Sans Holiday Challenge Essay

2315 words - 10 pages

1. Introduction

The aim of this paper to analyze a packet capture file with various tools and answer the questions provided. SANS have released the Holiday Hacking Challenge packet capture for the last ten years. It's run as a competition for people all around the world. The packet capture is quite challenging and will test the skills of the network analyzer to the limit. The tools that will be used to analyze the packet capture are: Wireshark, Ngrep, Foremost, and Network Miner.

2. Filter by Protocols

The packet capture is quite verbose and can be intimidating to know where to begin, or what methodology to use. The first protocol filtered was POP3 for email communication. The filter ...view middle of the document...

The email details that
A significant vulnerability in the Allen Bradley controller we are testing was just disclosed. This vulnerability may be a reason behind the power bridge outage. Don Sawyer deletes the message and downloads the exe file. This is still unclear so more investigation is needed. This information may prove useful at a later stage.
(See Figure 2.4 below).

Figure 2.4. Email about controller vulnerability.

Hyper Text Transfer Protocol (HTTP) is a high layer protocol that any investigator would use to filter a packet capture file. The packet capture revealed two PDF files of interest on packet numbers 16 and 54.

The packet at number 16 showed a PDF file with the heading 'TrafficSystemNetworkMap', and the packet at number 54 showed a PDF with the heading 'BedfordFallsTrainSystem'. (See Figure 2.5 below).

Figure 2.5. PDF details.

A 'Follow TCP Stream' of the traffic system and train system revealed pdf files encoded using flatdecode. The files were unreadable so a decoder was searched for to decode the files.
(See Figure 2.6 below).

Figure 2.6. PDF with Flatedecode.

Numerous attempts to decode the pdf proved fruitless, so other methods were used.

2.2. Decode Flatdecode PDF files.

A forensic carving tool like Foremost can be used to try to recover the pdf files.
The command to extract the files is :
# foremost -t gif -o RecoveredFiles -i /root/ForensicsAss3/sansholidayhack2013.
The first pdf file recovered show details of the Bedford Falls Transport System Network Map.
(See Figure 2.2-1).
Figure 2.2-1. Bedford Traffic Map PDF.
The pdf contains details of four street corner addresses and of a Traffic Grid Controller PLC. The traffic grid controller and the four street corners have IP addresses associated with them. The IP addresses can be used to filter the packet capture, which helps with large files.

The second pdf file recovered show details of the Bedford Falls Train Switching System Network Components.
(See Figure 2.2-2).

Figure 2.2-2. Bedford Train Switching PDF.

The pdf contains IP addresses associated with the Train Management Workstation and the Simatic S7-1200 PLC. The Simatic S7-1200 PLC was previously mentioned in an email sent from the head of security George Bailey to Don Sawyer. A fault with the Simatic appears to have caused the bridge to out. This may have been an unsuccessful attack Mr. Potter's goons attempted against Bedford Falls infrastructure. More investigation is needed to confirm this.

3. Carve out further information

Foremost can be used to extract more files from the packet capture. Instead of selecting specific types of information a full carving is performed which groups files into defined directories.
# foremost -o RecFiles -i /root/ForensicsAss3/sansholidayhack2013.
Foremost extracted an exe file that was shown in Figure 2.3 above, the exe file could not be opened. The htm directory contains information about the Cyber City Water Monitoring & Alarm...

Find Another Essay On SANS Holiday Challenge

Psychological Egoism Theory Essay

2240 words - 9 pages The theory of psychological egoism is indeed plausible. The meaning of plausible in the context of this paper refers to the validity or the conceivability of the theory in question, to explain the nature and motivation of human behavior (Hinman, 2007). Human actions are motivated by the satisfaction obtained after completing a task that they are involved in. For example, Mother Teresa was satisfied by her benevolent actions and

How Celtic Folkore has Influenced My Family

1587 words - 6 pages Every family has a unique background that influences the way they live and interact with other people. My parents, who emigrated from Ireland to the States with my three brothers in 1989, brought over their own Celtic folklore and traditions that have helped shaped the way our family operates and lives. One aspect of folklore that has helped shape my family dynamic is the Celtic cross—both its background and what role it has played in our lives

Julia Margaret Cameron

1406 words - 6 pages At a time when women were looked upon as being homemakers, wives, mothers and such the late 1850's presented a change in pace for one woman in specific. Photography was discovered in 1826 and soon after the phenomenon of photography was being experimented with and in turn brought new and different ways of photo taking not only as documenting real time, but also conceptualizing a scene in which an image would be taken. Julia Margaret Cameron will

Evaluation of School Improvement

1403 words - 6 pages The evaluation process should be progressive to incorporate overall planning, implement changes, which contribute to success. In order to focus on school climate and norms, the evaluation design must include the students, instructions, and outcomes to improve communication and building-level concerns to be address in this response. School Climate and Social Norms The school principal, other staff leaders, and personnel set the tone and the

