Incident Response and Forensic Course Disk Image Cataloging Project Concepts and Deliverables

Major Goals Guide implementation of several GenII “Honeywalls” (honeynets) Capture images of compromised systems Enter these (and “clean” images) into a database for retrieval or comparison Implement a client/server in FIRE for loading these images onto systems over the network Implement some integrity checking functions in FIRE to simplify analysis

Honeynet Research Alliance “Pacific Northwest Honeynet Project” (?) Open to UW, SU, ISU (etc?) students Related to this project, but only as much as it benefits the project More hands/eyes to install, monitor, test… Network diversity Honeypot diversity Increased chances of “interesting” activity

Honeynets Locations: UW, SU, ISU networks Using new GenII “Honeywall CD-ROM” Intel PC with three NICs >20GB hard drive 512MB RAM Honeypots will be Windows 2000, Linux One or more honeypots per honeynet Start independent, then centralize logs later

Honeypots Preparation Entire drive written with zeros (no residue) Partitions as small as possible (minimize footprint in database and network transfer time) partitions on each drive Operating System “live” partition Image copy of OS (not mounted) Swap partition (if OS requires one) MD5 hash both OS partitions before going “live” (to verify integrity) MD5 hash all blocks (to find changes faster) [Automate using database & client/server]

Database Index on useful attributes OS type (e.g., Windows, Linux) OS version (e.g., Win2k, RH7.2) Services enabled Partitions used Partition sizes MD5/SHA1 hashes of partitions MD5/SHA1 hashes of blocks on OS partition Status (e.g., Clean, Compromised) Etc…

Front end Runs on custom FIRE CD User interface to database Client/server to manage bits on disk Upload bits on disk to database Hash partitions/blocks, gather attributes, etc. Chose image, prep drive, load Chose image, compare with bits on disk (detect changes since install)

Use in Forensic Course Lab Student boots lab system using custom FIRE CD Chooses which compromised system to analyze Bits loaded to disk, verified Student performs analysis, answers specific questions (which are compared with analysis in database) Repeat…

Use by Honeynet Alliance group Do once for each unique honeypot Zero drive Install/configure OS and services Reboot w/custom FIRE CD Hash partitions/blocks while loading into database From then on… Boot w/ custom FIRE CD Chose honeypot to clone Go get coffee/tea/Jolt while honeypot is cloned

Resources “The Use of Honeynets to Detect Exploited Systems Across Large Enterprise Networks” honeynet.pdf honeynet.pdf