honeyLambda: create and monitor fake HTTP endpoints

by do son · January 17, 2018

honeyλ – a simple serverless application designed to create and monitor URL {honey}tokens, on top of AWS Lambda and Amazon API Gateway

Slack notifications
Email and SMS alerts
Load config from local file or Amazon S3
Customize the HTTP response for each token
Threat Intelligence report (Source IP lookup)
- Using Cymon API v2
Based on Serverless framework
- pay-what-you-use
- provider agnostic

honeyλ allows you to create and monitor fake HTTP endpoints automatically. You can then place these URL honeytokens in e.g. your inbox, documents, browser history, or embed them as {hidden} links in your web pages (Note: honeybits can be used for spreading breadcrumbs across your systems to lure the attackers toward your traps). Depending on how and where you implement honeytokens, you may detect human attackers, malicious insiders, content scrapers, or bad bots.

This application is based on Serverless framework and can be deployed in different cloud providers such as Amazon Web Services (AWS), Microsoft Azure, IBM OpenWhisk or Google Cloud (Only tested on AWS; the main function may need small changes to support other providers). If your cloud provider is AWS, it automatically creates HTTP endpoints using Amazon API Gateway and then starts monitoring the HTTP endpoints using honeyλ Lambda function.

Setup

Install Serverless framework:
- npm install -g serverless
Install honeyλ:
- serverless install --url https://github.com/0x4d31/honeyLambda
Edit serverless.yml and set HTTP endpoint path (default: /v1/get-pass)
Edit config.json and fill in your Slack Webhook URL. Change the trap/token configs as you need
You can customize the HTTP response for each token
- For example, you can return a 1x1px beacon image in response and embed the token in your decoy documents or email (tracking pixel!)

Deploy

Set up your AWS Credentials
In order to deploy honeyλ, simply run:
- serverless deploy

Output:

Serverless: Packaging service...

Serverless: Creating Stack...

Serverless: Checking Stack create progress...

.....

Serverless: Stack create finished...

Serverless: Uploading CloudFormation file to S3...

Serverless: Uploading artifacts...

Serverless: Uploading service .zip file to S3 (116.22 KB)...

Serverless: Validating template...

Serverless: Updating Stack...

Serverless: Checking Stack update progress...

.................................

Serverless: Stack update finished...

Service Information

service: honeyLambda

stage: dev

region: ap-southeast-2

api keys:

  None

endpoints:

  GET - https://rz1bEXAMPLE.execute-api.ap-southeast-2.amazonaws.com/dev/v1/get-pass

functions:

  honeylambda: honeyLambda-dev-honeylambda

Note: If you want to return binary in HTTP response (e.g. Content-Type: image/png), you have to manually configure Binary Support using the Amazon API Gateway console (it’s not yet possible to set binary media types automatically using serverless):

Open the Amazon API Gateway console, add the binary media type */*, and save.