Forensic Challenge 7 - Submission deadline passed

05 Apr 2011 Angelo Dellaera challenge forensic-challenge
Folks the submission deadline for the Forensic Challenge 7 – “Forensic Analysis of a Compromised System” - put up by Hugo Gonzalez from the Mexico Chapter and Guillaume Arcas from the French Chapter - has passed. We have received 16 submissions and will be announcing results on Friday, Apr 29th 2011. The winners will get a copy of the book “Virtual Honeypots - From Botnet Tracking to Intrusion Detection” written by Niels Provos and Thorsten Holz.

Forensic Challange 7 - Only 5 days left!

26 Mar 2011 Christian Seifert challenge forensic-challenge
Folks, challenge 7 - forensic analysis of a compromised server - put up by Hugo Gonzalez from the Mexico Chapter and Guillaume Arcas from the French Chapter is in full swing. Submissions are due by March 31st, so if you want to participate, you have 5 days left. We award little prizes for the top three submissions! Hope to see your submission. Christian

Forensic Challenge 2010/6 - Analyzing Malicious Portable Destructive Files - The winners are ...

24 Dec 2010 Christian Seifert challenge forensic-challenge
Folks, holiday greetings from forensic challenge headquarter in Seattle. Mahmud and Ahmad from the Malaysian Chapter have judged all submissions and results have been posted on the challenge web site. The winners are: Vos from Russia with perfect score! Codrut from Romania Mike from Canada Congratulations! We received a total of 21 submissions and they were very competitive. The top three submissions came within a point of a perfect score and Vos from Russia actually received a perfect score.

Project Honeynet “Log Mysteries” Challenge Lessons

10 Nov 2010 Anton Chuvakin challenge lessons-learned
We just finished grading the results of Project Honeynet “Log Mysteries” Challenge #5 and there are some useful lessons for BOTH future challenge respondents and to log analysts and incident investigators everywhere. If you look at the challenge at high level, things seem straightforward: a bunch of log data (not that much data, mind you – only 1.14MB compressed) from a Linux system. You can squeak by even if you use manual analysis and simple scripting.

取证分析挑战 6 - 分析恶意编码 PDF 档案

01 Nov 2010 Roland Cheung challenge forensic-challenges malware pdf simplified-chinese
取证分析挑战 6:分析恶意编码 PDF 档案 - (由来自马来西亚分支的Mahmud Ab Rahman和Ahmad Azizan Idris提供) 利用含恶意编码 PDF档案进行的典型攻击。 请在2010年11月30日星期二之前在 https://www.honeynet.org/challenge2010/ 透过我们的表格 (请使用 [MS word解答范本](/files/[your%20email]_Forensic%20Challenge%202010%20-%20Challenge%206%20-%20Submission%20Template - Simplified Chinese.doc) 或 [Open Office解答范本](/files/[your%20email]_Forensic%20Challenge%202010%20-%20Challenge%206%20-%20Submission%20Template - Simplified Chinese.odt)) 提交您的挑战解答。结果约在12月的第三个星期公布。) 难度等级:中级 欢迎透过下列链接访问:英文版内容 挑战内容: PDF 格式是在线文件交换的业界标准 (de facto standard)。由于它的普及性,因此亦吸引了罪犯利用它来向信任的使用者传播恶意程序。在很多攻击工具中已经包含了建立恶意编码 PDF档案的功能来散播恶意程序。如果使用者对开启 PDF 档案缺乏警觉性,恶意编码 PDF档案会是一个颇成功的攻击手段。 在网络封包记录 lala.pcap 内藏有关于一个典型的恶意编码 PDF档案。这个封包记录了一个使用者开启了一个已被入侵的网页,然后被重新转向去下载一个恶意编码 PDF档案。当浏览器内的PDF插件开启PDF时,没有安装修补程序的Adobe Acrobat Reader会被攻击,结果在使用者的计算机上无声无色地下载并安装恶意程序。 在这次事故中包含了多少个 URL 路径?请列出找到的URL 路径。(1分) 在PCAP档案内,你能找到什么程序代码?请解释这些程序代码做了什么。 (2分) 在PCAP档案内,你能找到什么档案吗?若找到任何档案,请利用zip密码保护(密码:infected)的压缩档案方式,将档案命名为:[your email]_Forensic Challenge 2010 – Challenge 6 – Extracted Files.zip并提交到https://www.honeynet.org/challenge2010/。 在PDF档案内包含多少个对象?(1分) 请利用PDF 字典及对象参考详细解释PDF档案的流程结构。(1分) 有多少个过滤机制应用在对象串流,它们是什么?请解释你如何将串流解压。 哪个对象串流可能藏有恶意编码内容?请列出该对象及解释所使用的隐匿技术 (obfuscation technique(s))。(3分) 在PDF档案内包含了什么攻击?哪一个攻击能成功执行并触发漏洞?请在答案上提供一些相应的解释。 (4分) 在PDF档案内包含了什么负载 (payloads)?如果有,请列出及解释它们做了什么,那些负载(payload)会被执行?(2分) 对于PDF 格式结构的理解,请解释在开启 PDF 档案时,我们能如何启动其它攻击 (2分) 奖励分:

