Serverless trap

honeyλ - a simple serverless application designed to create and monitor URL {honey}tokens, on top of AWS Lambda and Amazon API Gateway

• Slack notifications
• Email and SMS alerts
• Load config from local file or Amazon S3
• Customize the HTTP response for each token
• Threat Intelligence report (Source IP lookup)
  • Using Cymon API v2
• Based on Serverless framework
  • pay-what-you-use
  • provider agnostic

Description

honeyλ allows you to create and monitor fake HTTP endpoints automatically. You can then place these URL honeytokens in e.g. your inbox, documents, browser history, or embed them as {hidden} links in your web pages (Note: honeybits can be used for spreading breadcrumbs across your systems to lure the attackers toward your traps). Depending on how and where you implement honeytokens, you may detect human attackers, malicious insiders, content scrapers, or bad bots.

This application is based on Serverless framework and can be deployed in different cloud providers such as Amazon Web Services (AWS), Microsoft Azure, IBM OpenWhisk or Google Cloud (Only tested on AWS; the main function may need small changes to support other providers). If your cloud provider is AWS, it automatically creates HTTP endpoints using Amazon API Gateway and then starts monitoring the HTTP endpoints using honeyλ Lambda function.

Setup

• Install Serverless framework:
  • npm install -g serverless
• Install honeyλ:
  • serverless install --url https://github.com/0x4d31/honeyLambda
• Edit serverless.yml and set HTTP endpoint path (default: /v1/get-pass)
• Edit config.json and fill in your Slack Webhook URL. Change the trap/token configs as you need
• You can customize the HTTP response for each token
  • For example you can return a 1x1px beacon image in response and embed the token in your decoy documents or email (tracking pixel!)

Deploy

• Set up your AWS Credentials
• In order to deploy honeyλ, simply run:
  • serverless deploy

Output:

Serverless: Packaging service...
Serverless: Creating Stack...
Serverless: Checking Stack create progress...
.....
Serverless: Stack create finished...
Serverless: Uploading CloudFormation file to S3...
Serverless: Uploading artifacts...
Serverless: Uploading service .zip file to S3 (116.22 KB)...
Serverless: Validating template...
Serverless: Updating Stack...
Serverless: Checking Stack update progress...
.................................
Serverless: Stack update finished...
Service Information
service: honeyLambda
stage: dev
region: ap-southeast-2
api keys:
  None
endpoints:
  GET - https://rz1bEXAMPLE.execute-api.ap-southeast-2.amazonaws.com/dev/v1/get-pass
functions:
  honeylambda: honeyLambda-dev-honeylambda

• Note: If you want to return binary in HTTP response (e.g. Content-Type: image/png), you have to manually configure Binary Support using the Amazon API Gateway console (it's not yet possible to set binary media types automatically using serverless):

Open the Amazon API Gateway console, add the binary media type */*, and save.

Once done, you have to re-deploy the API to the dev stage

Usage

Open the generated URL/endpoint in your browser to test if it works:

Slack Alert

TODO

• Remote config: load config from Amazon S3
• Beacon image / return image as HTTP response
• Customize the HTTP response for each token
• Check the source IP address against Threat Intelligence feeds (e.g. Cymon API)
• Email alert
• SMS alert (Twilio)
• HTTP Client Fingerprinting