INJECTING SUPPLEMENTAL DATA INTO DATA QUERIES AT NETWORK END-POINTS
Various embodiments pertain to techniques for injecting supplemental data into search query results delivered to an operating system. More specifically, an operating system can submit a search query to a directory server (or some other network-accessible database), and then pass results of the search query to a local proxy. The local proxy can inject supplemental data into the results. For example, the local proxy could inject bogus user account information in an effort to obfuscate an unauthorized entity who attempts to penetrate the network by parsing the results of the search query.
1 . A computer-implemented method, the method comprising:
causing a deception module to be installed on a computing device within a network;
receiving, via a processor, a data query from a sender;
transmitting the data query to a directory server that includes a main identity database;
receiving a response to the data query from the directory server;
generating a supplemental information based on the response to the data query, the supplemental information representing one or more data record not found in the main identify database;
generating a modified query response including the supplemental information representing a modified version of the response to the data query from the directory server; and
transmitting the modified query response to the sender of the data query.
2 . The computer-implemented method of claim 1 , wherein the computing device is a server or an endpoint.
3 . The computer-implemented method of claim 1 , wherein the network is an internal network associated with an enterprise.
4 . The computer-implemented method of claim 1 , wherein the data query is a user account enumeration query.
5 . The computer-implemented method of claim 4 , wherein the supplemental information includes a fictitious user account.
6 . The computer-implemented method of claim 1 , comprising generating the supplemental information, wherein generating the supplemental information includes analyzing a valid record.
7 . The computer-implemented method of claim 6 , wherein analyzing the valid record includes determining a format of the valid record.
8 . The computer-implemented method of claim 7 , wherein generating the supplemental information includes creating the supplemental information in a similar format as the format of the valid record.
9 . The computer-implemented method of claim 8 , wherein the format of the valid record is an arrangement of a portion of a first name in respect to a last name.
10 . The computer-implemented method of claim 9 , wherein the supplemental information includes a username and a password, wherein the password is a low strength password.
11 . The computer-implemented method of claim 10 , comprising storing the supplemental information in the main identity database.
12 . A system for obfuscating unauthorized users attempting to penetrate a network, the system comprising:
an identity database configured to store a valid record used to facilitate a directory service for the network; and
a deception module that stored on a computing device within the network and configured to
receive a data query from a sender;
transmit the data query to a directory server that includes a main identity database;
receive a response to the data query from the directory server;
generate supplemental information based on the response to the data query, the supplemental information representing one or more data record not found in the main identify database;
generate a modified query response including the supplemental information representing a modified version of the response to the data query from the directory server; and
transmit the modified query response to the sender of the data query.
13 . The system for obfuscating unauthorized users attempting to penetrate a network of claim 12 , wherein the computing device is a server or an endpoint.
14 . The system for obfuscating unauthorized users attempting to penetrate a network of claim 12 , wherein the network is an internal network associated with an enterprise.
15 . The system for obfuscating unauthorized users attempting to penetrate a network of claim 12 , wherein the data query is a user account enumeration query.
16 . The system for obfuscating unauthorized users attempting to penetrate a network of claim 15 , wherein the supplemental information includes a fictitious user account.
17 . The system for obfuscating unauthorized users attempting to penetrate a network of claim 12 , wherein generating the supplemental information includes analyzing the valid record.
18 . The system for obfuscating unauthorized users attempting to penetrate a network of claim 17 , wherein analyzing the valid record includes determining a format of the valid record.
19 . The system for obfuscating unauthorized users attempting to penetrate a network of claim 18 , wherein generating the supplemental information includes creating the supplemental information in a similar format as the format of the valid record.
20 . The system for obfuscating unauthorized users attempting to penetrate a network of claim 19 , wherein the format of the valid record is an arrangement of a portion of a first name in respect to a last name.
21 . The system for obfuscating unauthorized users attempting to penetrate a network of claim 20 , wherein the supplemental information includes a username and a password, wherein the password is a low strength password.
22 . The system for obfuscating unauthorized users attempting to penetrate a network of claim 21 , comprising storing the supplemental information in the main identity database.