Know Your Enemy: Sebek2 - A kernel based data capture tool
by The Honeynet Project - Wednesday, 24 September 2003.
To observe intruders using session encryption, researchers needed to find a way to break the session encryption. For many organizations this has proven extremely difficult. In an attempt to circumvent session encryption rather than break it, the Honeynet Project began experimenting with using kernel-based rootkits for the purpose of capturing the data of interest from within the honeypot’s kernel.

These experiments lead to the development of a tool called Sebek. This tool is a piece of code the lives entirely in kernel space and records either some or all data accessed by users on the system. It provides capabilities to: record keystrokes of a session that is using encryption, recover files copied with SCP, capture passwords used to log in to remote system, recover passwords used to enable Burneye protected binaries and accomplish many other forensics related tasks. What follows is a detailed discussion of Sebek, how it works and its value.

Download the paper in PDF format here.

Spotlight

Researchers track Android users by collecting accelerator readings

A group of researchers have demonstrated that Android users' movements can be tracked by simply analyzing the data provided by the devices' accelerometers and orientation sensors.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  
DON'T
MISS

Wed, May 27th
    COPYRIGHT 1998-2015 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //