What is sinkholing?

Sinkholing is the redirection of traffic away from its original destination and into a controlled location, known as a sinkhole. Why? During the Locked Shields cyber exercise we observed unwanted traffic heading to specific domains. We decided to redirect those domains to a machine we controlled, where we could analyse the (encrypted) communications.

The infected machines were communicating over encryption and we didn't have the private key — we were relying on the fact that they wouldn't verify the server certificate (we used a simple openssl req -new -x509 -keyout server.pem -out server.pem -days 365 -nodes). They didn't verify it, so we were able to identify the content of the requests at the endpoint. The HTTPS server was a modified SimpleHTTPServer. We successfully uncovered the content, identified the infected machines, and eliminated the infection.

Sinkholing is a fairly effective method — and that certainly wasn't the last time we used it.

Previous Post Next Post

Other Related Posts:

Locked Shields CCDCoE Red Team Blue Team

Locked Shields 2021

A cyber exercise from home

During a pandemic, running a cyber exercise is a huge challenge. Personal contact has to be replaced by chat and video calls. On top of that the team restructured and we introduced a SIEM. All of this would have been fairly straightforward without the pandemic. If yo...

16th Apr 2021
Locked Shields Red Team Blue Team

Locked Shields 2019

Another year, new challenges

As every year, I took part in the Locked Shields cyber exercise. This year the team responsible for Red Team detection doubled in size — whether that doubled our chances of eliminating the Red Team (attackers) was hard to judge in advance.

We spent the preparation...

12th Apr 2019