Forensic Challenge 2010/6 - Analyzing Malicious Portable Destructive Files - The winners are ...

24 Dec 2010 Christian Seifert challenge forensic-challenge
Folks, holiday greetings from forensic challenge headquarter in Seattle. Mahmud and Ahmad from the Malaysian Chapter have judged all submissions and results have been posted on the challenge web site. The winners are: Vos from Russia with perfect score! Codrut from Romania Mike from Canada Congratulations! We received a total of 21 submissions and they were very competitive. The top three submissions came within a point of a perfect score and Vos from Russia actually received a perfect score.

TaiWan Malware Analysis Net

20 Dec 2010 Yi Lang Tsai malware taiwan twman
Basically, The TWMAN is an automated behavioral malware analysis environment to analyze the malware targeted at Microsoft Windows, and it can develop a free and open source software, and the environment is built around Joe Stewart’s TRUMAN sandnet. Although, there are many services of analysis malware behavioral, such as the Norman Sandbox, CWSandbox, Threat Expert, etc. For privacy and policy reasons, it must be treated as if they contain personally identifiable information.

Another possible way to intercept function calls in QEMU

02 Dec 2010 Chengyu Song qemu hook
I’m developing a syscall interception tool for Android as a course’s project. While it is relatively simple to intercept calling into the system services (introduced at the end), it is harder to get the syscall return. The reason is, the latest Android emulator is build upon QEMU 0.10.50, meaning it’s TCG based. So we cannot use the same way Qebek or TEMU uses to intercept the syscall return. Therefore I looked into the new code to find if I could find a way to solve this problem.

Announcing the publication of Know Your Tools: Glastopf - A dynamic, low-interaction web application honeypot

15 Nov 2010 Christian Seifert Lukas Rist kye kyt paper publication
Folks, I am very pleased to announce the publication of our Know Your Tools paper: Glastopf - A dynamic, low-interaction web application honeypot authored by Lukas Rist of the Chicago Honeynet Project Chaper and Sven Vetsch, Marcel Kossin, and Michael Mauer. The paper is available from https://honeynet.org/papers/KYT_glastopf. Paper abstract Currently, attacks against web applications make up more than 60% of the total number of attempted attacks on the Internet. Organizations cannot afford to allow their websites be compromised, as this can result in serving malicious content to customers, or leaking customer’s data.

Project Honeynet “Log Mysteries” Challenge Lessons

10 Nov 2010 Anton Chuvakin challenge lessons-learned
We just finished grading the results of Project Honeynet “Log Mysteries” Challenge #5 and there are some useful lessons for BOTH future challenge respondents and to log analysts and incident investigators everywhere. If you look at the challenge at high level, things seem straightforward: a bunch of log data (not that much data, mind you – only 1.14MB compressed) from a Linux system. You can squeak by even if you use manual analysis and simple scripting.

Know Your Tools: Qebek - Conceal the Monitoring has been published

05 Nov 2010 Jianwei Zhuge gsoc kye kyt white-paper
Christian Seifert (CPRO of The Honeynet Project) has just announced publication of our Know Your Tools series: Qebek - Conceal the Monitoring, authored by Chengyu Song and Jianwei Zhuge from the Chinese Chapter and Brian Hay from the Alaskan Chapter. The paper is based on Chengyu’s hard work during the GSoC 2009, Brian Hay and me acted as his mentors for the Qebek GSoC Project. Congrats to Chengyu and Chinese Chapter.

Announcing the publication of Know Your Tools: Qebek - Conceal the Monitoring

03 Nov 2010 Christian Seifert kye kyt qebek
I am very pleased to announce another publication of our Know Your Tools series: Qebek - Conceal the Monitoring authored by Chengyu Song and Jianwei Zhuge from the Chinese Chapter and Brian Hay from the Alaskan Chapter. The paper is available from https://honeynet.org/papers/KYT_qebek. Paper abstract For the last few years, while low-interaction (LI) honeypot systems like Nepenthes and PHoneyC are getting more and more powerful, the progress of high-interaction (HI) honeypot technology has been somewhat slower.