鑑識分析挑戰 6:分析惡意編碼 PDF 檔案

01 Nov 2010 Roland Cheung challenge forensic-challenges hong-kong malware pdf traditional-chinese
鑑識分析挑戰 6:分析惡意編碼 PDF 檔案 - (由來自馬來西亞團隊的Mahmud Ab Rahman和Ahmad Azizan Idris提供) 利用含惡意編碼 PDF檔案進行的典型攻擊。 請在2010年11月30日星期二之前在 https://www.honeynet.org/challenge2010/ 透過我們的表格 (請使用 [MS word解答範本](/files/[your%20email]_Forensic%20Challenge%202010%20-%20Challenge%206%20-%20Submission%20Template - Traditional Chinese.doc) 或 [Open Office解答範本](/files/[your%20email]_Forensic%20Challenge%202010%20-%20Challenge%206%20-%20Submission%20Template - Traditional Chinese.odt)) 提交您的挑戰解答。結果約在12月的第三個星期公佈。) 難度等級:中級 歡迎透過下列鏈結訪問:英文版內容 挑戰內容: PDF 格式是在線文件交換的業界標準 (de facto standard)。由於它的普及性,因此亦吸引了罪犯利用它來向信任的使用者傳播惡意程式。在很多攻擊工具中已經包含了建立惡意編碼 PDF檔案的功能來散播惡意程式。如果使用者對開啟 PDF 檔案缺乏警覺性,惡意編碼 PDF檔案會是一個頗成功的攻擊手段。 在網路封包記錄 lala.pcap 內藏有關於一個典型的惡意編碼 PDF檔案。這個封包記錄了一個使用者開啟了一個已被入侵的網頁,然後被重新轉向去下載一個惡意編碼 PDF檔案。當瀏覽器內的PDF插件開啟PDF時,沒有安裝修補程式的Adobe Acrobat Reader會被攻擊,結果在使用者的電腦上無聲無色地下載並安裝惡意程式。 在這次事故中包含了多少個 URL 路徑?請列出找到的URL 路徑。(1分) 在PCAP檔案內,你能找到什麼程式碼?請解釋這些程式碼做了什麼。 (2分) 在PCAP檔案內,你能找到什麼檔案嗎?若找到任何檔案,請利用zip密碼保護(密碼:infected)的壓縮檔案方式,將檔案命名為:[your email]_Forensic Challenge 2010 – Challenge 6 – Extracted Files.zip並提交到https://www.honeynet.org/challenge2010/。 在PDF檔案內包含多少個物件?(1分) 請利用PDF 字典及物件參考詳細解釋PDF檔案的流程結構。(1分) 有多少個過濾機制應用在物件串流,它們是什麼?請解釋你如何將串流解壓。 哪個物件串流可能藏有惡意編碼內容?請列出該物件及解釋所使用的隱匿技術 (obfuscation technique(s))。(3分) 在PDF檔案內包含了什麼攻擊?哪一個攻擊能成功執行並觸發漏洞?請在答案上提供一些相應的解釋。 (4分) 在PDF檔案內包含了什麼負載 (payloads)?如果有,請列出及解釋它們做了什麼,那些負載(payload)會被執行?(2分) 對於PDF 格式結構的理解,請解釋在開啟 PDF 檔案時,我們能如何啟動其他攻擊 (2分) 獎勵分:

Forensic Challenge 2010/5 - Log Mysteries - just a few days left to submit your solution

28 Sep 2010 Christian Seifert challenge forensic-challenge
The deadline for the Forensic Challenge 2010/5 - Log Mysteries is quickly approaching. It seems like this challenge is a hard nut to crack as we only received a few submissions so far. If you like a challenge, give it a try. The deadline is September 30th 2010. You can access the challenge at https://honeynet.org/challenges/2010_5_log_mysteries. Did I mention there are prizes?

The winners of the 4th Forensic Challenge 2010 VoIP are ...

24 Jul 2010 Christian Seifert challenge forensic-challenge
The 4th Forensic Challenge on VoIP has come to an end. We had a total of 21 submissions with several submissions from Chinese speakers which has been made possible by Julia, Jianwei and Roland from the Chinese speaking chapters. The winners of the 4th Forensic Challenge 2010 VoIP are: Franck Guenichot (France) Fabio Panigatti (Italy) Shaun Zinck (USA) We have posted their submissions onto the challenge web site so you can see what top notch submissions they provided.

Forensic Challenge 2010/4 - VoIP - 4 days left!

26 Jun 2010 Christian Seifert challenge forensic-challenge
Folks, the submission deadline for our Forensic Challenge 4 - VoIP is quickly approaching. The deadline is this Wednesday and so you have another 4 days to submit your solution. The challenge is quite different than our previous challenges. It was provided by Ben Reardon from the Australian and Sjur Eivind Usken from Norwegian Chapter - and takes you into the realm of voice communication on the Internet. Thanks to our Chinese speaking chapters, it is also available in simplified Chinese and traditional Chinese.