UPnProxyPot: Fake the Funk, Become a Blackhat Proxy, MITM Their TLS
Akamai researcher Chad Seaman presents UPnProxyPot, a Golang honeypot that impersonates vulnerable UPnP routers to intercept and MITM blackhat proxy networks.
Summary
The Exploitation of UPnP in Criminal Proxy Networks
Threat actors routinely scan the internet for routers with exposed UPnP services (UPnProxy), injecting port forwarding rules to transform consumer routers into anonymous proxy relays.
Building UPnProxyPot: The Golang UPnP Honeypot
Chad Seaman introduces UPnProxyPot, an open-source honeypot engineered to mimic vulnerable SSDP and UPnP daemon behaviors.
Intercepting and Decrypting Adversary Traffic
By posing as a functional proxy node in botnet networks, UPnProxyPot intercepts, logs, and MITMs encrypted TLS traffic routed through criminal proxy infrastructure.
Extracting Threat Intelligence on Active Cybercrime Campaigns
Seaman shares empirical data on cybercrime operations, credit card fraud rings, and credential stuffing attacks observed through the honeypot network.
Related talks
Main Stage·44 min
Maxime Bergeron · Olivier Bilodeau
Gozint and ESET researchers use PyRDP to record and classify over 100 hours of attacker sessions on exposed RDP honeypots into behavioral archetypes.
Main Stage·19 min
Ionut Cernica
Ionut Cernica analyzes automated hacker tooling and exploit scripts, demonstrating how predictable exploit traffic leaks target data to network eavesdroppers over TLS.
S4 Events·27 min
Engineers explore architecture and security mechanisms for Honeypots For Threat Intelligence.