Deception-based responses to security attacks
Deception-based techniques for responding to security attacks are described herein. The techniques include transitioning a security attack to a monitored computing device posing as a computing device impacted by the security attack and enabling the adversary to obtain deceptive information from the monitored computing device. Also, the adversary may obtain a document configured to report identifying information of an entity opening the document, thereby identifying the adversary associated with the attack. Further, the techniques include determining that a domain specified in a domain name request is associated with malicious activity and responding to the request with a network address of a monitored computing device to cause the requesting process to communicate with the monitored computing device in place of an adversary server. Additionally, a service may monitor dormant domains names associated with malicious activity and, in response to a change, respond with an alert or a configuration update.
1 . A method implemented by a computing device having a processor and a memory, the method comprising:
receiving data associated with an attack on a computing device;
transitioning the data associated with the attack to a monitored computing device that is configured to pose to an adversary as the computing device impacted by the attack;
enabling an entity associated with the computing device impacted by the attack to load deceptive information to the monitored computing device;
enabling the adversary to obtain the deceptive information from the monitored computing device;
monitoring subsequent activities on the monitored computing device;
determining, based on the subsequent activities, a geographic location of the adversary;
updating, based at least in part on the geographic location of the adversary, the deceptive information to generate updated deceptive information;
enabling the adversary to obtain the updated deceptive information from the monitored computing device;
monitoring additional activities on a second monitored computing device configured to pose to the adversary as the computing device impacted by the attack;
correlating information obtained from the subsequent activities on the monitored computing device and the additional activities on the second monitored computing device to obtain correlated information; and
updating a configuration associated with a security agent of the computing device impacted by the attack based at least in part on the correlated information.
2 . The method of claim 1 , wherein the attack includes at least one of a spearfish email, a clickable link, a website, a drive by exploit, a Quick-Response (QR) code, a Near Field Communications (NFC) triggered link, a document, an executable, a removable drive, or an archive.
3 . The method of claim 1 , further comprising:
retrieving the data associated with the attack from an information sharing system or a portal of a second computing device to which the attack has been submitted, and
installing the data associated with the attack on the monitored computing device.
4 . The method of claim 1 , wherein
the monitored computing device is a physical computing device or a virtual computing device, and
the monitored computing device is configured with an image of the computing device impacted by the attack illustrating at least one of a name, an operating system version, desktop screens, folder names, preloaded files or computer firmware versions associated with the computing device.
5 . The method of claim 1 , wherein the monitored computing device is implemented remotely by a security service and assigned with a network address or a domain associated with the computing device.
6 . The method of claim 1 , wherein the subsequent activities on the monitored computing device include at least one of:
commands and events issued by the adversary to the monitored computing device, or
network activity, file activity, process activity, execution activity, registry activity, operating system activity, firmware updates, loaded drivers, or kernel extensions of the monitored computing device.
7 . The method of claim 1 , wherein the data associated with the attack includes a redirection domain name resolution request, and the method further comprises:
transitioning the data associated with the attack to the second monitored computing device, the second monitored computing device being configured to pose to the adversary as the computing device impacted by the attack.
8 . The method of claim 1 , further comprising:
intercepting communication from the adversary to the monitored computing device;
decoding the communication to identify a new protocol used for the communication; and
configuring the monitored computing device to communicate with the adversary by using the new protocol.
9 . The method of claim 1 , further comprising:
pre-determining a set of monitored computing devices based at least in part on malicious dormant domain names identified in past activities;
determining that the data associated with the attack includes a redirection domain name resolution request; and
identifying a candidate monitored computing device from the set of monitored computing devices based at least in part on comparing a domain name in the redirection domain name resolution request with the malicious dormant domain names.