Case Study: The Benefits of Animal Testing

1757 words - 7 pages Nine year old Amy has already had a rough start in life. She was born with an abnormal heart that hinders her everyday activities. Amy is unable to keep up with kids her own age because she often tires out easily. As a consequence, she has very little friends and is often alone. Amy is forced to take different medications everyday just to survive. Amy’s life consists of medicine, doctors, and constant hospital visits. However, Amy is due for a

Myth and Magic: Realism in "One Hundred Years of Solitude"

1531 words - 6 pages “He enjoyed his grandmother's unique way of telling stories. No matter how fantastic or improbable her statements, she always delivered them as if they were the irrefutable truth” (Wikipedia, 2011). Experiences are particular instances of one personally encountering or undergoing something and in these moments of time life changes for the best or the worst and memories are formed. These recollections such as riding your first bicycle, going to

Adiponectin: a Novel Indicator of Malnutrition and Inflammation in Hemodialysis Patients

2384 words - 10 pages Objective Protein-Energy malnutrition (PEM) and inflammation are common and overlapping conditions in hemodialysis patients which are associated with increased risk of morbidity and mortality. Adiponectin is an adipocytokine which is exclusively produced by adipose tissue. Few studies in hemodialysis patients have demonstrated that serum levels of adiponectin were significantly higher in malnourished patients compared to well-nourished ones. The

The Congo Free State: A Legacy of Apathy, Exploitation and Brutality

2298 words - 9 pages Between 1885 and 1908, Belgium’s Leopold II ruled Congo, a region in central Africa, as his personal colony, exploiting the resources and inhabitants for his own gain. Leopold allowed and encouraged Europeans and other Westerners to enter Congo and set up companies whose primary purpose was to gather rubber, which was abundant but difficult to get to in the Congo, using the Congolese as the laborers for the Europeans. Rubber gathering in Congo

Selective Exposition in The Lottery, by Shirley Jackson

1073 words - 4 pages Usually when someone hears the word “lottery” the first thing that comes to mind is a large sum of cash that people compete against highly impractical odds to win. Shirley Jackson’s story The Lottery might imply a similar conception based on the title alone, but the story is filled with unknowns never revealing exactly when and where the story takes place, or why the lottery exists; even what the lottery is isn’t revealed until the very end. Yet


1857 words - 7 pages INTRODUCTION I remember when I was a young child; I would always be scared whenever there was a severe storm outside that included thunder and lightning. This was especially true in the hours of darkness, when you could really see the lightning. As I grew older this so-called fear of lightning turned into a fascination for this weather phenomena. One of my most vivid memories of lightning as a young man was when I was flying to Florida, the

Maryland's Ecology and Environment

1130 words - 5 pages Maryland is the 42nd largest state, making it one of the smaller states in America. It is located in the South Atlantic region on the United States eastern seaboard. Prince George's is one of twenty four counties in Maryland. It is also the geographic center of the state. Maryland has a varied climate. The state is home to a variety of different ecosystems. This is also true of Maryland’s environment, which has the Atlantic Ocean on

Similar Essays

When The Bubble Burst Essay

1539 words - 6 pages By the time I arrived state side from my second tour in the Middle East the housing bubble had already burst. I noticed a drastic change in the way that many of my friends and family were living. Several of my friends that worked in real estate had sold their boats and seconds houses. My own stock portfolio had lost a third of its value. My sister and her husband had defaulted on their home mortgage leaving them scrambling for a place to live. I

Phase Diagram Essay

4456 words - 18 pages Introduction: Chemical equilibrium is a crucial topic in Chemistry. To represent and model equilibrium, the thermodynamic concept of Free energy is usually used. For a multi-component system the Gibbs free energy is a function of Pressure, Temperature and quantity (mass, moles) of each component. If one of these parameters is changed, a state change to a more energetically favorable state will occur. This state has the lowest free energy

Revolutionary Work Of Art Essay

1890 words - 8 pages Walter Benjamin emphasizes in his essay, “The Work of Art in the Age of its Technological Reproducibility” that technology used to make an artwork has changed the way it was received, and its “aura”. Aura represents the originality and authenticity of a work of art that has not been reproduced. The Sistine Chapel in the Vatican is an example of a work that has been and truly a beacon of art. It has brought a benefit and enlightenment to the art

Enlightenment Thought In New Zealand Schools

1594 words - 6 pages In this essay I will be looking at how the political and intellectual ideas of the enlightenment have shaped New Zealand Education. I will also be discussing the perennial tension of local control versus central control of education, and how this has been affected by the political and intellectual ideas of the enlightenment. The enlightenment was an intellectual movement, which beginnings of were marked by the Glorious Revolution in Britain