Investigating Network

Intrusions

Eoghan Casey
eoghan.casey@yale.edu
Yale University
 Outline
• Overview of Forensic Science
• Basic Computer Intrusions
– Password theft
– Intellectual Property (IP) theft
• Large Scale Network Intrusions
– Correlating logs
– Network compromise
– Internet tracking
 Forensic Science Overview
• Science exercised on behalf of the law
• Locard’s exchange principle
• Recognition
– not as easy as it sounds
• Collection, documentation & preservation
– authenticity and reliability
• Crime reconstruction (forensic analysis)
– when, where, how, what, who, why
 Reconstruction & Analysis
• Low level analysis versus interpreted data
• Temporal reconstruction (timeline)
• Relational and functional reconstruction
• Risk assessment
• Motive and intent
• Corroborating data on network
Interpreted data is necessary but confirm findings
Advanced Forensic Analysis
• Networked PCs
• Servers
• Network devices
• Network traffic
• Wireless systems
• Embedded systems
 Basic Computer Intrusions
• Confirm report & assess damage
• Collect/preserve most volatile evidence first
• Document everything
– pay special attention to system clock offsets
• Analyze/reconstruct events
– assess target risk
– determine intruder motive, intent, and skill
– locate collateral victims
– perform research when necessary
Network Overview
 Case #1: Password Theft
• Individual’s password was repeatedly stolen
– Every day he would change his password
– Every day the intruder had the new password
– Was our primary server compromised?
– No, our server appeared to be intact
• Reconstruction of victim’s activities
– Victim only used his work system
– Monitored traffic to and from this system
– Nothing unusual
 Password Theft (part 2)
• Individual’s password was still being stolen
– Second interview: victim also used home PC
– “But nobody else uses my home PC”
• Monitor traffic when victim dials in
– Capture traffic for one dial-up account (not all)
– tacacs-action and tcpdump
– Carnivore with RADIUS trigger
 Password Theft (haha!)
• Network traffic showed connection from UK dial-up to home PC

09:24 userbf38.aol.uk.uudial.com.1391 > dialup03.its.yale.edu.1982

0000: 4500 002f 9fd9 4000 7406 a606 3e7d 0c2f E../..@.t...>}./
0010: 8284 f3b8 056f 07be 0340 c236 0003 ef1b .....o...@.6....
0020: 5018 2395 b25c 0000 5057 4468 6168 61 P.#..\..PWDhaha

09:24 dialup03.its.yale.edu.1982 > userbf38.aol.uk.uudial.com.1391

0000: 4500 006d d800 4000 7e06 63a1 8284 f3b8 E..m..@.~.c.....
0010: 3e7d 0c2f 07be 056f 0003 ef1b 0340 c23d >}./...o.....@.=
0020: 5018 2179 6089 0000 636f 6e6e 6563 7465 P.!y`...connecte
0030: 642e 2030 393a d. 09:
 Password Theft (server side)
• Network traffic showed connection from UK to our main server

09:25 server.yale.edu.telnet > userbf38.aol.uk.uudial.com.2231

0000: 4510 0034 f6e2 4000 fe06 28a8 8284 8ff8 E..4..@...(.....
0010: 3e7d 0c2f 0017 08b7 3d2d f4d9 06bf f9fb >}./....=-......
0020: 5018 faf0 2744 0000 0d0a 5061 7373 776f P...'D....Passwo
0030: 7264 3a20 rd:

• Corresponding login on server:

user pts/41 userbf38.aol.uk. Wed Jun 14 09:21 - 09:21 (00:00)

• Note: server was approximately 5 minutes behind sniffer

 Password Theft (lessons)
• Rely on evidence not interviews
• tcpdump
– only captures first 68 bytes of packet by default
– output is difficult to read (review)
• Use focused capture
– limits risk of privacy invasion
– reduces chance of packet loss
– less irrelevant data to sort through
• Beware of temporal discrepancies
 Case #2: Intellectual Property
• IDS logs show intrusion

[**] FTP-site-exec [**]

09/14-12:27: 208.181.151.231 -> 130.132.x.y
09/14-12:28: 24.11.120.215 -> 130.132.x.y
09/14-12:33: 64.28.102.2 -> 130.132.x.y