取证分析挑战 6 - 分析恶意编码 PDF 档案

01 Nov 2010 Roland Cheung challenge forensic-challenges malware pdf simplified-chinese
取证分析挑战 6:分析恶意编码 PDF 档案 - (由来自马来西亚分支的Mahmud Ab Rahman和Ahmad Azizan Idris提供) 利用含恶意编码 PDF档案进行的典型攻击。 请在2010年11月30日星期二之前在 https://www.honeynet.org/challenge2010/ 透过我们的表格 (请使用 [MS word解答范本](/files/[your%20email]_Forensic%20Challenge%202010%20-%20Challenge%206%20-%20Submission%20Template - Simplified Chinese.doc) 或 [Open Office解答范本](/files/[your%20email]_Forensic%20Challenge%202010%20-%20Challenge%206%20-%20Submission%20Template - Simplified Chinese.odt)) 提交您的挑战解答。结果约在12月的第三个星期公布。) 难度等级:中级 欢迎透过下列链接访问:英文版内容 挑战内容: PDF 格式是在线文件交换的业界标准 (de facto standard)。由于它的普及性,因此亦吸引了罪犯利用它来向信任的使用者传播恶意程序。在很多攻击工具中已经包含了建立恶意编码 PDF档案的功能来散播恶意程序。如果使用者对开启 PDF 档案缺乏警觉性,恶意编码 PDF档案会是一个颇成功的攻击手段。 在网络封包记录 lala.pcap 内藏有关于一个典型的恶意编码 PDF档案。这个封包记录了一个使用者开启了一个已被入侵的网页,然后被重新转向去下载一个恶意编码 PDF档案。当浏览器内的PDF插件开启PDF时,没有安装修补程序的Adobe Acrobat Reader会被攻击,结果在使用者的计算机上无声无色地下载并安装恶意程序。 在这次事故中包含了多少个 URL 路径?请列出找到的URL 路径。(1分) 在PCAP档案内,你能找到什么程序代码?请解释这些程序代码做了什么。 (2分) 在PCAP档案内,你能找到什么档案吗?若找到任何档案,请利用zip密码保护(密码:infected)的压缩档案方式,将档案命名为:[your email]_Forensic Challenge 2010 – Challenge 6 – Extracted Files.zip并提交到https://www.honeynet.org/challenge2010/。 在PDF档案内包含多少个对象?(1分) 请利用PDF 字典及对象参考详细解释PDF档案的流程结构。(1分) 有多少个过滤机制应用在对象串流,它们是什么?请解释你如何将串流解压。 哪个对象串流可能藏有恶意编码内容?请列出该对象及解释所使用的隐匿技术 (obfuscation technique(s))。(3分) 在PDF档案内包含了什么攻击?哪一个攻击能成功执行并触发漏洞?请在答案上提供一些相应的解释。 (4分) 在PDF档案内包含了什么负载 (payloads)?如果有,请列出及解释它们做了什么,那些负载(payload)会被执行?(2分) 对于PDF 格式结构的理解,请解释在开启 PDF 档案时,我们能如何启动其它攻击 (2分) 奖励分:

鑑識分析挑戰 6:分析惡意編碼 PDF 檔案

01 Nov 2010 Roland Cheung challenge forensic-challenges hong-kong malware pdf traditional-chinese
鑑識分析挑戰 6:分析惡意編碼 PDF 檔案 - (由來自馬來西亞團隊的Mahmud Ab Rahman和Ahmad Azizan Idris提供) 利用含惡意編碼 PDF檔案進行的典型攻擊。 請在2010年11月30日星期二之前在 https://www.honeynet.org/challenge2010/ 透過我們的表格 (請使用 [MS word解答範本](/files/[your%20email]_Forensic%20Challenge%202010%20-%20Challenge%206%20-%20Submission%20Template - Traditional Chinese.doc) 或 [Open Office解答範本](/files/[your%20email]_Forensic%20Challenge%202010%20-%20Challenge%206%20-%20Submission%20Template - Traditional Chinese.odt)) 提交您的挑戰解答。結果約在12月的第三個星期公佈。) 難度等級:中級 歡迎透過下列鏈結訪問:英文版內容 挑戰內容: PDF 格式是在線文件交換的業界標準 (de facto standard)。由於它的普及性,因此亦吸引了罪犯利用它來向信任的使用者傳播惡意程式。在很多攻擊工具中已經包含了建立惡意編碼 PDF檔案的功能來散播惡意程式。如果使用者對開啟 PDF 檔案缺乏警覺性,惡意編碼 PDF檔案會是一個頗成功的攻擊手段。 在網路封包記錄 lala.pcap 內藏有關於一個典型的惡意編碼 PDF檔案。這個封包記錄了一個使用者開啟了一個已被入侵的網頁,然後被重新轉向去下載一個惡意編碼 PDF檔案。當瀏覽器內的PDF插件開啟PDF時,沒有安裝修補程式的Adobe Acrobat Reader會被攻擊,結果在使用者的電腦上無聲無色地下載並安裝惡意程式。 在這次事故中包含了多少個 URL 路徑?請列出找到的URL 路徑。(1分) 在PCAP檔案內,你能找到什麼程式碼?請解釋這些程式碼做了什麼。 (2分) 在PCAP檔案內,你能找到什麼檔案嗎?若找到任何檔案,請利用zip密碼保護(密碼:infected)的壓縮檔案方式,將檔案命名為:[your email]_Forensic Challenge 2010 – Challenge 6 – Extracted Files.zip並提交到https://www.honeynet.org/challenge2010/。 在PDF檔案內包含多少個物件?(1分) 請利用PDF 字典及物件參考詳細解釋PDF檔案的流程結構。(1分) 有多少個過濾機制應用在物件串流,它們是什麼?請解釋你如何將串流解壓。 哪個物件串流可能藏有惡意編碼內容?請列出該物件及解釋所使用的隱匿技術 (obfuscation technique(s))。(3分) 在PDF檔案內包含了什麼攻擊?哪一個攻擊能成功執行並觸發漏洞?請在答案上提供一些相應的解釋。 (4分) 在PDF檔案內包含了什麼負載 (payloads)?如果有,請列出及解釋它們做了什麼,那些負載(payload)會被執行?(2分) 對於PDF 格式結構的理解,請解釋在開啟 PDF 檔案時,我們能如何啟動其他攻擊 (2分) 獎勵分:

GlastopfNG release

15 Oct 2010 Lukas Rist glastopf glastopng web-honeypot
Before we are getting worse than Duke Nukem Forever, we decided to finally release the next generation of the web application honeypot Glastopf, aka GlastopfNG! Today we find web applications in every environment independent of company size and even in home networks. Over web attack vectors like SQL Injections and Remote File Inclusions, criminals can overtake web servers which than become part of a botnet or even a command and control server.