Author: sherri

Join Us for Black Hat and DEFCON!

Want to tear apart Android cell phone dumps and Blackhole Exploit Kit 2 infection traffic? LMG has been hard at work gearing up for Black Hat and DEFCON. We’ve developed brand new puzzles for you to play with, a shiny new Network Forensics virtual workstation, and lots more. Here’s a quick preview:
Black Hat logo

  • Register for “Network Forensics: Black Hat Release” (4-Day course). Learn the ins and outs of packet analysis, flow record analysis, wireless forensics, intrusion detection and analysis, covert tunneling, malware network behavior– all packed into a dense 4 days with intensive hands-on technical labs.
     
  • Cellular network forensics is here! Don’t miss our cutting edge workshop, “Do-It-Yourself Cellular IDS,” during the Black Hat Briefings.
     
  • LMG is releasing a brand-new Network Forensics Workstation exclusively for students of “Network Forensics: Black Hat Release.” It includes all of the tools you need to solve every case study in the class, plus extra goodies. You can install this customized ISO to a virtual machine, or right on a hard drive.
     
  • We’ve got another AWESOME puzzle contest lined up for DEFCON, which will be publicly released online at the Network Forensics Puzzle Contest web site afterwards. Keep your eyes peeled for all the new packet captures!

See you in Vegas!

Puzzle #10: PaulDotCom Goes Off the Air

Our latest puzzle was created by Eric Fulton, Sherri Davidoff, Jonathan Ham and Scott Fretheim.

“Oh god” is the first thought running through your mind as you crack open the door. An odious wafting of day old vomit, sweat, and stale cigar washes across you as the door moves from cracked to ajar. The room is pitch black, a dirty and exposed hallway light bulb does nothing to cut into the dark abyss of the room. Peering inside you see only shapes, but deep down you know it isn’t going to be pretty.

It’s been three weeks since the PaulDotCom crew went missing. Through extensive research and cyberstalking, millions of PDC fans gathered information relating to their disappearance and hired you to find them. This is John Strand’s safe house, and a quick Google image search was all you needed to know about his seedy life. Who knows what’s in this room? Donning rubber gloves you feel for a light switch with your left hand, both intensely afraid and curious for what you are about to see. Wincing in anticipation you flick the switch with a “click”.

Nothing happens. “Why do I always get the messed up jobs” you whisper to yourself, digging around in your black bag. Corporate espionage isn’t a clean game, but usually the tech jobs involve threatening geeks in suburban houses, not sneaking around what looks to be North Dakotan project housing. Pulling a sleek Pelican flashlight from the bag, you click it on and begin to survey the damage. Starting from the left you identify the location of the puke smell; there’s day old vomit trailing its way down peeling wallpaper toward a box of empty tequila bottles. Smell one located.

Further to the right you spot a human shape on a couch. You freeze with the flashlight beam aimed at the shape. It’s Larry, wrapped in a dirty pink blanket almost too small to cover him, rocking back and forth and muttering something unintelligible. What’s he saying? You suspect it’s key. His fingers are pale as he grips a WRT54G router which appears to have twenty-four overlapping bites taken out of it. Seconds tick by. Nothing happens; he pays no attention to your entry. Smells two and three probably located. Your light continues its sweep as you spot a table hosting two 24” monitors surrounded by miscellaneous cables. Jackpot.

Ignoring the rest of the room you step over martini glasses and other unidentified objects, making a beeline to the desk. The little voice in your head shouts “Damn! Damn! Damn!” There is evidence that someone left only recently. The scene is almost out of a second rate Hollywood movie, being so incredibly obvious:a puddle of spilled cosmopolitan makes apparent the distinct outlines where a laptop and external hard drive once sat.

Disheartened, you rummage though the desk, hopeful of finding a forgotten USB drive or other storage device. No dice. You slide a few sticky quarters off of the desk (it’s not like you’re getting a per-diem) and continue the search– wait. One of the quarters… splits a little. You pick it up and play with it. Viola! A small micro SDHC card lies inside the quarter. Your heart starts beating faster. You have a clue.

As a matter of habit you go through the rest of the room, quietly, as the eerie sound of Larry chanting in the background never stops. Old coffee mugs, a dirty microwave, hundreds of empty frozen food wrappers, and magnetic buckyballs cover the floor like a sort of 21st century urban underbrush…and then you see something peculiar. A stack of hard drives sits in the corner. The top drive looks like someone shot it 7 or 8 times, a strange method for data destruction, but certainly an effective one. Rummaging through the stack of drives you find one at the bottom looking as if it survived the data massacre. Grabbing it, you give one last look around as you walk to the door. The sounds of Larry go from muffled to silent as you shut the door and make your exit.

