sebek2- kernel based data capture tool

Quote:

---

Know Your Enemy: Sebek2 - A kernel based data capture tool
by The Honeynet Project - Wednesday, 24 September 2003.

To observe intruders using session encryption, researchers needed to find a way to break the session encryption. For many organizations this has proven extremely difficult. In an attempt to circumvent session encryption rather than break it, the Honeynet Project began experimenting with using kernel-based rootkits for the purpose of capturing the data of interest from within the honeypot’s kernel.

These experiments lead to the development of a tool called Sebek. This tool is a piece of code the lives entirely in kernel space and records either some or all data accessed by users on the system. It provides capabilities to: record keystrokes of a session that is using encryption, recover files copied with SCP, capture passwords used to log in to remote system, recover passwords used to enable Burneye protected binaries and accomplish many other forensics related tasks. What follows is a detailed discussion of Sebek, how it works and its value.

Download the paper in PDF format here .

---

Thought some here might be interested in this. Especially those running honeypots.

Enjoy!