• Concern: system contains sensitive data

IP theft (confirm/assess damage)
• Initial examination of compromised host
showed no signs of compromise
– no wtmp entries from site exec exploit
– no syslog entries
– no unusual processes using ps or files using ls
• System clock was 5 hours fast (∆t = 5hrs)
• Oddities on system suggested compromise
– difference between ps & lsof; /tmp/.tmp/
 IP theft (preservation & analysis)
• Used EnCase to preserve/analyze evidence
• Recovered deleted syslogs (noting ∆t)
Sep 14 17:07:22 host ftpd[617]: FTP session closed
Sep 15 00:21:54 host ftpd[622]: ANONYMOUS FTP LOGIN FROM
231.efinityonline.com [208.181.151.231],

1À1Û1É°FÍ 1À1ÛC
‰ÙA°?Í ëk^1À1É ^^AˆF^Df¹ÿ^A°'Í 1À ^^A°=Í 1À1Û ^^H‰C^B
1ÉþÉ1À ^^H°^LÍ þÉuó1ÀˆF^I ^^H°=Í þ^N°0þȈF^D1ÀˆF^G‰v^H
‰F^L‰ó N^H V^L°^KÍ 1À1Û°^AÍ è ÿÿÿ0bin0sh1..11
Sep 14 17:22:54 host inetd[448]: pid 622: exit status 1
EnCase (preservation & analyze)
 IP theft (crime reconstruction)
• Confirmed source of initial intrusion
• Determined that target was high risk
• Determined motive and intent
– not aware of sensitive information on host
– used host for DoS, scanning, and IRC
• Determined that a sniffer had been used
• Located other compromised systems
– notified system owners on outside networks
 Intrusion (research - t0rnkit)
• Intruder used a rootkit called t0rn
– replaces system binaries to conceal presence
– creates backdoors to allow future access
– patches the FTP site exec vulnerability
– replaces SSH daemon (/usr/info/.t0rn)
• /usr/src/.puta/t0rnsniff
• See CERT Incident Note 2000-10
 Intrusion (lessons)
• IDS is necessary but not sufficient
• Rootkits are becoming more sophisticated
• Cannot trust a compromised system
• EnCase is necessary but not sufficient
• Need to restore system to fully analyze it
• Research can lead to useful resources
• Understand the intruders (skill, motive, etc.)
• Beware of temporal discrepancies
Large Scale Network Compromise
• Recognition
– many potential sources of digital evidence
• Collection, preservation & documentation
– varies widely depending on circumstances
– remote collection
– observe intruder(s)
• Analysis & reconstruction
– correlating multiple independent sources
 Finding Evidence on Networks
• Internet
– Web, newsgroups, chat
• Log files
– server (e.g. e-mail, Web, dial-up server)
– correlate with logs on clients
• User information (e.g. finger, nbtstat, who)
• State tables (e.g. netstat, arp, show conn)
– network devices are a challenge
• Network traffic (e.g. NetFlow & tcpdump)
 Collect, Preserve, Document
• Proactive evidence gathering
– NFR, Shadow, Dragon, NetFlow
• Remote/dynamic collection
– print screens, video, log keystrokes
• Document evidence
– MD5, digital signatures, encryption
• Are the system times & logs reliable?
– know and test systems
– www.counterpane.com
 Tracking Offenders
• Locate source
– logs, state tables, finger, nbtstat, etc.
• Contact source ISP (e.g. logs, ANI)
• Search Internet for rough edges
• Observe offender on Internet (e.g. IRC)
 The Coroner’s Toolkit
• Lazarus
– Bitstream copy like dd
– Attempts to categorize data
• Grave Robber
– MACtime database
– Gather host info, processes, and select files
– Calculate MD5 of important system files
– Save open files using icat
 Case #3: Correlating Logs
• Logs show only one suspicious connection at
22:50 from 62-30-247-138-do.blueyonder.co.uk
/var/log/secure:
Apr 24 22:50:34 target in.ftpd[2103]: connect from 62.30.247.138

/var/log/messages:
Apr 24 22:48:15 target inetd[25739]: login/tcp: bind: Address already in use
Apr 25 02:50:40 target ftpd[2103]: ANONYMOUS FTP LOGIN FROM pc-
62-30-247-138-do.blueyonder.co.uk [62.30.247.138], guest@here.com
Apr 25 02:50:40 target ftpd[2103]: FTP session closed
Apr 24 22:58:15 target inetd[25739]: login/tcp: bind: Address already in use