The Evidence

You are the forensic investigator.The items found in the safe house have been uploaded to this server for your analysis. These include:

  • quarter-SDHC-snippet.dd – A DD image of a the SDHC card found inside the quarter.
  • pcap-from-surviving-hard-drive.pcap – A packet capture that you copied off the surviving hard drive.

Download the 7-zipped evidence file here.

SHA256 sum:
44450915addb8bdbe1766a3fad1c03059393a0f1f01839b19f98f235dc3b97bd

The Adoring Fans’ Questions

Can you solve the puzzle and find out what happened to PaulDotCom? Their adoring legions of fans have asked you to find the answers to the following questions along the way:

1. In his conversation with juniorkeyy, how old does Larry initially say he is?

2. What was the filename of the file that had the following SHA256 sum:

e56931935bc60ac4c994eabd89b003a7ae221d941f1b026b05a7947a48dc9366

3. What is the SHA256sum of the photo from the “dd” image that shows Larry taking a bite out of a wireless router?

4. What is the SHA256sum of the image that shows zombie Larry taking a
bite out of a cat?

5. What is Larry saying as he rocks back and forth? (No spaces or
capital letters.)

6. Where are Paul and John? Report their GPS coordinates:
a) Latitude
b) Longitude

BONUS. What is the name of the nearest bar?

Submission Form

Please submit your answers using the Official Submission Form.
Deadline is 7/23/12 (11:59:59PM UTC-11) (In other words, if it’s still 7/23/12 anywhere in the world, you can submit your entry.)

Prize

The Grand Prize will be a Black Hat “Black Card”! Thanks, Black Hat, for sponsoring such an awesome prize.

There will also be prizes for the first correct submission, as well as the 2nd and 3rd place runner-ups. Stay tuned for more info!

How to Win

The MOST ELEGANT solution wins. In the event of a tie, the entry submitted first will receive the prize. Coding is always encouraged. We love to see well-written, easy-to-use tools which automate even small sections of the evidence recovery. Graphical and command-line tools are all eligible. You are welcome to build upon the work of others, as long as their work has been released under a an approved Open Source License. All responses should be submitted as plain text. Microsoft Word documents, PDFs, etc will NOT be reviewed.

More Details

Feel free to collaborate with other people and discuss ideas back and forth. You can even submit as a team (there will be only one prize). However, please do not publish the answers before the deadline, or you (and your team) will be automatically disqualified. Also, please understand that the contest materials are copyrighted and that we’re offering them publicly for the community to enjoy. You are welcome to publish full solutions after the deadline, but please use proper attributions and link back. If you are interested in using the contest materials for other purposes, just ask first.

Authors agree that their code submissions will be freely published under the GPL license, in order to further the state of network forensics knowledge. Exceptional submissions may be used as examples and tools in the Network Forensics course or book. All authors will receive full credit for their work.

To Recap

Evidence File
Sha256sum: 44450915addb8bdbe1766a3fad1c03059393a0f1f01839b19f98f235dc3b97bd

Deadline is 7/23/12 (11:59:59PM UTC-11). Here’s the Official Submission form. Good luck!!

Copyright 2012, Lake Missoula Group, LLC. All rights reserved.

Puzzle #9: Ann’s Deception (DEFCON 2011)

This year’s DEFCON contest was a huge success, with over 200 teams entering! The contest was split up into six rounds of increasing difficulty. The first team to complete all six rounds won the contest. Now that the contest is over, we’re placing the materials here for folks who would like to play around on their own.

WARNING: This contest contains off-color humor which may not be appropriate for the classroom, children, rodents, etc.

The lead chemist of a high-profile pharmaceutical company was involved in a serious accident, leaving him in a coma days before the release of the company’s highly publicized “133t pill.” The chemist was the only person in possession of the list of ingredients required to produce the wonder drug, and it is not known if he will ever recover. All chemical evidence of the drug has been destroyed, but the company believes that the missing ingredients may have been stored electronically. You have been hired as a forensic investigator, to recover the final ingredient of their 133t pill. Can you find the missing ingredient?

Here’s a link to the encrypted contest volume:
Defcon2011-Contest.tc

SHA256 CHECKSUM:
6906e4a08bd498c6ff78928b1c8d292a9f89f2ecfac60094528f4497e2254474

The Defcon2011-Contest.tc is an encrypted password-protected Truecrypt volume. Inside are six individual Truecrypt archives which each contain a single round of the contest. You will need to mount each encrypted volume using Truecrypt before you can access its contents. Here is a page which shows you how to mount a Truecrypt volume.

