Dionaea honeypot: from Conficker to WannaCry + SambaCry CVE 2017-7494

30 May 2017 Roberto Tanara dionaea honeypot sambacry wannacry
This is a contribution by Tan Kean Siong, follow him on Twitter @gento_ . The open source honeypot Dionaea supported SMB since long but lacked support for the recent WannaCry ransomware SMB vulnerability and the most recent Samba RCE vulnerability CVE 2017-7494 dubbed “SambaCry” wormable attacks. With the recent changes, both attack vectors are supported and respective samples caught in the wild. Dionaea is a low interaction, server side honeypot which emulates a vulnerable system or device.