Challenge 4 - VoIP - (provided by Ben Reardon from the Australian and Sjur Eivind Usken from Norwegian Chapter) takes you into the world of voice communications on the Internet. VoIP with SIP is becoming the de-facto standard for voice communication on the Internet. As this technology becomes more common, malicious parties have more opportunities and stronger motives to take control of these systems to conduct nefarious activities. This Challenge is designed to examine and explore some of attributes of the SIP and RTP protocols. Enjoy the challenge.

Challenge 3 - Banking Troubles - (provided by Josh Smith and Matt Cote from The Rochester Institute of Technology Chapter, Angelo Dell’Aera from the Italian Chapter and Nicolas Collery from the Singapore Chapter) is to investigate a memory image of an infected virtual machine.

The challenge has been completed on May 12th 2010. Skill Level: Difficult

The Challenge:

Company X has contacted you to perform forensics work on a recent incident that occurred. One of their employees had received an email from a fellow co-worker that pointed to a PDF file. Upon opening, the employee did not seem to notice anything, however recently they have had unusual activity in their bank account. Company X was able to obtain a memory image of the employee’s virtual machine upon suspected infection. Company X wishes you to analyze the virtual memory and report on any suspected activities found. Questions can be found below to help in the formal report for the investigation.

Challenge 2 - browsers under attack - (provided by Nicolas Collery from the Singapore Chapter and Guillaume Arcas from the French Chapter) is to investigate a network attack but of a different kind.

Skill Level: Intermediate

The Challenge:

A network trace with attack data is provided. (Note that the IP address of the victim has been changed to hide the true location.) Analyze and answer the following questions:

1. List the protocols found in the capture. What protocol do you think the attack is/are based on? (2pts)
2. List IPs, hosts names / domain names. What can you tell about it - extrapolate? What to deduce from the setup? Does it look like real situations? (4pts)
3. List all the web pages. List those visited containing suspect and possibly malicious javascript and who’s is connecting to it? Briefly describe the nature of the malicious web pages (6pts)
4. Can you sketch an overview of the general actions performed by the attacker? (2pts)
5. What steps are taken to slow the analysis down? (2pts)
6. Provide the javascripts from the pages identified in the previous question. Decode/deobfuscate them too. (8pts)
7. On the malicious URLs at what do you think the variable ’s’ refers to? List the differences. (2pts)
8. Which operating system was targeted by the attacks? Which software? And which vulnerabilities? Could the attacks been prevented? (4pts)
9. What actions does the shellcodes perform? Please list the shellcodes (+md5 of the binaries). What’s the difference between them? (8pts)
10. Was there malware involved? What is the purpose of the malware(s)? (We are not looking for a detailed malware analysis for this challenge) (4pts)

Sample Solution:
Forensic Challenge 2010_-_Challenge_2_-_Solution.doc - Sha1: d60270743b8aea425bab74041b776d7fef36f0af

Forensic Challenge 2010

Challenge 1 - pcap attack trace - (provided by Tillmann Werner from the Giraffe Chapter) is to investigate a network attack.

Skill Level: Intermediate

The Challenge:

A network trace with attack data is provided. (Note that the IP address of the victim has been changed to hide the true location.) Analyze and answer the following questions:

1. Which systems (i.e. IP addresses) are involved? (2pts)

2. What can you find out about the attacking host (e.g., where is it located)? (2pts)