At the start time, DEFCON attendees visited the contest booth to obtain the first decryption passwords, provided below:

The password to unlock Defcon2011-Contest.tc is: !#$h1d3&&s33k$#!
The password to unlock round1 is: r0und1g0!!

When a team found the answer to a round, they texted it to Headquarters (HQ). If their answer was correct, staff texted back the key to unlock the next round.

SPOILER ALERT: You can find the keys to each of the encrypted volumes here.

SUPER SPOILER ALERT: For your convenience, we’ve also unlocked all the rounds for those of you who just want to play around with individual round puzzles without having to solve the whole thing in order. You can find the individual round puzzles here:

Round1
Round2
Round3
Round4
Round5
Round6

A few notes:

1. You will not get the correct answer simply by running “strings” on the packet captures. It is more complicated than that.

2. Please do not attempt to brute-force the answer by guessing. We reserve the right to cut you off from submitting answers if you abuse the privilege.

3. There are six contest rounds containing six evidence files. You must analyze the evidence files in order to answer the question(s) which go along with each capture.

Have fun! 🙂


This puzzle was created by Scott Fretheim, Randi Price, Eric Fulton, Sherri Davidoff, and Jonathan Ham (Lake Missoula Group, LLC).

Copyright 2011, Lake Missoula Group, LLC. All rights reserved.

Puzzle #9 Answers

Here are the answers to Puzzle #9: Ann’s Deception (DEFCON 2011):

  1. Round 1 Decryption Key: r0und1g0!!
    In this capture we were looking for the name of the company. This is located inside an email.
    Answer: Factory-Made-Winning-Pharmaceuticals
     
  2. Round 2 Decryption Key: !n1c3?w0rk
    In this capture we were looking for the date of a speech given by Bruce Schneier. To solve this puzzle you must carve out a packet capture which was sent as an email attachment. Inside that packet capture, you can find the data by looking through the web traffic to see the pages Ann viewed.
    Answer: October 6-7, 2011
     
  3. Round 3 Decryption Key:?g3tting!t0ugh
    In this capture we were looking for Romulus’s password. This can be found by carving out the VOIP conversation and listening to it.
    Answer: rom127#
     
  4. Round 4 Decryption Key: m4k1ng?pr0g
    In this packet capture we were looking for the name on the 16th line in a spread sheet. To find the answer, you need to carve out the SMB transfer of the 7zip file containing the credit card file. In order to unlock the 7zip file you will need to use the password YOU found in Round 3.
    Answer: Jason Wilson
     
  5. Round 5 Decryption Key: 0v3r#h4lf?w4y
    In this packet capture, you need to carve out the SMB file transfer of the ingredients list. To unlock the 7zip file containing the ingredients list, you will need to use the password you found in in Round 4.
    Answer:8.4 oz- Red Bull; Tim
     
  6. Round 6 Decryption Key: ch33rs!0n3$m0r3
    Round 6 requires you to find the final ingredient of the 133t pill. To unlock the volume, you must use the cipher along with the previous answers from Rounds 1-5. Begin by solving the cipher, and then use the cipher as the password to unlock the Truecrypt volume.
    Cipher Solution: 00gmu1rt#?
    Answer: 2oz Vodka
  7. Copyright 2011, Lake Missoula Group, LLC. All rights reserved.

Gearing Up for DEFCON 19!

We are totally psyched for DEFCON 19! The Network Forensics Puzzle Contest (NFPC) will be running in the contest area. Watch our DEFCON forum for updates this week. Prizes include a Verizon 3g Network Extender and $150 ThinkGeek gift certificate (many thanks to ThinkGeek for sponsoring that prize).

To whet your appetite even more, check out the hot new graphic on the DEFCON 19 NFPC CD, designed by Mr. Scott Fretheim:

Players can pick up their CDs at the contest booth starting Thursday @ 10:00 AM. The contest will officially start on Friday. (Of course, we’ll post the contest materials online afterwards, too, so everyone can check out the latest challenge, just for fun.

Cheers!

Puzzle #7 Answers

Here is the solution to Puzzle #7: Ann’s Dark Tangent (DEFCON 2010). There are many ways to arrive at the solution. Here is our method; there are other tools you can use to reach the same answer.

You received a CD containing, among other things, a packet capture: evidence-defcon2010.pcap

Check the MD5 sum:

$ md5sum evidence-defcon2010.pcap
7c416421a626600f86e3702df0cac8ef evidence-defcon2010.pcap

If you examine the packet capture, you will see that it contains WEP-encrypted wireless traffic.

