Deceiving an attacker who is harvesting credentials

• US 10,333,977 B1
• Filed: 08/23/2018
• Issued: 06/25/2019
• Est. Priority Date: 08/23/2018
• Status: Active Grant

• Current Assignee: illusive networks LTD.
• Original Assignee: illusive networks LTD.
• Inventors: Shamul, Tomer, Lasry, Tsahi, Segev, Moshe, Natan, Mor
• Primary Examiner(s): Giddins, Nelson
• Application Number:
  US16/109,811
• Time in Patent Office: 306 Days
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment

Abstract

A system for deceiving an attacker who harvests credentials within an enterprise network, including a management server deploying a deceptive agent on an endpoint computer of the enterprise network, the deceptive agent including a hook manager creating system hooks on resources in the endpoint computer that holds valuable credentials, which would be desired by attackers, and a deceptive content provider, generating deceptive content and returning the deceptive content to a malicious process run by an attacker on the endpoint computer, the malicious process making a read request directed to a resource in the endpoint computer that holds valuable credentials, thus making it appear to the attacker that a response is coming from the resource whereas in fact the response is coming from the deceptive agent, when the hook manager hooks the read request.

Claims

1. A system for deceiving an attacker who harvests credentials within an enterprise network, comprising a management server deploying a deceptive agent on an endpoint computer of the enterprise network, the deceptive agent comprising:

a hook manager creating a system hook on a network adaptor of the endpoint computer; and

a deceptive content provider, generating deceptive content and responding to an outgoing call to a service of a remote server of the enterprise network made by a malicious process run by an attacker on the endpoint computer, returning the deceptive content to the malicious process, thus making it appear to the attacker that a response is coming from the service in the remote server whereas in fact the response is coming from the deceptive agent, when said hook manager hooks the remote call.

2. The system of claim 1 wherein said hook manager creates system hooks on resources in the endpoint computer that hold valuable credentials, which would be desired by attackers, and wherein said deceptive content provider generates deceptive content and returns the deceptive content to a malicious process run by the attacker on the endpoint computer, the malicious process making a read request directed to a resource in the endpoint computer that holds valuable credentials, thus making it appear to the attacker that the response is coming from the resource whereas in fact the response is coming from the deceptive agent, when said hook manager hooks the read request.

3. The system of claim 2 wherein the resource that holds desirable credentials is a registry, a file server, or a memory in the endpoint computer.

4. The system of claim 1 wherein said management server deploys the deceptive agent on the remote server, wherein said deceptive agent further comprises an authenticator, listening to inbound requests to the remote server and authenticating the inbound requests as coming from the endpoint computer of the enterprise network, and wherein said deceptive agent generates deceptive content and responds to a remote call to a service of the remote server from a malicious process being run by the attacker on the endpoint computer by returning the deceptive content to the malicious process, thus making it appear to the attacker that the response is coming from the service of the remote server whereas in fact the response is coming from said deceptive agent, when said authenticator detects the remote call.

5. A method for deceiving an attacker who is harvesting credentials within an enterprise network, comprising:

deploying, by a management server, a deceptive agent on an endpoint computer of an enterprise network;

creating, by the deceptive agent, a system hook on a network adaptor of the endpoint computer; and

in response to hooking an outbound call to a service of a remote server in the enterprise network, by a malicious process being run by an attacker on the endpoint computer, generate, by the deceptive agent, deceptive content and respond to the remote call by returning the deceptive content to the malicious process, thus making it appear to the attacker that the response is coming from the remote server whereas in fact the response is coming from the deceptive agent.

6. The method of claim 5 further comprising:

creating, by the deceptive agent, system hooks on resources in the endpoint computer that hold valuable credentials, which would be desired by attackers; and

in response to hooking a read request by the malicious process, directed to a resource in the endpoint computer that holds valuable credentials, generate, by the deceptive agent, deceptive content and respond to the read request by returning the deceptive content to the malicious process, thus making it appear to the attacker that the response is coming from the resource whereas in fact the response is coming from the deceptive agent.

7. The method of claim 6 wherein the hooked read request is directed to a registry, a file server, or a memory in the endpoint computer.

8. A method for deceiving an attacker who is harvesting credentials within an enterprise network, comprising:

deploying, by a management server, a deceptive agent on a remote server of an enterprise network, wherein the deceptive agent listens to inbound requests for the remote server and authenticates the inbound requests as coming from a legitimate process running on a client computer of the enterprise network; and

in response to detecting a remote call to a service of the remote server from a malicious process being run by an attacker on a client computer of the enterprise network, generate, by the deceptive agent, deceptive content and respond to the remote call by returning the deceptive content to the malicious process, thus making it appear to the attacker that the response is coming from the service in the remote server whereas in fact the response is coming from the deceptive agent.

9. A system for deceiving an attacker who harvests credentials within an enterprise network, comprising a management server deploying a deceptive agent on a remote server of the enterprise network, the deceptive agent comprising:

an authenticator, listening to inbound requests to the remote server and authenticating the inbound requests as coming from a legitimate process running on a client computer of the enterprise network; and

a deceptive content provider, generating deceptive content and responding to a remote call to a service of the remote server from a malicious process being run by an attacker on the client computer by returning the deceptive content to the malicious process, thus making it appear to the attacker that the response is coming from the service of the remote server whereas in fact the response is coming from said deceptive agent, when said authenticator detects the remote call.