Greetings once more, my apprentice hackers!
I started a new series on digital forensics lately to demonstrate to potential hackers what a forensic investigator may observe and do when looking into a cyberattack. The second part of that series, which focuses on network forensics, is available now. Stated differently, what, and how, can a network forensic investigator discover about the attacker during an investigation?
Step1: Get Wireshark
While there are several tools available for network analysis and research, Wireshark is the most commonly used tool for this purpose. You can get this free network analysis tool from this link. It has been ported to Windows, Unix, OS X, and Linux. Better yet, if you use BackTrack, there's no need to download anything because it's integrated into the program.
You can start Wireshark from the BackTrack menu by going to BackTrack -> Information Gathering -> Network Analysis -> Network Traffic Analysis and click on Wireshark.
Step2: Grab a Live Capture The next step is to launch Wireshark, which can perform live captures in addition to analysis on pcap and other capture files. Have a live capture, please. A window similar to the one below will open when you select Capture from the menu at the top.
Select the active interface, which in this case is
eth0, as I'm running it on a wired connection.
Step3: Our Problem
This is the issue that we are dealing with.
Our client has been complaining that his PC is acting strangely. His browser is constantly switching to a website informing him that he needs to purchase an antivirus program and that there is a virus on his machine. Everybody has witnessed this at some point.
His computer is also functioning slowly and a lot of advertisements are always popping up. There is a virus on this system. Let's try to figure out what this situation is all about.
Step4: Live Capture
We start by sniffing the traffic on the network and we can see the live packets go by like that below.
Take note of the three windows in Wireshark. Each packet is displayed, along with some basic information, in the upper pane. We can view every single bit and byte of the packet headers in the middle pane. The packet contents are displayed in both ASCII and hexadecimal on the bottom window.
Step5: Remote Attempts
The packets are listed in the order that they arrive in the far left column. Now let's examine packet 147. Somewhere on the Internet, we can observe a messenger packet from a gadget. By clicking on it, let's examine this packet in more detail. When we do, its features show up in a white window in the middle.
Nothing occurs since the messenger service is deactivated on this network. By examining the subsequent packet, an ICMP "Destination Unreachable" packet seeking a messenger connection that was returned to the IP, we can confirm it. This behavior is questionable.
Step6: Filter the Traffic
We must filter the traffic because there is so much of it passing by so that we only see the traffic that interests us. Clicking on traffic between 216.49.88.118 reveals that this address is a McAfee antivirus update (see the mention of mcafee.com in the ASCII section at the bottom of the window).
We can filter out this traffic so that it doesn't appear when we examine it because it is not hazardous. In this instance, our goal is to view any traffic that does not originate from the IP address 216.49.88.118. The filter window can be filled using the following filter. The background of the window will become green when the syntax is correct. To exclude an IP address, use the following syntax:
!ip.addr == 216.49.88.118
We have now blocked any traffic from an innocent address from appearing in our view. This makes it easier for us to concentrate on the other, possibly harmful traffic.
We have effectively filtered off the traffic going to and coming from McAfee, as seen in the snapshot below.
Step7: DNS Query
Let's now examine a few packets below. This screenshot demonstrates how the computer of our customer (216.148.227.68) displays a "standard query" to virtumonde.com via the DNS protocol in the second packet. This raises suspicions!
If we scroll down to packet 386, we can see our client's host goes out to the virtumonde.com server and requests a download. When we click on this packet and expand its HTTP protocol in the middle window, we can see "updates.virtumonde.com\r\n."
This is VERY suspicious activity, which suggests that our client's system is most likely reporting back to its home server after becoming infected with spyware or a rootkit.
As we continue to delve into the nuances of hacking and forensics, my budding hackers, don't forget to check back!
Comments
Post a Comment