abhi shelat

Project 5: Forensics

This project is due at 11:59pm on Saturday, April 4, 2019.

Description and Deliverables

In this project, you will play the role of digital forensic analyst. You will be given a bootable disk image that was captured from a server that may-or-may-not have been hacked and infected with malware. Your job is to traces the attacker’s footsteps from the origin of the breach, all the way to their ultimate payload.

To receive full credit for this project, first open this Google doc here, and select File->Make a copy to copy the document under your own account. Write your answers in the designated lines of that template, export to PDF, and then upload your PDF answers to gradescope in “Project 5”.

Please follow the exact format in the template; your answer to each question should fit into one line. Do this to assist our grading.

Brief Introduction to Digital Forensics

Digital forensics is the art of investigating computer systems to identify and isolate evidence. Forensics has applications to law enforcement as well as compromise triage more generally. In the former case, law enforcement officers must follow strict protocols governing electronic evidence to maintain the “chain of custody” of any evidence that is obtained so that it is admissable in court. This often involves the use of specialized digital forensics equipment that has been certified for use in law enforcement contexts. In the latter case, the goal of triage is typically to determine how an attacker broke into a system, what they did while they had access, determining whether the attacker still has access (e.g. did they plant a backdoor or rootkit?), and ultimately disinfecting the system so that the attacker no longer poses a threat. You will engage in this latter task, i.e. triaging a compromised system.

Getting Started

In this project, you will play the role of a digital security expert who has been asked to forensically analyze a disk image that was captured from a compromised server. This server, owned and maintained by an employee of Happy Funtime Plastic Co., hosted a simple website that allowed people to upload and view images. However, the owner of the server began to notice strange behavior on the server, so they shut it down, cloned the hard drive to an image file, and sent the image to you for analysis. The disk image can be downloaded here:

  • Server Image (warning: this file is 3 gigabytes, it may take a few minutes to download)

In most cases, digital forensic analysts would use tools that statically analyze a disk image, i.e. the analyst would analyze the files in the image without actually booting into the image’s operating system, as this might disturb evidence. However, in this project you may simply boot into the image using VirtualBox or VMWare Player, then log in and begin your analysis. To do this in VirtualBox, open the VirtualBox software, click Import, and then select the server_image.ova file that you downloaded. You can try to leave all the import settings to their default values; however on a MacOS machine, if the screen looks garbled, you may need to add video memory and select the VMSVGA display driver. After VirtualBox has imported the image, you will see a Project 6 VM (even though this is Project 5 for us) that is available in the left-hand menu in VirtualBox. Start it and wait for it to boot. The client was kind enough to make a user account for you to use to analyze the system: the username is forensics and the password is sparkbear. Note that the forensics account has sudo privileges, so you will have full access to the system. The sudo password is the same as the account login password. Once you are logged in you can begin your analysis.

Note that while this assignment simulates a server that has been hacked and infected with malware, it is perfectly safe. Booting into this system is not a security risk to you or your host operating system.

Questions

These questions are the same as the ones in the template, but we have some extra instructions here.

  1. What was the name of the malicious script uploaded to the web server?

    As noted above, the primary purpose of this server was to host a photo sharing website for employees of HFPC. You can access this website by opening Firefox (or any other browser) in the virtual machine and visiting http://localhost. As you will see, this website allows people to upload pictures, and those pictures then appear on the site. The site is not very well engineered and it often doesn’t work.

    The HFPC employee who maintained this server believes that the attacker somehow broke into the server through this website, but is unsure how. Thus, you should begin your investigation here.

    The web server uses the standard Apache web server software package. The configuration files for the Apache software are located in /etc/apache2/, and the files that compromise the website itself are located in /var/www/html/. Apache logs all incoming HTTP requests in the file /var/log/apache2/access.log; any requests that generate errors are logged in /var/log/apache2/error.log.

    There is enough information left in these places to piece together how the attacker was able to initially breach the server. Once you’ve figured out how the initial breach occurred, move on to the next question.

  2. At what date/time did the attacker first log-in to the server?

    The attacker was able to do something to the server by exploiting the photo sharing website. Once this was accomplished, they were able to gain remote access to the server. There are various system logs in the /var/log/ folder that are useful for determining when the attacker remotely accessed the server, including /var/log/auth.log (the authentication log), /var/log/kern.log (the operating system kernel log), and /var/log/ufw.log (the system firewall log).

  3. What critical system file was viewed/stolen by the attacker? Give the full path to this file.

    In addition to the system logs that are available in /var/log/, most user accounts have a log of all the commands they have run in the past stored in the file ~/.bash_history. The Bash History often contains hints about what a given user account has been up to.

  4. What is the name of malicious process running on this machine?

    The HFPC employee noticed that their server was compromised because the system firewall service, called Uncomplicated Firewall or UFW, kept shutting down. This is a telltale sign of compromise: attackers often try to disable security software running on their victims’ machines. The employee tried to manually restart the firewall service, but to no avail. Restarting the server also did not fix the issue: as soon as the operating system booted, the firewall process immediately shut down. The only logical explanation is that some process that the attacker installed on the server keeps terminating the firewall. But how did this process restart itself after the server was rebooted?

    One way to schedule processes to run periodically on Linux systems is the Cron tool. Cron is like an alarm clock: it can be configured to run other programs on a schedule, i.e. once a day, once a week, or once a minute. Cron has various configuration files, all located in /etc/. /etc/crontab is the system-wide Cron configuration file, and there are additional, per-process configuration files in the folders /etc/cron.d/, /etc/cron.hourly/, /etc/cron.daily/, /etc/cron.weekly/, and /etc/cron.monthly/.

  5. What binary was back-doored? Give the full path.

    Attackers often attempt to hide their presence on compromised systems by installing rootkits or back doors. Rootkits are essentially cloaking devices: depending on their level of sophistication, they try to hide the various programs, processes, and user accounts created by the attacker. Back doors offer the attacker hidden ways to access the system or elevate their privileges, typically using methods that try to evade detection.

    One way to achieve these ends is by modifying the system utilities that everyone uses to manage to their systems (e.g. programs like ls and ps). In this case, did the attacker attempt to back door any system utilities? One way to see if system programs have been modified is by running the debsums tool: it checks the cryptographic hash of all system files and compares them to a list of known-good hashes. debsums prints “FAILED” for any file that appears to have been modified.

    Note: please provide a full path that resolves all file system links. For example, notice that /bin is actually a link to /usr/bin, so instead of /bin/foo, please submit /usr/bin/foo.

Submission

To receive full credit on this assignment, you must upload your single page PDF export of the google docs template into Gradescope.

Answers to 1 and 4 should name particular files/processes such as my_program.exe. Answers to 3 and 5 should state the full path of a file such as /usr/local/foo/bar/ddd. Answers to 2 should be a date/time in exactly the format given above, i.e. three-letter abbreviated month, two digit day, and six digit hour:minute:second in 24-hour format such as Jan. 21 15:10:49.