m announcing the new features of Android dynamic analysis tool DroidBox as GSoC 2012 approaches the end. In this release, I would like to introduce two parts of my work: DroidBox porting and APIMonitor.

DroidBox for Android 2.3

Based on TaintDroid 2.3, I’ve ported DroidBox to support Android 2.3 and fixed some bugs.

• Download bata version: http://droidbox.googlecode.com/files/DroidBox23.tar.gz
• Source code repository: https://github.com/kelwin

Usage is same with the previous version. You can check the project page.