CRIME Fwd: Fw: LOGS: GIAC GCIA Version 3.4 Practical Detect #4

From: tobyhush@private
Date: Thu Nov 14 2002 - 01:56:58 PST

  • Next message: Tim Kramer: "Re: CRIME A couple questions..."

    If you haven't ever read one of the SANS GCIA practicals (or written one) this won't be as funny but I think you'll still appreciate it.
    :)
    
    toby
    
    ----- Original Message ----- 
    From: "Craig Baltes" <craig@private>
    To: "Julien Radoff" <vildian@private>
    Cc: <intrusions@private>
    Sent: Tuesday, November 12, 2002 12:49 PM
    Subject: Re: LOGS: GIAC GCIA Version 3.4 Practical Detect #4
    
    
    An absolute work of art!! 
    
    
    On Tuesday 12 November 2002 12:17 pm, Julien Radoff wrote:
    > DETECT FOUR
    > 
    > 
    > [**] SHPILKIS ALERT!!! [**] 
    > 06/10-17:30:30.834488 0:3:E7:D9:26:C0 -> 0:0:C:6:B2:33
    > type:0x800 len:0x71 
    > X.Y.221.104:4527 -> X.Y.180.133:80 TCP TTL:666 TOS:0x0
    > ID:666 IpLen:666 DgmLen:666 DF 
    > ***AP*** Seq: 0xF5D98495 Ack: 0xB824F82 Win: 0x4470
    > TcpLen: 20 
    > 47 45 54 20 2F 73 63 72 69 70 74 73 2F 2E 2E 5C GET
    > /SHPILKIS/..\ 
    > 34 34 23 43 2E 65 78 65 3F 2F 63 2B 64 69 34 dd 
    > genektikaZOINK
    > 
    > 
    > =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ 
    > 
    > 
    > 1.1 Source of Trace: 
    > 
    > Raw files from: 
    > 
    > http://www.incidents.org/logs/RAWHIDE/
    > 
    > 1.2 Detect Generated By: 
    > 
    > SCHNORT Win32 1.8 triggered this rule: 
    > 
    > alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80
    > (msg:"SHPILKIS ALERT!!!"; flags: A+; content: "I've got
    > shpilkis in my genektikazoink!!"; noclass;
    > classtype:brutal aweful and mean attack; sid:1002;
    > rev:2;) 
    > 
    > This was the command used: schnort -c schnort.conf -d
    > -e -l log -r 2002.05.9 | help | grep
    > 
    > The detect works by detecting the deadly secret
    > 'shpilkis' command in the payload
    > 
    > I used this command to generate a TCP dump analysis: 
    > mcsedump -r 2002.5.9 -vvvvvvv > file.txt
    > 
    > This is a portion of the mcsedump output.
    > 17:30:30.834488 h000476b9bf5d.ne.client2.attbi.com.4527
    > > 46.5.180.133.80: P [bad tcp cksum eae4!]
    > 4124673173:4124673232(59) ack 193089410 win 17520 (DF)
    > (ttl 107, id 29762, len 99, bad cksum a005!)
    > 
    > 1.3 Probability the Source Address Was Spoofed:
    > 
    > Likely. But don't worry. We will find you! You can't
    > outsmart SANS!!!
    >  
    > 1.4 Description of Attack: 
    > 
    > This attack executes hidden secret Microsoft Outlook
    > self destruct code, inserting shpilkis into the
    > genektizoink buffer floppy memory stack partition,
    > whereupon causing your hard drive to spin backwards and
    > play backmasked messages from Bill Gates involved in a
    > bizarre ritual I don't even want to talk about. Then
    > your computer bursts into flames.
    > Vulnerable systems are OS2 Warp and Windows XP.
    >  
    > 1.5 Attack Mechanism: 
    > 
    > This attack does bad things, man. I mean BAD things!!
    > 
    > 1.6 Correlations: 
    > 
    > http://www.cert.org/advisories/MS-2001-11.html 
    > 
    > 
    http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/you'rejust_Imagining_this_vulnerability_there_is_no_problem_with_our_software_it's_really_great.hml
    > 
    > 1.7 Evidence of Active Targeting: 
    > 
    > Bring it. Chump.
    > 
    > 1.8 Severity: 
    > 
    > Severity = (criticality + lethality) - (system
    > countermeasures + network countermeasures) 
    > 
    > Criticality = 5
    > When your hard drive spins backwards, it causes the
    > electronodes on your motherboard and fatherboard to
    > squelch the IRQ PCI bus settings, which can cause fires
    > or inflammation.
    >  
    > Lethality = 5
    > If the inflammation spreads, it's curtains for you,
    > sister. 
    > 
    > System Countermeasures = 0 
    > It can't be stopped. 
    > 
    > Network Countermeasures = .4423
    > At least there is an alert giving you time to panic for
    > a few minutes.
    > 
    > SEVERITY = 9.5577
    > 
    > 1.9 Defensive Recommendations: 
    > 
    > Run for the hills!! Seagate is working on a freewheel
    > patch which will prevent the hard drive from spinning
    > backwards. It works like a bicycle freewheel footbrake.
    > Your hard drive will come to a dead hault instead,
    > probably ruining it, but it's better than the
    > alternative. And disable desktop themes. It's driving
    > people in the neighboring cubicles crazy, you jerk. I'm
    > getting ready to send you a virus myself!!
    > 
    > 1.10 Multiple Choice Question: 
    > 
    > Who is buried in Grant's tomb?
    >  
    > A. Linux
    > B. Grant
    > C. Smith
    > D. Jones
    > E. All of the above. 
    > 
    > Answer E
    > 
    > 
    
    -- 
    Craig Baltes, GCIA
    Senior Information Security Analyst
    LURHQ corp
    craig@private
    843-903-4376 x2
    
    
    
    
    
    
    Get your free encrypted email at https://www.hushmail.com
    



    This archive was generated by hypermail 2b30 : Thu Nov 14 2002 - 10:09:37 PST