Project Swarm Lets Users Deploy Honeypots to Investigate Internet Exploitation
· 47:11 · Watch on YouTube ↗
Summary
John Hammond and Grey Noise founder Andrew Morris demonstrate Project Swarm, showing how users can deploy honeypot sensors, inspect exploit traffic, download packet captures and investigate suspicious scanning.
Key points
- Morris says Project Swarm costs $1 to access and lets users deploy unlimited sensors, upload custom profiles, write rules and download their own packet captures.
- Sensors forward traffic through a tunnel to honeypots hosted by Grey Noise, reducing local computing requirements and allowing users to switch software profiles.
- Custom honeypots can use uploaded OVA images or physical hardware bridged through a Raspberry Pi transporter. Morris says the hardware is isolated from the rest of the user's network.
- The demonstration correlates an SSH fingerprint with roughly 3,000 IP addresses classified as malicious or suspicious. Morris interprets this as likely shared botnet tooling; the underlying codebase remains unidentified.
- Session inspection reveals a request for a git configuration file. Morris also says the platform decrypts TLS in certain cases to inspect exploits delivered over encrypted connections.
- Morris acknowledges that surfacing high-impact activity still needs improvement. Sensor rentals and support for running additional vulnerable device firmware are described as future work.
Article Details
- Topics
- [00:20] Project Swarm and user-operated honeypot data collection
- [04:43] Filtering and visualizing sensor sessions and scanning traffic
- [07:49] Investigating SSH activity through fingerprint correlation
- [11:14] Sensor deployment, tunneled architecture and software profiles
- [13:33] Custom OVA profiles and isolated physical-device honeypots
- [18:21] Inspecting payloads, downloading packet captures and decrypting TLS
- [27:08] Callback analysis linking downloads, malware artifacts and command-and-control
- [30:30] Investigating scanning spikes and uncertain TCP fingerprints
People
Andrew MorrisFounder of Grey Noise who explains Project Swarm's architecture, demonstrates traffic investigations and discusses current limitations and planned capabilities.John HammondDemonstrates his Project Swarm sensors and participates in analyzing suspicious SSH activity, exploit attempts and captured network sessions.