Section 3.2 Network Forensics TRACKING HACKERS THROUGH CYBERSPACE CASE STUDY : ANN’S RENDEZVOUS

THE MISSION The case: After being released on bail, Ann Dercover disappears! Fortunately, investigators were carefully monitoring her network activity before she skipped town. “We believe Ann may have communicated with her secret lover, Mr. X, before she left,” says the police chief. “The packet capture may contain clues to her whereabouts.” Challenge: You are the forensic investigator. Your mission is to analyze the packet capture and gather information about Ann’s activities and plans. The following questions will help guide your investigation: Provide any online aliases or addresses and corresponding account credentials that may be used by the suspect under investigation. Who did Ann communicate with? Provide a list of addresses and any other identifying information. Extract any transcripts of Ann’s conversations and present them to investigators. If Ann transferred or received any files of interest, recover them. Are there any indications of Ann’s physical whereabouts? If so, provide supporting evidence.

THE MISSION CONTINUED Network: Internal network: /24 DMZ: /24 The “Internet”: /24 [Note that for the purposes of this case study, we are treating the /24 subnet as “the Internet.” In real life, this is a reserved nonroutable IP address space.] Evidence: Investigators provide you with a packet capture from Ann’s home network, “evidence-packet-analysis.pcap.” They also inform you that in the course of their monitoring, they have found that Ann’s laptop has the MAC address 00:21:70:4D:4F:AE. Pg. 135

ANALYSIS: PROTOCOL SUMMARY Begin by taking a high-level look at the packet Wireshark > Statistics > Protocol Hierarchy Notice the presence of “Bootstrap Protocol” Used for DHCP request and response

DHCP TRAFFIC Examine using Wireshark Display Filter “eth.addr == 00:21:70:4d:4f:ae and bootp Wireshark automatically looks up the registered OUI, “00:21:70,” and displays the corresponding manufacturer, Dell. Can be verified using IEEE Request address is Host name matches Ann Router DNS

DHCP CONTINUED Router DNS Renewal Time Value of 30 minutes

KEYWORD SEARCH Matches seven packets Three contain a conversation with TCP port 587 (SMTP) Four contain a conversation with TCP port 143 (IMAP)

EXAMINE SMTP Use Wireshark’s “Follow TCP Stream” to isolate packets beginning with 2011/05/17 13:33:

EXAMINATION CONTINUED Notice Ann’s authentication is in plain text: Her credentials are only Base-64-encoded, not encrypted Take note of the sender and receiver: Look at the body of the Next look at the SMTP packet 2011/05/17 13:34: User: Receiver:

EXAMINATION CONTINUED AGAIN Examination of the third packet matching SMTP using command line Look at the content from (Ann’s computer) to remote server We are interested in the outbound content reconstruction Notice the From: ID, the To: ID and the body of the As the message suggests there is an attachment

SMTP ANALYSIS – ATTACHMENT FILE CARVING $ bless Cut the SMTP and MIME protocol information Attachment of greatest interest is labeled Start carving After set of 0x0D & 0x0A CRLF Carriage-return/linefeed Finish carving Just before the second set Save file as “evidence-packet-analysis-smtp3-attachment”

ATTACHMENT FILE CARVING CONTINUED We need to remove the line breaks before decoding the Base64 encoding Use “fromdos” which is part of the “tofrodos” Debian package $ fromdos -b evidence -packet -analysis -smtp3 –attachment Decode $ base64 -d evidence -packet -analysis -smtp3 -attachment > secretrendezvous.docx Check file type $ file secretrendezvous.docx secretrendezvous.docx: Zip archive data, at least v2.0 to extract Make cryptographic checksums

VIEW THE ATTACHMENT Always work with a copy

MORE CARVING Lets carve the image out of the.docx file Start by unzipping the file Notice the.png file Take the cryptographic checksum View a copy of the image

FINDING ANN THE EASY WAY Use NetworkMiner

EASY WAY CONTINUED “NetworkMiner automatically parses headers and displays them along with the body of each SMTP message. It can also show other types of messages, such as IMs.” Pg 151 “The “Files” tab displays files that NetworkMiner automatically carved out of the packet capture.” Pg 151

SMTPDUMP Use smtpdump to: analyze SMTP flow #3 in the packet capture (-f 3) extract attachments (-x) print the MD5sum (-m) print authentication data (-A)

DOCXTRACT Use docxtract to: extract all images from the carved.docx attachment (-x -i) print the corresponding cryptographic checksum (-m)

