Cowrie is a medium interaction SSH and Telnet honeypot designed to log brute force attacks and shell interaction performed by an attacker. Cowrie also functions as an SSH and telnet proxy to observe attacker behavior to another system. Cowrie was developed from Kippo.
History
Cowrie was developed by Michel Oosterhof as a fork of Kippo. Kippo was itself inspired by Kojoney, one of the earliest SSH honeypots, whose active development ceased around 2006. Kippo was developed between 2009 and 2015, after which its author directed users to Cowrie.
Compared to Kippo, Cowrie added more extensive logging and support for the Telnet protocol. The T-Pot multi-honeypot platform, developed by Deutsche Telekom, replaced Kippo with Cowrie in March 2016.
Design
Cowrie is written in Python and uses the Twisted Conch library, the de facto standard implementation of SSHv2 for Python.
The project's stated approach is to implement only those shell commands observed in use by attackers; as of January 2018 it partially emulated 34 commands.
Use
Cowrie has been used as a data source in published security research.
Rapid7 has included Cowrie among the open-source honeypots used in its Project Heisenberg Cloud framework. Following the emergence of large-scale attacks on Internet of Things devices in 2016, researchers at the SANS Institute urged administrators and security researchers to run current versions of Cowrie in order to monitor changes in the credentials being targeted and in attack patterns.
Limitations
In 2018, Vetterl and Clayton of the University of Cambridge demonstrated a generic technique for identifying low- and medium-interaction honeypots at Internet scale, using deviations in how they implement network protocols compared to the systems they impersonate. Because Cowrie relies on the Twisted Conch library rather than replicating OpenSSH exactly, its responses differ from a genuine OpenSSH server in ways detectable from a single packet. Cowrie and Kippo pad SSH2_MSG_KEXINIT packets with random bytes, whereas OpenSSH uses null bytes; Cowrie can also be distinguished by its disconnection messages.
Applying the technique in Internet-wide scans conducted in January 2018, the authors identified 2,021 Cowrie instances running on SSH and 938 on Telnet. They described the weakness as a class break that could not be addressed by patching the existing honeypot architecture. They also found that Cowrie deployments were often poorly maintained, with only around half having incorporated improvements released seven months earlier, and that some operators ran multiple honeypots on a single address or reused SSH host keys across deployments.
The authors disclosed their findings to Cowrie's developer in March 2017. Cowrie subsequently changed its padding to use null characters; as of June 2018 the authors reported that only one of the issues they identified had been resolved.
References
External links