Crack the WEP key. You can do this using aircrack-ng in less than one second:

$ aircrack-ng evidence-defcon2010.pcap
Opening evidence-defcon2010.pcap
Read 426642 packets.
# BSSID    ESSID    Encryption
1 00:1C:10:B3:CC:F0 w00t    WEP (98923 IVs)
Choosing first network as target.
Opening evidence-defcon2010.pcap

Once you have the WEP key, use it to decrypt the traffic:

$ airdecap-ng -w 4A:7D:B5:08:CD evidence-defcon2010.pcap
Total number of packets read    426642
Total number of WEP data packets 187650
Total number of WPA data packets 0
Number of plaintext data packets 0
Number of decrypted WEP packets 187650
Number of corrupted WEP packets 0
Number of decrypted WPA packets 0

If you run strings on the packet capture (or view it in Wireshark), you will see IMAP and SMTP traffic, including an email with an attachment. This attachment is the key to the entire puzzle.

Dark Tangent,
I know you've been watching me. You should be able to figure out the =
location of our rendezvous point from my traffic. Contact me first with =
the name of the city where we will meet, and you win :-) I'll send you =
more details after that.=20
Ann
ps. See the attachment for a clue.

Carve out the email attachment. You can do this manually, or use the smtpdump tool by Franck Guénichot from Contest #2.

The email attachment is a GIF image, shown below:

There were five lines in the image, which read (from top to bottom):

App Store - App Name
Podcast Title
YouTube Video Title
Google Earth City Name
AIM Buddy Name

If you go through the packet capture, you will find that Ann used her iPad to:

  • Download the iPad app called “Solitaire”
  • Download and watch an Onion podcast called “Onion Radio News for Kids”
  • View a YouTube video called “Cry for Help – Rick Astley”
  • Search on Google Earth for “Hacker Valley, West Virginia”
  • IM her buddy, “inter0pt1c”

Line all the answers up, as shown in the GIF image, and read down the first column:

  • Solitaire
  • Onion Radio News for Kids
  • Cry for Help
  • Hacker Valley
  • inter0pt1c

The answer is “SOCHI”, a resort town in Russia where the winter Olympics will be held.

Thanks to everyone who played!

Puzzle #7 Winners

Over 221 teams registered to play Puzzle #7: Ann’s Aurora at DEFCON 18 (2010)! Each team was given a CD which contained the evidence, and teams were asked to text the answer to the phone at NFPC Headquarters. The first team to text the correct answer won the contest.

The Winner of Puzzle #7 (and the shiny new iPad) was (drumroll…)

Team Bam Bam!

These guys solved the puzzle after about 5 hours. We also have to give mad props to team Preset Kill Limit, who texted the correct answer just one minute after team Bam Bam. Wow, that was close!

Great job to everyone!

Puzzle #7: Ann’s Dark Tangent (DEFCON 2010)

At long last! Here is a copy of Puzzle #7, “Ann’s Dark Tangent,” which was run at Defcon 18 (2010). This contest was unusual in that the answer was a single word. The contest was open to DEFCON 18 attendees who were at the conference. Although the contest has long since closed, you might enjoy playing around with the packet capture, which contains wireless iPad traffic.

Ann has arranged a rendezvous with Dark Tangent. You are the forensic investigator. Can you figure out their destination?

Here’s a copy of their network traffic:

evidence-defcon2010.pcap
MD5sum: 7c416421a626600f86e3702df0cac8ef

The first team to submit the correct answer wins a brand new Apple iPad.

A few notes:
1. You will not get the correct answer simply by running “strings” on the packet capture. It is more complicated than that.
2. Please do not attempt to brute-force the answer by guessing. We reserve the right to cut you off from submitting answers if you abuse the privilege.

Have fun! 🙂

Puzzle #7 was written by Sherri Davidoff, Eric Fulton and Jonathan Ham.

Copyright 2010, Lake Missoula Group, LLC. All rights reserved.

Defcon 2010

For all those attending DEFCON 2010, we’ll be hosting a puzzle contest starting Friday afternoon in the contest area. It’s a race against time; the first person to complete the puzzle wins a brand-new iPad. We’ll be posting the packet capture here after the contest for those of you who like the intellectual challenge. Contest description below… See you there!

Ann Dercover is on the run, and you’re hot on her trail as she travels around the globe hacking companies, stealing intellectual property, launching 0-day attacks and setting up sneaky backdoors. *You are the forensic investigator.* You’ve got a packet capture of Ann’s network traffic. Can you analyze Ann’s malicious traffic and solve the crime by Sunday? Prize: Win a brand-spanking new Apple iPad!

cheers!
Eric