FINDSMTPINFO.PY Can be used to : Print SMTP authentication information Extract all messages from the packet capture Extract all attachments from the messages Print the MD5 sums for each of the attachments Extract the files embedded within the.docx file Print the MD5 sums for each of the embedded files Produces reports suitable for professional forensic reports Pg. 152

FINDSMTPINFO.PY CONTINUED Example:

FINDSMTPINFO.PY CONTINUED AGAIN Tool will: automatically unzip attached.docx file Extract embedded files MD5sums

TIMELINE All times listed below occurred on May 17, :32: —Packet capture begins 13:32: —First DHCP Request from 00:21:70:4d:4f:ae (Ann’s computer) 13:32: —DHCP ACK from to Ann’s computer, assigning 00:21:70:4d:4f:ae the IP address with a 1-hour lease time. 13:33: :33: —First SMTP conversation. sent from Ann’s computer with sender and recipient 13:34: :34: —Second SMTP conversation. sent from Ann’s computer with sender and recipient 13:35: :35: —Third SMTP conversation. sent from Ann’s computer with sender and recipient 13:35: —Packet capture ends Pg 154

THE CASE THEORY Ann Dercover connected her laptop (“ann-laptop”) to the network on May 17, 2011, at 13:32:03. Her computer was probably manufactured by Dell. At 13:33:05, Ann sent from her AOL account, to asking the recipient, “Hey, can you hook me up quick with that fake passport you were talking about?” At 13:34:15, Ann sent from her AOL account, to informing the recipient, “Sorry—I can’t do lunch next week after all. Heading out of town. Another time!” At 13:35:15, Ann sent from her AOL account, to aol.com, with the message, “Hi sweetheart! Bring your fake passport and a bathing suit. Address attached. love, Ann.” The had a.docx attachment that contained an address and a map. Pg 155

CHALLENGE QUESTION RESPONSES Provide any online aliases or addresses and corresponding account credentials that may be used by the suspect under investigation. Based on our SMTP analysis, there are indications that Ann Dercover uses the address and that her password is “s00pers3kr1t.” Who did Ann communicate with? Provide a list of addresses and any other identifying information. We have seen that sent s to the following recipients:

RESPONSES CONTINUED Extract any transcripts of Ann’s conversations and present them to investigators. Here is a quick summary of Ann’s conversations, sent via SMTP: SMTP Message #1 Sender: Recipient: Date [beginning of SMTP conversation]: May 17, :33:05 Subject: need a favor Message [formatting removed]: Hey, can you hook me up quick with that fake passport you were talking about? - Ann Attachments of interest: None Pg. 155

RESPONSES CONTINUED AGAIN SMTP Message #2 Sender: Recipient: Date [beginning of SMTP conversation]: May 17, :34:15 Subject: lunch next week Message [formatting removed]: Sorry—I can’t do lunch next week after all. Heading out of town. Another time! - Ann Attachments of interest: None SMTP Message #3 Sender: Recipient: Date [beginning of SMTP conversation]: May 17, :35:15 Subject: rendezvous Message [formatting removed]: Hi sweetheart! Bring your fake passport and a bathing suit. Address attached. love, Ann Attachments of interest: secretrendezvous.docx Pg. 156

AND AGAIN If Ann transferred or received any files of interest, recover them. We recovered one Office Open XML Document (.docx) file, attached to Ann’s to The MD5 checksum of the.docx file was: 9049b6d9e26fe878680eb3f28d72d1d2 The SHA256 checksum was: 24601c174587be4ddfff0b9e6d598618c6abfcfadb16f7dd6dbd7a24aed6fec8 The document began with the text, “Meet me at the fountain near the rendezvous point. Address below. I’m bringing all the cash.” This was followed by a PNG image of a map with an address. Pg 156

AND AGAIN Are there any indications of Ann’s physical whereabouts? If so, provide supporting evidence. The document that Ann sent to indicates that she would like to meet him at the following address: Playa del Carmen 1 Av Constituyentes 1 Calle 10 x la 5ta Avenida Playa del Carmen, 77780, Mexico Of course, there is no guarantee that Ann and/or the recipient ever traveled to this location. Perhaps Ann was trying to throw us off her trail! Pg 156

THE NEXT STEP Conduct further analysis on the packet capture to see if there are more s, web traffic, etc. If there is sufficient evidence, a warrant might be in order to monitor Ann’s account and / or open her account using her credentials and investigate her past activity.

Works Cited Davidoff, S., & Ham, J. (2012). Network Forensics Tracking Hackers Through Cyberspace. Boston: Prentice Hall. Disclaimer: All information and data pulled directly from this book. Pages