Last saved by: The Office of Information Technology

Daniel Warner

IS 3523 Lab 3

Packet Capture Analysis

A. Purpose

To analyze a packet capture file and determine whether or not a significant event has occured.

B. Materials

In this lab I am using Wireshark Version 1.2.6 (SVN Rev 31702) on a Windows XP system to analyze the packet capture file. 

C. Procedure

The first thing I tried to do was to put together a picture of the network. The private network is using the 172.16.x.x class B reserved subnet. Wireshark tags the first packet captured as a TiVo connect discovery beacon coming from 172.16.1.35 and broadcast to the entire subnet. Clearly this means that there is a TiVo on the network somewhere on the network but I do not believe that it is this machine. We can glean the following information about this machine from the packet.

MACHINE: KAUFMANUPSTAIRS
platform:pc/WinNT:5.1.2600
Services:TiVoMediaServer:8080/http

The first value I listed is probably the Hostname of the computer. The platform value is what leads me to believe that it is not the actual TiVo box, because TiVo DVRs use a version of Linux while the platform here is Windows. The 2600 number probably refers to the build number of Windows, in this case Windows XP. It appears to be running a TiVo media server. These packets seem to repeat regularly and they are called TiVo discovery beacons, so they must be a way of announcing the TiVo services to the network, however they also seem to be an easy source of information about the host computers. The presence of a TiVo on the network also suggests that this is a home network; it seems unlikely that a business would use a TiVo on their LAN

If we filter for only the TiVo connect protocol we can quickly find the DVR on the network since it is the only other IP that shows up. Packet 210 shows us that the DVR is at 172.16.1.37 and its discovery beacon yields the following information

Machine: DVR 8525
Platform: tcd/Series2
Services: TiVo-ServeTcdVideo-1:2191/tvbus_v3,TiVoMediaServer:80/http

Packets 5 and 6 also give us a little more information about the network they are a pair of ARP requests and replies. The request is from 172.16.0.1 which is commonly a router or modem address. A lookup of the MAC vendor shows that the hardware address belongs to a 2Wire device, a common maker of home DSL and Cable modem routers and modems further making the case for this device being the router. The reply is from 172.16.1.35 and its MAC vendor is First International Computer, a maker of PC motherboards which would also lead us to believe that this machine is a PC.

Packets 44-50 also give us a hint as to the structure of the network. The router sent off a series of ARP requests to the machines already discovered as well as172.16.1.34, 172.16.1.36, and 172.16.1.39; machines that we have not previously seen. However, none of these machines responded to the ARP request which suggests that they are turned off.

After 52 seconds the machine at 172.16.1.35 sends out a DNS request for Microsoft.com and begins to download the webpage there with a series of HTTP requests. At the same time it signs onto an FTP server at 69.39.22.157 and goes through the following sequence.

220 linux-wlan.org NcFTPd Server (licensed copy) ready.
USER anonymous
331 Guest login ok, send your complete e-mail address as password.
PASS IEUser@
230-You are user #3 of 32 simultaneous users allowed.
230-
230 Logged in anonymously.
opts utf8 on
501 Option not recognized.
syst
215 UNIX Type: L8
site help
211-The following SITE commands are recognized:
211-   BUFSIZE
211-   CHMOD
211-   DATE
211-   DF
211-   QUOTA
211-   RBUFSIZ
211-   RBUFSZ
211-   RETRBUFSIZE
211-   SBUFSIZ
211-   SBUFSZ
211-   STORBUFSIZE
211-   SYMLINK
211-   UMASK
211-   UTIME
211 
PWD
257 "/" is cwd.
CWD /pub/linux-wlan-ng/
250 "/pub/linux-wlan-ng" is new cwd.
TYPE A
200 Type okay.
PASV
227 Entering Passive Mode (66,39,22,157,238,162)
LIST
150 Data connection accepted from 68.92.158.179:3375; transfer starting.
226 Listing completed.

This entire sequence took less than two seconds to complete which makes me believe that is a machine performing this FTP session, not a human.

The computer at 172.16.1.35 Then navigated to rbfcu.org, the webpage for Randolph Brooks Federal Credit Union and downloaded the webpage

The computer also navigated to ruby1604.utsa.edu, the login page for faculty and staff at UTSA, then back to Microsoft, then to login.yahoo.com and others.

There are also several connections back to the same FTP server that follow the same pattern. They use the same commands and take roughly the same amount of time.

