CET4862
Network Forensics and Incident Response
Assignment 2 - Network Intrusion
Goal:
The goal of this assignment is to allow us to practice network forensics on a packet capture. This packet capture is not as straightforward as that used in the CIS4360 course; this is a bit more realistic, although truncated packet capture with a fair amount of traffic. There are some fun(ny) things going on with the network as evidenced in the packet capture. We will use Wireshark to analyze the packet capture. Hint: The using the filters in Wireshark will make our job a lot easier for some questions.
If you've taken CIS4360 prior to this, and you should have, then you have seen some of these videos. If you feel you have a good grasp of TCP/IP, signature analysis, and using Wireshark, you could skip the videos; however, a refresher is always good to have.
An 'attacker' will typically perform several steps prior to conducting an attack, called the 'reconnaissance' phase:
1. Enumeration: What computers are up and running?
2. Footprinting:What services are provided by the computers that are up and running?
3. Fingerprinting: What operating systems are the computers running?
The 'attack' phase* can occur in many forms:
1) Unauthorized access (logging into a computer without authorization)
2) Downloading information (unauthorized access to information)
3) Uploading information or files (root kits, logic or time bombs, worms, viruses, etc.)
3) Denial of service attacks
4) etc.
*Not all of the attacks are represented in the packet capture.
Scenario:
Ms. Wilde, pleased with your performance on the malware case, has decided to give you another incident. The overworked, underpaid, and understaffed IT administrator of a small business has contacted Palindrome to analyze some network traffic around the time of an abnormal spike in traffic. Your mission, should you choose to accept it - and Ms. Wilde has decided that you do - is to analyze the provided packet capture and report on the activity found therein which may.
To aid in your goals, the administrator has provided a few details about the network from which the capture originated. There are four computers on the network. The IT administrator admin box is an Ubuntu server. There are also DHCP and web (HTTP) servers and the Admin is the only individual within the company with authorization for access to those servers. There are two other employees, Bob Smith, a new hire and recent college graduate, who uses a workstation with network access running Windows XP, and Sarah, a developer who uses a workstation with a standard installation of Ubuntu also with network access. Both Bob and Sarah are authorized to have access to their own workstation and no others.
The analysis and deliverables for this assignment are in two parts: Reconnaissance and Incidents. To be clear, this doesn't mean that early traffic may only be relevant to the first part of the assignment or latter traffic for the second part of the assignment. Instead, we're trying to be a bit more focused on how we analyzed what occurred. The Reconnaissance portion will be mostly focused on creating an understanding of the environment represented by this packet capture: what devices are on the network, their roles, etc. The Incident portion of the assignment will be mostly focused on some specific things which our attacker(s) has done.
Reconnaissance
Deliverables:
A professional-quality report in two sections.
First, a management summary, written with no technical language, which provides a summary of what was found. The summary should be roughly a paragraph in length. This will require some thinking on your part to digest all that you've seen and turn that into something a manager can read quickly, but also come away with, and comprehend, the relevant information you gathered.
The second part will be the technical section where you will answer the following questions. Include the question and the answer.
1. What is the network address and subnet mask?
2. For each computer:
a. What is the IP of the computer?
b. What OS is it running?
c. What is the MAC address?
3. What computer (refer by OS name and last octet of the IP address, e.g., Win7.128) is serving as a DHCP server? How do you know?
a. What other services is the DHCP server running? How do you know?
4. What computer (refer by OS name and last octet of the IP address) is running a web server?
a. Which computer(s) accessed this web server?
b. How do you know a web page was accessed? What was the file name of the web page accessed?
c. What web browser was the user running?
d. At what time did the access occur?
e. What web server application was running? (include version number)
5. What computer (refer by OS name and last octet of the IP address) is running the telnet service?
a. Which computer(s) accessed the telnet server?
b. At what time(s)/date did this access occur?
Incidents
Deliverables:
A professional-quality report in two sections.
First, a management summary, written with no technical language, which provides a summary of what was found. The summary should be roughly a paragraph in length. This will require some thinking on your part to digest all that you've seen and turn that into something a manager can read quickly, but also come away with, and comprehend, the relevant information you gathered.
The second part will be the technical section where you will answer the following questions. Include the question and the answer.
1. What usernames/passwords were used to access the telnet server?
a. What did the attacker do, if anything, from the telnet server? Explain why the attacker might have done this.
2. What is a buffer overflow? What is an SQL Injection? Identify the packet series that contains what appears to be a buffer overflow followed by an SQL Injection. Describe how the attacker attempts to effect the buffer overflow. You may need additional material from the Web. Use your own words; do not copy and paste an answer.
3. What is a port scan?
a. How many port scans were run?
b. What computer initiated the port scan(s)? What were the target computers?
c. What type of port scan(s) did the attacker use (refer to the man page for nmap)?
4. What did the 'attacker' do once on the FTP server?
a. How many commands were run on the ftp server?
b. What username/password was used to access the FTP server?
c. From what computer was the FTP server accessed?
d. Date and time?
e. What file was downloaded from the ftp server?
f. To which computer was this file downloaded?
5. What is the IP address of the attacker? In your opinion, how technically sophisticated is the attacker? Provide evidence to support your claims.
Writing a non technical summary
Your non technical summary should use NO technical terms. Is this difficult when describing a technical event? YES! That doesn't mean it can't be done. Here is an excerpt from the Washington Post about the Heartbleed SSL issue. Note that they do a terrific job of explaining the technical issue with NO technical terms!
Q: What is SSL?.
A: It stands for Secure Socket Layer. It is the technology for establishing an encrypted link between a Web server and a browser. This link ensures that all data passed between the Web server and browsers remain private. “Open” SSL simply means that the code is freely available.
It’s the “s” in “https” that is supposed to stand for “secure.” Unlike Web sites that begin with “http,” “https” sites have a lock in browser address bars.
“That lock is supposed to signal that third parties won’t be able to read any information you send or receive. Under the hood, SSL accomplishes that by transforming your data into a coded message that only the recipient knows how to decipher,” explains Vox’s Timothy Lee. “If a malicious party is listening to the conversation, it will only see a seemingly random string of characters, not the contents of your emails, Facebook posts, credit card numbers, or other private information.”
Have fun!
What you'll need:
Comments (0)
You don't have permission to comment on this page.