BlackNet alpha 3 is out, bringing mostly a centralized configuration system to help with deployment and installation. We also added information about license, readme, and a public mercurial repository. For more information about BlackNet, please see the previous post on this blog.

You can download the project at the following URL: http://dev.bezut.info/p9/BlackNet.

Unfortunately our report on the project is not available in English yet. If you want to download it in french please select the french version of this post. The English version should be available by the end of July, since it will certainly contain more information than in the french version.

However a recent article in the Hacking magazine HITB is dealing with the same subject. You can download it for free in PDF at http://magazine.hitb.org.
The tool used in this article is called Kojoney, and simulate a SSH server (in python). The goal is to let attackers getting in (on a simulated shell), and collect information on the commands they type, the login they used, etc... The conclusions of this document are the same as ours in terms of countries involve, nationality of attackers, passwords tested, ..

Kojoney and BlackNet are different because Kojoney wants to le light at installation, and to provide raw statistics by email, or in txt files, from a single server, and with an automated intrusion system (with limited range of commands, etc...).
Our goal is to be able to install a whole infrastructure to collect login attempts from multiple servers, centralize it, and display it on a web interface, with maps, charts, logins used, etc... We still have the opportunity to create a vulnerable virtual machine and collect commands and miscellaneous events with our system, but not automatically.
That's why we plan to add functionality to Kojoney to be able to communicate with our system, and basically to behave like one of our virtual machine. It would provide us a very light alternative to virtual machines and also a way to have an automatic way to monitor commands and events (events are something like a password change on the account).

But we still keep in mind that stalking bot masters as we did in during our project is clearly not something easy to automate, and there will still be human involved in this process (and that's why it's interesting no?).