/var/log/wtmp:
ftp ftp pc-62-30-247-138-do.blueyonder.co.uk [62.30.247.138] Tue Apr 24
22:50 - 22:50 (00:00)
 Correlating Logs (IDS)
• IDS logs do not show intrusion at 22:50
• IDS logs show intrusion from Italy (62-
122-10-221.flat.galactica.it) hours later
[**] FTP-site-exec [**]
04/25-02:48:45.012306 62.122.10.221:4158 -> 192.168.1.34:21
TCP TTL:46 TOS:0x0 ID:20194 IpLen:20 DgmLen:468 DF
***AP*** Seq: 0x11A6920B Ack: 0xD567116C Win: 0x3EBC
TCP Options (3) => NOP NOP TS: 98258650 1405239787
 Correlating Logs (NetFlow)
• FTP scans from UK and Taiwan
• Intrusion on April 25 at 02:47:12 (Italy)
• NetFlow shows two connections from target
– Downloaded RPM to fix vulnerability
– Connected to www.xoom.it

srcaddr|dstaddr|src_as|dst_as|input|output|srcport|dstport|protocol|pkts|octets|flows
192.168.1.34|18.29.1.70|0|0|4|17|2382|20|TCP-FTP|61|3180|1
192.168.1.34|18.29.1.70|0|0|4|17|2381|21|TCP-FTP|14|855|1
192.168.1.34|206.132.163.187|0|0|4|17|2383|80|TCP-WWW|94|1204|1
 Case #4: Network Compromise
• External complaint about compromised host
• Internal report of another compromised host
• CERT team members examined machines
– confirmed reports & assessed damage
– determined source and method of attack
• CMSD vulnerability exploited
• Stolen dial-up account used to launch attack
• Backdoors and sniffers installed on all hosts
 Network Compromise (cont.)
• Located other compromised systems
– scanned network for known backdoors
– received additional reports from sys admins
• Collected evidence remotely (40+ systems)
• Documented collection process and results
– script to monitor keystrokes
– digitally signed each evidence file
• Performed basic analysis and reconstruction
 Network Compromise (live)
• Observed intruder returning to crime scenes
• Recorded unauthorized access (sniffer log)
• Telneted to one machine with intruder
– gathered corroborating evidence (telnet log)
– shutdown and seized the machine
• Documented collection process and results
• Called source ISP to gather evidence (ANI)
 Network Compromise (analysis)
• Analyzed evidence in more detail
– remembered similar M.O. to past intrusion
– compared cases and found many similarities
• Performed basic reconstruction of events
• Compiled reports for law enforcement
• Monitored IRC for intruder
• Seized suspect’s computer
 Network Compromise (lessons)
• Be swift, thorough, and lucky
• Multiple independent sources of evidence
• Dial-up account used versus ANI
• Reports for law enforcement and attorneys
– misread IP address
– incident summary
– reconstruction summary
– full documentation and evidence inventory
– provide search tips for forensic examiners (hash files)
 Case #4: Internet Tracking
• Compromised Windows 98 machines
– Back Orifice and IRC bot
– Intruders left voluminous chat logs
– Subsequent credit card fraud
• Monitoring IRC led to group of intruders
• Focused on primary intruder
– Many personal details in logs, including name
– Net search & finger linked her with intrusions
 Internet Tracking (particulars)
• finger username@primenet.com host
– leads to dial-up connection

% finger username@usr07.primenet.com (206.165.6.207) ...

Login: username Name: First Last
Directory: /user/u/username Shell: /bin/bash
Mailbox last read: Tue Oct 24 12:31:24 2000
Currently logged in via 208-50-51 49.nas2.fhu.primenet.com
% finger @208-50-51-49.nas2.fhu.primenet.com (208.50.51.49) ...

if your name is xxxxxx xxxxxxx, you're a explicatives removed.

also: www.domainname.net
 Internet Tracking (particulars)
• Web site registered to intruder
– Whois gives home address and phone number
• IRC chat encounter reveals personal info
– use online undercover identity
• Collect evidence while you can
– chat logs, finger results, and even Web sites
• Temporal discrepancies
– Sam spade time stamp earlier than finger results
 Digital Evidence Challenges
• Getting the evidence
– distribution of crime scenes
– volume of data (needle in haystack)
– investigators require technical expertise
– legal barriers (jurisdiction, admissibility)
– evidence dynamics
• Connecting computer activity to individual
• Preserving probity of digital evidence
– case database
– evidence locker
 Best Practices
• Be prepared with procedures and tools
– proactive evidence gathering
– do not rely entirely on one tool
– document everything & maintain chain
– always perform a full analysis (do not skip steps)
– seek multiple independent sources of evidence
– rely on evidence when making conclusions
• Computer clocks are critically important
• Forensic analysis includes human behavior
– build understanding of intruders (motives, skill)
– know your audience when writing reports