10 . A system comprising:
one or more processors; and
memory communicatively coupled to the one or more processors, the memory storing instructions executable by the one or more processors that, when executed by the one or more processors, cause the system to perform operations including:
receiving data associated with an attack on a computing device;
transitioning the data associated with the attack to a monitored computing device that is configured to pose to an adversary as the computing device impacted by the attack;
enabling an entity associated with the computing device impacted by the attack to load deceptive information to the monitored computing device;
enabling the adversary to obtain the deceptive information from the monitored computing device;
monitoring subsequent activities on the monitored computing device;
determining, based on the subsequent activities, a geographic location of the adversary;
updating, based at least in part on the geographic location of the adversary, the deceptive information to generate updated deceptive information;
enabling the adversary to obtain the updated deceptive information from the monitored computing device;
monitoring additional activities on a second monitored computing device configured to pose to the adversary as the computing device impacted by the attack;
correlating information obtained from the subsequent activities on the monitored computing device and the additional activities on the second monitored computing device to obtain correlated information; and
updating a configuration associated with a security agent of the computing device impacted by the attack based at least in part on the correlated information.
11 . The system of claim 10 , wherein the attack includes at least one of a spearfish email, a clickable link, a website, a drive by exploit, a Quick-Response (QR) code, a Near Field Communications (NFC) triggered link, a document, an executable, a removable drive, or an archive.
12 . The system of claim 10 , wherein the instructions, when executed by the one or more processors, further cause the system to perform operations including:
retrieving the data associated with the attack from an information sharing system or a portal of a second computing device to which the attack has been submitted, and
installing the data associated with the attack on the monitored computing device.
13 . The system of claim 10 , wherein
the monitored computing device is a physical computing device or a virtual computing device, and
the monitored computing device is configured with an image of the computing device impacted by the attack illustrating at least one of a name, an operating system version, desktop screens, folder names, preloaded files or computer firmware versions associated with the computing device.
14 . The system of claim 10 , wherein the monitored computing device is implemented remotely by a security service and assigned with a network address or a domain associated with the computing device.
15 . The system of claim 10 , wherein the instructions, when executed by the one or more processors, further cause the system to monitor at least one of:
commands and events issued by the adversary to the monitored computing device, or
network activity, file activity, process activity, execution activity, registry activity, operating system activity, firmware updates, loaded drivers, or kernel extensions of the monitored computing device.
16 . The system of claim 10 , wherein the data associated with the attack includes a redirection domain name resolution request, and the instructions, when executed by the one or more processors, further cause the system to perform operations including:
transitioning the data associated with the attack to the second monitored computing device, the second monitored computing device being configured to pose to the adversary as the computing device impacted by the attack.
17 . A non-transitory computer-readable storage medium storing computer-readable instructions executable by one or more processors, that when executed by the one or more processors, cause the one or more processors to perform operations comprising:
receiving data associated with an attack on a computing device;
transitioning the data associated with the attack to a monitored computing device that is configured to pose to an adversary as the computing device impacted by the attack;
enabling an entity associated with the computing device impacted by the attack to load deceptive information to the monitored computing device;
enabling the adversary to obtain the deceptive information from the monitored computing device;
monitoring subsequent activities on the monitored computing device;
determining, based on the subsequent activities, a geographic location of the adversary;
updating, based at least in part on the geographic location of the adversary, the deceptive information to generate updated deceptive information;
enabling the adversary to obtain the updated deceptive information from the monitored computing device;
monitoring additional activities on a second monitored computing device configured to pose to the adversary as the computing device impacted by the attack;
correlating information obtained from the subsequent activities on the monitored computing device and the additional activities on the second monitored computing device to obtain correlated information; and
updating a configuration associated with a security agent of the computing device impacted by the attack based at least in part on the correlated information.
18 . The non-transitory computer-readable storage medium of claim 17 , wherein the computer-readable instructions, when executed by the one or more processors, further cause the one or more processors to perform operations comprising:
retrieving the data associated with the attack from an information sharing system or a portal of a second computing device to which the attack has been submitted, and
installing the data associated with the attack on the monitored computing device.
19 . The non-transitory computer-readable storage medium of claim 17 , wherein
the monitored computing device is a physical computing device or a virtual computing device, and
the monitored computing device is configured with an image of the computing device impacted by the attack illustrating at least one of a name, an operating system version, desktop screens, folder names, preloaded files or computer firmware versions associated with the computing device.
20 . The non-transitory computer-readable storage medium of claim 17 , wherein the data associated with the attack includes a redirection domain name resolution request, and the computer-readable instructions, when executed by the one or more processors, further cause the one or more processors to perform operations comprising:
transitioning the data associated with the attack to the second monitored computing device, the second monitored computing device being configured to pose to the adversary as the computing device impacted by the attack.