Lost in Security (and mostly everything else)

SANS Holiday Hack Challenge – Part II

December 28, 2015 December 28, 2015Challenges

So continuing from my original post about the SANS 2015 Hack Challenge, here is my quick write up about exercise two. Exercise 2 ========== > What operating system and CPU type are used in the Gnome? What type of web framework is the Gnome web interface built in? – System – DISTRIB_ID=’OpenWrt’ – DISTRIB_RELEASE=’Bleeding Edge’ – DISTRIB_REVISION=’r47650′ – DISTRIB_CODENAME=’designated_driver’ – DISTRIB_TARGET=’realview/generic’ – DISTRIB_DESCRIPTION=’OpenWrt Designated Driver r47650′ – DISTRIB_TAINTS=” – CPU: ARM version 1 (SYSV) – Gnome web framework: Looks to be node.js > What kind of a database engine is used to support the Gnome web interface? What is the plaintext password…

SANS Holiday Hack Challenge – Part I

December 23, 2015 December 28, 2015Challenges, Packet Analysis

I figured that I would try and attempt to do the annual SANS Holiday Hack Challenge this year while things were slow at work (knock on wood). So after working on this for 2-3 days, I have managed to knock out the first of the questions: 1) Which commands are sent across the Gnome’s command-and-control channel? 2) What image appears in the photo the Gnome sent across the channel from the Dosis home? The way I got the answers for this first set of problems was not “creative” by any stretch of the imagination. If anything it was just manually…

Damn Malicious Word docs – Part 2

December 20, 2015 February 23, 2016Packet Analysis

So with the push of the Christmas season upon me and my family, it has taken some time to get back to this. So with that being said, I have come back to it only to find out that the malicious word doc is not working fully at the present time – most likely since the compromised server is no longer up/has been fixed. But here is the little bit that I got from running the word doc. After running the malicious word doc within my test VM, I could see a call being made to an IP address of…

Damn Malicious Word docs – Part 1

December 11, 2015 February 23, 2016Packet Analysis

So the purpose of this post is because I could not remember how to extract the script from a malicious Word document. Damn old age and lack of coffee! Like anyone in a SOC role, you most likely get a lot of emails sent to you (or your distro) for odd/weird/humorous emails that people are not sure about. It is up to you and the team in the SOC to figure out if the email is malicious or not. So yesterday someone sent in an email from someone else saying that they would like to work for the company and…

Malware Exercise 2015-11-24 Goofus and Gallant

December 9, 2015 February 23, 2016Packet Analysis

So this one has a great comical backstory – how the user (ironically from the SOC) Tom brought his personal laptop in and managed to get his system infected while looking for a shotgun to go hunting with. Outside of making me and one of my co-workers laugh at the scenario (and then another one asking if this could be based on a real event – lol), there is one thing that I learned from this and it was from reading the answers. Brad explains how he went about finding the start of the infection chain from working backwards using…

Malware Exercise 2015-11-06 Email Roulette

November 15, 2015 February 23, 2016Packet Analysis

So here is my write-up of the latest malware exercise from Brad. Needless to say, his description of the event that lead up to the infection is hilarious. Another great exercise to say the least. As usual, if you spot something off or something that I could improve on, drop me a comment below. Summary of the Investigation ============================== – Date and time of the activity. > 2015-11-06 @ 16:22 – The infected computer’s IP address. > 10.3.66.103 – The infected computer’s MAC address. > Dell 00:24:e8:2d:90:81 – The infected computer’s host name. > STROUT-PC – Domains and IP addresses…

Malware Exercise 2015-10-28 Midge Figgins Infected Her Computer

November 5, 2015 February 23, 2016Packet Analysis

So here is the latest one from Brad – another good exercise to say the least! One thing to note about this one is that I had some issues extracting objects from the PCAP using Wireshark. In those cases I was able to use Captipper to extract out the HTTP object. Also, I am re-organizing my Github so the individual files from the different labs can be downloaded individually and not as one huge download. **Update 06/11/2015 – So after reading Malware Kiwi’s blog post with his results, and talking to some of the guys at work that did the…

Malware Exercise 2015-10-13 – Halloween-Themed Host Names

October 22, 2015 February 23, 2016Packet Analysis

Just posting my write-up of another one of Brad’s exercises. You can find the answers to this exercise from Brad here. The other interesting bit that I came across while researching different aspects from this exercise was another researcher that had worked on the same one as well. Check out his blog here, or his Twitter feed here. Here are my results from this exercise. – Date and time of the activity. > User1 = 10.12.2015 18:55 – 19:10 > User2 = 10.12.2015 23:30 – 23:39 – The infected computer’s IP address. > User1 = 10.0.15.202 > User2 = 172.16.95.97…

Malware Exercise from ThreatGlass (2015-09-20 www.koreatimes.com)

October 16, 2015 February 23, 2016Packet Analysis

So while waiting for Brad to come up with his next exercise, I figured that I would do some lab work “independently” while I waited. So I went over to Threatglass to see what I could find there. This one stood out to me being half-Korean and all so I figured that I would try my hand at it. The one that I used is from the Korea Times website. There you can find the PCAP and the screenshots that Threatglass posts. One thing that I wanted to note here is my lack of knowledge and understanding around how to…

Malware Exercise 2015-09-11 – A Bridge Too Far Enterprises

September 29, 2015 February 23, 2016Packet Analysis

So I am a little late with this one as I just could not find the mental capacity to finish this one on time due to a head cold that turned into a sinus infection (which I am still fighting). Based on what Brad had said about this one, it was one of his more “tricky” exercises and some of the other analysts seem to confirm that as well. With that being said, I seem to get the gist of it pretty quickly. The thing that threw me off was the fact that I did not see the traffic hitting…