A Pakistani Researcher’s Journey to Developing a Novel Trap for Cybercriminals

Muhammad Bilal Arif, a cybersecurity researcher at Trillium Information Security, has recently made waves in the global tech community. He was one of only eight participants from Pakistan selected for the Google Summer of Code (GSoC) program this year. The program is highly competitive, with only 1,318 participants  chosen from over 20,000 applicants worldwide, a mere 6.4% acceptance rate. But for Bilal, this achievement is just another step in a journey that began with a simple question: how do you protect systems from online threats?

Bilal’s interest in cybersecurity started during his undergraduate studies when he started listening to BlackHat talks and following global experts in the subject. He became curious about ethical hacking, how attackers exploit systems and how those attacks could be prevented. This curiosity led him to secure a researcher position at Applied Security Research Group at Trillium Information Security. While working with Trillium’s researchers, Bilal learned about honeypots. These are decoys designed to attract attackers by simulating real systems, with the goal of monitoring them, blocking their actions, or even launching an offensive response if the situation calls for it.

After experimenting with many open-source tools, Bilal found that most honeypots were limited to one protocol, such as emulating a web server or an industrial control system. To trap malicious users across multiple protocols, you would need to set up a separate honeypot for each. Frustrated by this limitation, Bilal aimed to create a comprehensive tool to handle a wider range of threats. He reached out to various cybersecurity communities and connected with Lukas Rist, Chief Research Officer of The Honeynet Project, a global organization supported by Fortune 500 companies to develop deception systems.

Under Rist’s mentorship, Bilal developed a new type of honeypot. Unlike traditional honeypots, which are limited to specific protocols, his honeypot, called Glutton, could interact with attackers over multiple protocols. This project was endorsed by The Honeynet Project and Bilal spent months implementing this honeypot in the Go programming language. Glutton is designed to engage attackers on any port, making it a versatile tool for cybersecurity researchers. For his exceptional work on this project Bilal was accepted into GSoC to continue to improve the honeypot.

“Working on Glutton was a great opportunity,” Bilal said. “It wasn’t just about coding. I learned about secure coding practices, open-source project management, and how to collaborate with experts from around the world.”

Bilal’s contribution to the global cybersecurity community goes beyond creating a new tool to identify and analyze potential attacks. It also serves as an inspiration for young developers who aim to solve complex, real-world problems. For Bilal, however, this is just the beginning. He aims to bring initiatives like The Honeynet Project to Pakistan.

“I want to establish a local chapter of The Honeynet Project here,” he said. “It would help students and professionals learn about deceptive security and contribute to global efforts.”

Bilal’s journey is an example of how curiosity, persistence, and the right opportunities can lead to meaningful achievements. For those interested in his project, more details about Glutton can be found on the official Google Summer of Code project page here.