Honeypot opaque credential recovery

1. A computer-implemented method, comprising:

receiving, at a honeypot, a plaintext credential from an original attacker as part of an original attack event;

determining that the plaintext credential does not exist in a plaintext lookup table;

adding the plaintext credential to the plaintext lookup table;

adding the plaintext credential to a protocol specific plaintext lookup table to associate the plaintext credential previously added to the plaintext lookup table with a protocol used by the honeypot to perform credential exchange;

generating an opaque credential for the plaintext credential;

adding the opaque credential to a protocol specific opaque lookup table;

generating attack context metadata associated with the original attack event;

adding the attack context metadata to the protocol specific plaintext lookup table;

storing the attack context metadata associated with the original attack event in the protocol specific opaque lookup table;

receiving, at the honeypot, from the original attacker as part the original attack event or from a subsequent attacker as part of a subsequent attack event, an opaque credential for the protocol used by the honeypot to perform the credential exchange;

accessing the protocol specific opaque lookup table; and

recovering the plaintext credential associated with the opaque credential.

2. The computer-implemented method of claim 1 , wherein

the attack context metadata comprises one or more attack vectors, one or more exploits used, or one or more vulnerabilities targeted by the original attacker as part of the original attack event.

3. The computer-implemented method of claim 1 , further comprising:

modifying one or more logs generated for the original attack event or for the subsequent attack event to comprise the recovered plaintext credential;

configuring the honeypot to consider the recovered plaintext credential as valid;

updating the plaintext lookup table with the recovered plaintext credential; and

sending the updated plaintext lookup table, the protocol specific plaintext lookup table, and the attack context metadata to a honeypot management server for performance of the credential exchange.

4. The computer-implemented method of claim 3 , further comprising:

receiving, at the honeypot, a new plaintext credential;

sending the new plaintext credential to the honeypot management server;

receiving a global opaque lookup table from the honeypot management server;

receiving a new opaque credential;

sending the new opaque credential to the honeypot management server;

receiving a newly-recovered plaintext credential for the new opaque credential from the honeypot management server; and

receiving confirmation from the honeypot management server that the updated plaintext lookup table further updated with the newly-recovered plaintext credential has been sent to one or more other honeypots.

5. A non-transitory computer readable storage medium comprising program instructions executable to:

receive, at a honeypot, a plaintext credential from an original attacker as part of an original attack event;

determine that the plaintext credential does not exist in a plaintext lookup table;

add the plaintext credential to the plaintext lookup table;

add the plaintext credential to a protocol specific plaintext lookup table to associate the plaintext credential previously added to the plaintext lookup table with a protocol used by the honeypot to perform credential exchange;

generate an opaque credential for the plaintext credential;

add the opaque credential to a protocol specific opaque lookup table;

generate attack context metadata associated with the original attack event;

add the attack context metadata to the protocol specific plaintext lookup table;

store the attack context metadata associated with the original attack event in the protocol specific opaque lookup table;

receive, at the honeypot, from the original attacker as part the original attack event or from a subsequent attacker as part of a subsequent attack event, an opaque credential for the protocol used by the honeypot to perform the credential exchange;

access the protocol specific opaque lookup table; and

recover the plaintext credential associated with the opaque credential.

6. The non-transitory computer readable storage medium of claim 5 , wherein

the attack context metadata comprises one or more attack vectors, one or more exploits used, or one or more vulnerabilities targeted by the original attacker as part of the original attack event.

7. The non-transitory computer readable storage medium of claim 5 , further comprising:

modifying one or more logs generated for the original attack event or for the subsequent attack event to comprise the recovered plaintext credential;

configuring the honeypot to consider the recovered plaintext credential as valid;

updating the plaintext lookup table with the recovered plaintext credential; and

sending the updated plaintext lookup table, the protocol specific plaintext lookup table, and the attack context metadata to a honeypot management server for performance of the credential exchange.

8. The non-transitory computer readable storage medium of claim 7 , further comprising:

receiving, at the honeypot, a new plaintext credential;

sending the new plaintext credential to the honeypot management server;

receiving a global opaque lookup table from the honeypot management server;

receiving a new opaque credential;

sending the new opaque credential to the honeypot management server;

receiving a newly-recovered plaintext credential for the new opaque credential from the honeypot management server; and

receiving confirmation from the honeypot management server that the updated plaintext lookup table further updated with the newly-recovered plaintext credential has been sent to one or more other honeypots.

9. A system comprising:

one or more processors; and

a memory coupled to the one or more processors, wherein the memory stores program instructions executable by the one or more processors to:

receive, at a honeypot, a plaintext credential from an original attacker as part of an original attack event;

determine that the plaintext credential does not exist in a plaintext lookup table;

add the plaintext credential to the plaintext lookup table;

add the plaintext credential to a protocol specific plaintext lookup table to associate the plaintext credential previously added to the plaintext lookup table with a protocol used by the honeypot to perform credential exchange;

generate an opaque credential for the plaintext credential;

add the opaque credential to a protocol specific opaque lookup table;

generate attack context metadata associated with the original attack event;

add the attack context metadata to the protocol specific plaintext lookup table;

store the attack context metadata associated with the original attack event in the protocol specific opaque lookup table;

receive, at the honeypot, from the original attacker as part the original attack event or from a subsequent attacker as part of a subsequent attack event, an opaque credential for the protocol used by the honeypot to perform the credential exchange;

access the protocol specific opaque lookup table; and

recover the plaintext credential associated with the opaque credential.

10. The system of claim 9 , wherein

the attack context metadata comprises one or more attack vectors, one or more exploits used, or one or more vulnerabilities targeted by the original attacker as part of the original attack event.

11. The system of claim 9 , further comprising:

modifying one or more logs generated for the original attack event or for the subsequent attack event to comprise the recovered plaintext credential;

configuring the honeypot to consider the recovered plaintext credential as valid;

updating the plaintext lookup table with the recovered plaintext credential; and

sending the updated plaintext lookup table, the protocol specific plaintext lookup table, and the attack context metadata to a honeypot management server for performance of the credential exchange.

12. The system of claim 11 , further comprising:

receiving, at the honeypot, a new plaintext credential;

sending the new plaintext credential to the honeypot management server;

receiving a global opaque lookup table from the honeypot management server;

receiving a new opaque credential;

sending the new opaque credential to the honeypot management server;

receiving a newly-recovered plaintext credential for the new opaque credential from the honeypot management server; and

receiving confirmation from the honeypot management server that the updated plaintext lookup table further updated with the newly-recovered plaintext credential has been sent to one or more other honeypots.