LightScope: Turning Production Machines into Telescopes and Honeypots

Traffic to unused IP addresses (dark spaces), including passive and reactive network telescopes and honeynets, has traditionally been used to study malicious activities. However, attackers may avoid known dark space sensors and preferentially target endpoints hosting legitimate services. We present LightScope, a lightweight application that unifies passive observation at Layer 4 with selective proxying to a remote Layer 7 honeypot. LightScope does this by leveraging a subset of the unused ports on production servers. By embedding measurement on the production hosts themselves, LightScope creates a new vantage point for observing various scanner populations, port-targeting profiles, and post-login behaviors that are only partially visible from dark-space telescopes and honeynets. In this paper we analyze two months of data collected from 235 LightScope deployments. We show that LightScope contributes new knowledge about widely observed scanners, their port scan strategies and their post-exploit activities. These scanners interact with production endpoints running LightScope differently than they do with other vantage points. In our study period, LightScope also exclusively observes 64,686 scanners not present at other vantage points. By instrumenting production machines, LightScope provides complementary visibility to existing telescopes and honeynets.