Cowrie is a medium interaction

SSH The Secure Shell Protocol (SSH) is a cryptographic network protocol for operating network services securely over an unsecured network. Its most notable applications are remote login and command-line execution. SSH applications are based on a ...

and

Telnet Telnet is an application protocol used on the Internet or local area network to provide a bidirectional interactive text-oriented communication facility using a virtual terminal connection. User data is interspersed in-band with Telnet control i ...

honeypot designed to log brute force attacks and shell interaction performed by an attacker. Cowrie also functions as an SSH and telnet

proxy Proxy may refer to: * Proxy or agent (law), a substitute authorized to act for another entity or a document which authorizes the agent so to act * Proxy (climate), a measured variable used to infer the value of a variable of interest in climate re ...

to observe attacker behavior to another system. Cowrie was developed from Kippo.

Reception

Cowrie has been referenced in published papers. The Book "''Hands-On Ethical Hacking and Network Defense''" includes Cowrie in a list of 5 commercial honeypots.

Prior uses

* Discussing a honeypot effort called the Project Heisenberg Cloud by Rapid7, Bob Rudis, the company's chief data scientist, told eWEEK, "There are custom Rapid7-developed low- and medium-interaction honeypots used within the framework, along with open-source ones, such as Cowrie." * Doug Rickert has experimented with the open-source Cowrie SSH honeypot and wrote about it on Medium. Putting up a simple honeypot isn't difficult, and there are many open-source products besides Cowrie, including the original Honeyd to MongoDB and NoSQL honeypots, to ones that emulate web servers. Some appear to be SCADA or other more advanced applications.

Best practices

* Researchers at the SysAdmin, Audit, Network and Security (SANS) institute urged administrators and security researchers to run the latest version of Cowrie on a honeypot to monitor shifts in the type of passwords being scanned for and pattern of attacks on IoT devices.

Discussion and further resources

* ''Attack Detection and Forensics Using Honeypot in an IoT Environment'' calls Cowrie a "medium interaction honeypot" and describes results from using it for 40 days to capture "all communicated sessions in log files." * The book ''Advances on Data Science'' also devotes chapter two to "Cowrie Honeypot Dataset and Logging." * ICCWS 2018 13th International Conference on Cyber Warfare and Security describes using Cowrie. * ''On the Move to Meaningful Internet Systems: OTM'' 2019 Conferences includes details of using Cowrie. * Splunk, a security tool that can receive information from honeypots, outlines how to set up a honeypot using the open-source Cowrie package.

References

External links

* {{Portal, Free and open-source software Software forks Computer security