## 4 DPI Applied to Honeynet Traffic and Attacks
### Layer 5 to 7 Payload Analysis
#### 4.4.5 Traffic Analysis of Port 21  
The _FTP request argument_ field contains the password when _FTP request command_ is equal to _PASS_ and the username when _FTP request command_ is equal to _USER_. After analyzing these fields, it was possible to generate statistics about the credentials with which malicious users tried to connect to the FTP server.  
When brute-forcing FTP service, most attackers tried to connect as anonymous using standard credentials. Traditionally, anonymous accounts accept any string as a password, it also being common to request for an e-mail as authentication. This FTP behavior explains the appearance of some standard password and e-mail addresses in the password fields shown in Table 10.  
One interesting detail in this analysis is that one attacker, with IP address georeferenced to the city Brasilia, tried to connect to the anonymous FTP, but using the actual personal and corporate e-mail addresses of the local network administrator and later the credentials of one professor from the department where the Honeynet is installed. This attacker also guessed nonexistent e-mail addresses in the University's domain and most other common credentials. The main guess in this case is that it probably corresponds to an attacker with insider's knowledge of the network, but he was not aware of the Honeynet itself.  
Figure 12 shows the distribution of usernames and passwords guessed. As in the Mirai botnet analysis (Section 4.4.1), a few usernames concentrate a high percentage of the total of guesses, while the passwords guessed are more equally distributed in a higher amount of different strings. However, as the distribution shows, there still is a preference for some kinds of usernames and passwords.  
Anonymous access is by default enabled in FTP servers and should be disabled, as it allows users to upload, for instance, illegal files and copyright protected material without authentication. The DPI analysis of traffic to this protocol showed that many users tried to connect to this service using anonymous access, probably with malicious intentions.  
To secure FTP servers, authentication and strong password requirements should be used, as attackers may easily and rapidly guess many weak credentials, as shown in Figure 12. Therefore, security devices should block many sequential and unsuccessful password guesses coming from the same source. Furthermore, attackers may use social engineering to obtain insider's knowledge and guess related credentials. Thus, legit users of access to limited services should be oriented regarding the disclosure of personal information, in order to prevent such exploitation.  
\begin{table}
\begin{tabular}{l l} \hline \hline
**HTTP Request** & **Description** \\ \hline HEAD [[http://18X.16X.113.82/check](http://18X.16X.113.82/check)]([http://18X.16X.113.82/check](http://18X.16X.113.82/check))\_proxy HTTP/1.1 & Scanning what kind of proxy it could be in use \\ \hline HEAD /robots.txt HTTP/1.0 & Scanning what bots are blocked or allowed by the server \\ \hline GET /muieblackcat HTTP/1.1 & _muieblackcat_ is a bot that scans for \\ GET /pma/scripts/setup.php HTTP/1.1 & PHP vulnerabilities \\ \hline GET /w00 tw00t.at.blackhats.romanian.anti-sec:) HTTP/1.1 & \\ GET /phpmyadmin/scripts/setup.php HTTP/1.0 & \\ GET /dbadmim/scripts/setup.php HTTP/1.1 & _ZmEu_ is a bot that scans for \\ GET /mygadmin/scripts/setup.php HTTP/1.1 & phpMyAdmin vulnerabilities. \\ GET /admin/phpmyadmin/scripts/setup.php HTTP/1.1 & It also performs SSH brute-force. \\ GET /admin/pmascripts/setup.php HTTP/1.10 & \\ GET /MyAdmin/scripts/setup.php HTTP/1.1934 & \\ \hline GET /namplovercheck1487075443 HTTP/1.1 & _Nmap_ probes for information \\ GET /nice\%20 ports\%2C/Tri\%Eity.txt\%2 ebak HTTP/1.0 & about the server. \\ \hline \hline \end{tabular}
\end{table}
Table 9: Examples of malicious HTTP requests received and their description.