Towards the end of the capture 172.16.1.35 logs into an AOL Instant Messenger Session. Wireshark has the ability to follow the TCP stream involved in an AIM session, however it is not clear from this capture what is being transferred. Wireshark has tagged many of the packets as malformed, and these malformed packets are sent from both the host machine and the AIM server.  The entire exchange was also 168,884 bytes, and  much of it was some sort of binary or encrypted data. Here is an excerpt:

.Vg.GT.>.\..{_..i./....K.z....t.A9.V...V..'J............+...i.R.p..o$%..a3...0...o.W.b....&.s_o...7....1.-..*....wat.-....n.(.Z.9a.'...- .glA....D.]n.i.7L...KP..L...yn..oJJT.Jm-..lP... ...........m2sp..=Y....Bb.t.4.>._.P..Ku..&.M.GgX*....wat.-....n.Sw....n......BG.....CF.Kkq..u.]I*..$...8..i..-...9.^.n$7.....)3.t@^aK:.......i..............=.(....X..zxM....*....wat.-....ne8.E...........R..(..S..t.T...!Y].....B.B.....$...........PlmKH.g..bkc,...I...*cLsyP...W...[*8L..d...d|.....
.*....wat.-....n/'.g.f.x...9.....,[.C.  
.4..?IG.T/......4.!.o..H.;...).M..j.I...DG..h...&..)x......1.8.v.._.{.R...D..)$K..D.R*....wat.-....n.:8(.......I..)...M...8\n.iL.....x..r#=.x:."..M..2.&...U$ktF.......ZCI.IS..RT...u.v@.M6.\...Fe_J..U.[1.v...d..*....wat.-....n%.`...(....#.q..k.iM!i...sUg....w..g.xt.X..........L,..t.....!.F
2.....l..\J.CjJ..ErQ=;.....fC.Y....F.6..)...l*....wat.-....n.6

This exchange also included what appeared to be some sort of code for the AOL Instant Messenger client followed by what appears to be some HTML code. Here is an excerpt:

If Command = "load" Then 
 AOL.S..netVisibility 10101, 0 
 AOL.SetVisibility 10151, 1 
 AOL.FormDoAction (2001)
 End If 
 If Command = "click" Th..nen 
 AOL.FormDoAction (2000) 
 End If 
 If Command = "done" Then 
 AOL.FormDoAction (2002) 
 AOL.UpdateDisplay..' 
 End If 
 AOL.UpdateDisplay 
 End Sub '.!i ..!J'.0.....!.!J'w..<b>Madonna Stirs Up<br>Controversy (Again)</b>}!J'x..The Pop Queen Recently Offended Rabbis,<br>Parents and More: <a href="aol://4344:PP2:1614605008:4297997573:4310631926,http://aolsvc.news.aol.com/music/article.adp?id=20051026141709990002">What She Did This Time</a>}!J'y..<b>Can She Still Shake It?</b><br><a href="aol://4344:PP2:1614605008:4297997573:4310631928,http://music.aol.com/videos/newthisweek.adp">Check Out Her New 'Hung Up' Video</a>}!J'z d......<a href="aol://4344:PP2:1614*.....at........605008:4297997573:4310631930,http://radaol-prod-web-rr.streamops.aol.com/radio/radioclient/common/html/OpenRadio.html?&amp;stationid=6743">Tune In to All Madonna Radio</a>!.!J'u...Madonna: Mother of Re-Invention0...L...< .... .$ ...Cd.#S1614605008:1.3030277:1.15664635,U3....Z.h .!.!J'{..<font color="#FF0000" back="#ffffff" style="BACKGROUND-COLOR: #ffffff" size="1" ptsize="8"><b>Top News: </b><a href="aol://4344:PP2:1614605008:4297997560:4310632161,aol://1722:news">Police Hunt New Delhi Bombers</a></font>}"

I am not sure what this is telling me, but I know that IRC is a common method of controlling computers that have been compromised, because the protocol is well known. It seems possible that a compromised computer might log into an AIM server to report back to a master and get instructions, but I am not sure if that is happening here. The observed AOL Instant Messenger session only lasted approximately 19 seconds which again leads me to believe that this was an automated transaction.

D. Results

I am unable to say with certainty whether or not this computer has been compromised, however I am suspicious for several reasons. The first is the AOL Instant Messenger session. I would be curious to ask the user whether or not they had used AIM, while it is possible that the results I saw might be due to a user transferring a binary  file, it seems unlikely that a human user would only use AIM for 19 seconds. The other factor that raises my suspicions is the FTP sessions, which only lasted 2 seconds. Again, it seems very unlikely that a human would be able to connect and disconnect that quickly. What is also concerning about the FTP sessions is that they are to the same server that seems to be unrelated to which website the computer is connecting to. The third factor that concerns me is the number of login pages that the computer navigated to. The capture session lasted approximately eight and a half minutes, but in that time the computer navigated to Microsoft.com, A credit union login page, the faculty login page at UTSA, back to Microsoft, then to the Yahoo mail login page, then to America Online which contains a login page. While it is physically possible for a human to go to all those pages within a few minutes, it seems unlikely that they would.

The computer at 172.16.1.35 also displayed some unusual behavior by performing reverse DNS lookups on the computers surrounding it on the local network. I have not seen this behavior before, and while it might not greatly concern me in isolation, taken with these other behaviors it seems possible that malware installed on this computer would try to discover more information about the surrounding network. Added together, all these strange behaviors seem like they could be the result of malware that collects information about a user by examining their internal network and collecting login information and then reporting back to a master using the AIM protocol. While I am not certain of this just through reading the packet capture, this would be enough evidence for me to warrant further investigation either through virus/malware scanners or further observation through Wireshark.