Introducing Linux Support for FakeNet-NG: FLARE’s Next Generation
Dynamic Network Analysis ToolIntroduction
In 2016, FLARE href="https://www.fireeye.com/blog/threat-research/2016/08/fakenet-ng_next_gen.html">introduced
FakeNet-NG, an open-source network analysis tool written in
Python. FakeNet-NG allows security analysts to observe and interact
with network applications using standard or custom protocols on a
single Windows host, which is especially useful for malware analysis
and reverse engineering. Since FakeNet-NG’s release, FLARE has added
support for additional protocols. FakeNet-NG now has out-of-the-box
support for DNS, HTTP (including BITS), FTP, TFTP, IRC, SMTP, POP,
TCP, and UDP as well as SSL.
Building on this work, FLARE has now brought FakeNet-NG to Linux.
This allows analysts to perform basic dynamic analysis either on a
single Linux host or using a separate, dedicated machine in the same
way as INetSim. INetSim has made amazing contributions to the
productivity of the security community and is still the tool of choice
for many analysts. Now, FakeNet-NG gives analysts a cross-platform
tool for malware analysis that can directly integrate with all the
great Python-based infosec tools that continually emerge in the field.
Getting and Installing FakeNet-NG on Linux
If you are running REMnux, then
good news: REMnux now comes with FakeNet-NG installed, and existing
users can get it by running the class="code">update-remnux command.
For other Linux distributions, setting up and using FakeNet-NG will
require the Python pip package manager, the class="code">net-tools package, and the development files for
OpenSSL, libffi, and class="code">libnetfilterqueue. Here is how to quickly obtain
the appropriate prerequisites for a few common Linux distributions:
- Debian and Ubuntu: sudo apt-get install
python-pip python-dev libssl-dev libffi-dev libnetfilter-queue-dev
net-tools - Fedora 25 and CentOS 7:
yum -y update;
yum -y install epel-release; # <-- If
CentOS
yum -y install redhat-rpm-config; # <-- If
Fedora
yum -y groupinstall 'Development Tools'; yum
-y install python-pip python-devel openssl-devel libffi-devel
libnetfilter_queue-devel net-tools
Once you have the prerequisites, you can href="https://github.com/fireeye/flare-fakenet-ng">download the
latest version of FakeNet-NG and install it using class="code">setup.py install.
A Tale of Two Modes
On Linux, FakeNet-NG can be deployed in class="code">MultiHost mode on a separate host dedicated to
network simulation, or in the experimental class="code">SingleHost mode for analyzing software locally.
Windows only supports SingleHost mode.
FakeNet-NG is configured by default to run in class="code">NetworkMode: Auto, which will automatically
select SingleHost mode on Windows or class="code">MultiHost mode on Linux. Table 1 lists the
currently supported NetworkMode settings by
operating system.
|
SingleHost
|
MultiHost
|
Windows
|
Default (Auto)
| | valign="top">Unsupported
Linux
| | valign="top">Experimental
Default (Auto)
|
Table 1: FakeNet-NG NetworkMode support per platform
FakeNet-NG’s support for SingleHost mode
on Linux currently has limitations.
First, FakeNet-NG does not yet support conditional redirection of
specific processes, hosts, or ports on Linux. This means that settings
like ProcessWhiteList will not work as
expected. We plan to add support for these settings in a later
release. In the meantime, SingleHost mode
supports redirecting all Internet-bound traffic to local listeners,
which is the main use case for malware analysts.
Second, the python-netfilterqueue library
is hard-coded to handle datagrams of no more than 4,012 octets in
length. Loopback interfaces are commonly configured with high maximum
transmittal unit (MTU) settings that allow certain applications to
exceed this hard-coded limit, resulting in unanticipated network
behavior. An example of a network application that may exhibit issues
due to this would be a large file transfer via FTP. A workaround is to
recompile python-netfilterqueue with a
larger buffer size or to decrease the MTU for the loopback interface
(i.e. lo) to 4,012 or less.
Configuring FakeNet-NG on Linux
In addition to the new NetworkMode
setting, Linux support for FakeNet-NG introduces the following
Linux-specific configuration items:
LinuxRedirectNonlocal: For class="code">MultiHost mode, this setting specifies a
comma-delimited list of network interfaces for which to redirect all
traffic to the local host so that FakeNet-NG can reply to it. The
setting in FakeNet-NG’s default configuration is *, which configures
FakeNet-NG to redirect on all interfaces.
LinuxFlushIptables: Deletes all class="code">iptables rules before adding rules for
FakeNet-NG. The original rules are restored as part of FakeNet-NG’s
shutdown sequence which is triggered when you hit Ctrl+C. This
reduces the likelihood of conflicting, erroneous, or duplicate rules
in the event of unexpected termination, and is enabled in
FakeNet-NG’s default configuration.
LinuxFlushDnsCommand: Specifies the
command to flush the DNS resolver cache. When using FakeNet-NG in
SingleHost mode on Linux, this ensures
that name resolution requests are forwarded to a DNS service such as
the FakeNet-NG DNS listener instead of using cached answers. The
setting is not applicable on all distributions of Linux, but is
populated by default with the correct command for Ubuntu Linux.
Refer to your distribution’s documentation for the proper command
for this behavior.
Starting FakeNet-NG on Linux
Before using FakeNet-NG, also be sure to disable any services that
may bind to ports corresponding to the FakeNet-NG listeners you plan
to use. An example is Ubuntu’s use of a local class="code">dnsmasq service. You can use class="code">netstat to find such services and should refer to
your Linux distribution’s documentation to determine how to disable them.
You can start FakeNet-NG by invoking class="code">fakenet with root privileges, as shown in Figure 1.
Figure 1: Starting FakeNet-NG on Linux
You can alter FakeNet-NG’s configuration by either directly editing
the file displayed in the first line of FakeNet-NG’s output, or by
creating a copy and specifying its location with the class="code">-c command-line option.
Conclusion
FakeNet-NG now brings the convenience of a modern, Python-based,
malware-oriented network simulation tool to Linux, supporting the full
complement of listeners that are available on FakeNet-NG for Windows.
Users of REMnux can make use of FakeNet-NG already, while users of
other Linux distributions can href="https://github.com/fireeye/flare-fakenet-ng">download and
install it using standard package management tools.
Source:
Introducing Linux Support for FakeNet-NG: FLARE’s Next Generation
Dynamic Network Analysis Tool
