David Dittrich, coordinator for the Forensic Challenge, outlines a contest that pits the best efforts by the blackhat community against anyone in the security community who wishes to accept it.
Every day, incident handlers across the globe are faced
with compromised systems, running some set of unknown programs, providing
some kind of unintended service to an intruder who has taken control of
someone else's -- YOUR, or your client's, or customer's -- computers. To
most, the response is a matter of "get it back online ASAP and be done with
it." This usually leads to an inadequate and ineffective response, not even
knowing what hit you, with a high probability of repeated compromise.
Enter the Honeynet Project. One of the primary goals of the Honeynet
Project is to find order in chaos by letting the attackers do their thing,
and allowing the defenders to learn from the experience and improve. The
latest challenge, inspired by the Honeynet Project's founder Lance Spitzner,
is the Forensic Challenge. Only this time, we're opening it up to anyone
who wants to join in.
On the law enforcement side, they are hampered by a flood of incidents and
a lack of good data. A victim trying to keep a system running or doing a
"quickie" job of cleanup usually means incidents are underreported and
inadequate handling of the evidence leads to no evidence, or tainted
evidence. There has to be a better way to meet the needs of incident
handlers and system administrators, as well as law enforcement, if Internet
crime is going to be managed and not run amok. One possible answer is
effective forensic analysis skills -- widespread knowledge of tools and
techniques -- to preserve data, analyze it, and produce meaningful reports
and damage estimates to your organization's management, to other incident
response teams and system administrators, and to law enforcement.
The Challenge
The Forensic Challenge is an effort to allow incident
handlers around the world to all look at the same data -- an image
reproduction of the same compromised system -- and to see who can dig the
most out of that system and communicate what they've found in a concise
manner. This is a nonscientific study of tools, techniques, and procedures
applied to postcompromise incident handling. The challenge is to have fun,
to solve a common real world problem, and for everyone to learn from the
process. If what I've said already isn't enough to get you interested,
Foundstone is generously offering copies of their extremely popular "Hacking
Exposed" (Second Edition) book for the 20 best submissions.
To get you started, here are the basic facts about the compromise.
Please be aware that these are new images. This is
not a system that the Honeynet Project has previously written about
or discussed publically. (I.e., you won't get any hints from previous
Honeynet papers.)
The images were edited to anonymize the system. Only the hostname was
modified. Everyone is using the same data, so any anomalies caused by this
editing will be identical. You can find the "dd" format disc images at:
http://honeynet.linuxsecurity.com/download/
The image files can be mounted on Linux systems using the loopback interface
like this: # mkdir /t
# mount -o ro,loop,nodev,noexec honeypot.hda8.dd /t
# mount -o ro,loop,nodev,noexec honeypot.hda1.dd /t/boot
[ etc... ]
Its now your job -- should you choose to accept it! --
to figure out the Who, What, Where, When, How, and maybe even the Why of
this compromise. We don't expect that everyone undertaking the challenge
can or will address all of the following items, but the list below of
questions and deliverables is provided as a guideline for what to produce and what to focus on.
To summarize (and standardize) the deliverables, please produce the
following:
File Contents
---------------------------------------------------------------------
index.txt Index of files/directories submitted
(including any not listed below)
timestamp.txt Timestamp of MD5 checksums of all files
listed and submitted (dating when produced
-- see deadline information below)
costs.txt Incident cost-estimate
evidence.txt Time line and detailed (technical) analysis.
(Use an Appendix, and/or mark answers to
questions above with "[Q1]", etc.)
summary.txt Management and media (non-technical) summary
advisory.txt Advisory for consumption by other system
administrators and incident handlers within
your organization
files.tar Any other files produced during analysis and/or
excerpts (e.g., strings output or
dissassembly listings) from files on the
compromised file system, which are referenced in
the previous files
The Rules
- You are free to use any tools or techniques that you choose, provided
that the judges are able to readily interpret your results and duplicate
or verify their accuracy using publicly available means (i.e., don't
expect us all to have a copy of your favorite "Law Enforcement Only" or
multi-hundred dollar commercial Windows-only tool). A good publicly
available free forensic toolkit is Dan Farmer and Wietse Venema's
The
Coroner's Toolkit (TCT). If you want examples of the use of TCT, or
other tools/techniques, see the Forensics section of the following web page:
http://staff.washington.edu/dittrich/
No matter what tools/methods you choose, please make sure you explain them
in your analysis and cite references to resources (e.g., RFCs, CERT or
SANS "how to" documents) to help others learn by example. Don't forget:
this is a Honeynet Project brainchild, so learning is what it's all about.
And fun. It's all about learning and fun. Oh yeah, and security.
Learning, fun, AND security. ;)
- You may work in as a team, but if your entry is selected as a Top 20,
you'll have to fight over one copy of the book.
- Deliver the results of the analysis in such a way that the judges can
quickly and easily consume the information, and such that its authenticity,
time of production, and integrity can be verified independently. (e.g.,
ISO 9660 CD-ROM or .tar archive, with digital time stamps, and
PGP signatures and/or MD5 checksums.)
Please DO NOT SEND COPIES OF COMPLETE FILES FROM THE FILE SYSTEM. We
already have a copy of the file system and its contents. Just note the
path (e.g., "[See file /bin/foo]").
- All submissions MUST be time stamped prior to 00:00 GMT on
Monday, February 19, 2001, and delivery to the judges initiated later that
same day. (This is to accommodate submissions on IS0 9660 format CD-ROM,
which should be postmarked by this time. The digital time stamps and
postmarks will be used to determine the 20 "Hacking Exposed" book winners.)
One free digital time stamping service you can use is
Stamper
.
- All submissions should be sent (or shipping address arranged, if CD-ROMs
are being produced) to challenge@honeynet.org.
- The person who hacked the box is NOT eligible, nor are members of the
Honeynet Project. Members of the companies employing Honeynet Project
members are eligible (and encouraged!) to enter, but their entries (even
if Top 20) will not receive copies of "Hacking Exposed." The books go to
other entrants.
- Entries must be written in English (UK and Aussie English accepted, but
go light on the regional slang, please! I only have a copy of "Best of
Aussie Slang," and the other judges don't live in Seattle.)
- Only one entry per household, please. Must be sentient to enter. Sorry,
no Ginsu Knives come with this offer!
Submissions will be judged by a panel of experts and a winner selected and
announced on Monday, March 19, 2001. All decisions of the judges are final
(no recounts or legal challenges by teams of grossly overpaid lawyers will
be tolerated!).
After the winners are announced, all entries will be posted for the
security community to review. We hope that the community can better learn
from and improve from all the different techniques that different people and
organizations use.
Also, we wouldn't be the Honeynet Project if we didn't capture all of the
blackhat's keystrokes as he exploited, accessed, and modified the honeypot!
We will release the Honeypot Project's analysis of the hacked system, as
well as the blackhat's keystrokes, along with the results of the Challenge
on March 19.
Good luck, and have fun!
Dave Dittrich
(Thanks to Lance Spitzner, members of the Honeynet Project,
Dan Farmer, Wietse Venema, SecurityFocus.com, linuxsecurity.com, Foundstone,
Ali Ritter, and anyone else who helped develop or support the Forensic
Challenge whose name I may have left out.)
Only registered users can write comments.
Please login or register. Powered by AkoComment! |
