- About us
- Code of Conduct
- Google SoC
- Recent posts
- Security Workshops
Another challenge is ready to be tackled by forensic analysts, students, hackers and alike. This time, we present you with an attack vector that has become quite successful: malicious PDF files!
For challenge 6 of our series (provided by Mahmud Ab Rahman and Ahmad Azizan Idris from the Malaysia Honeynet Project Chapter) we present you with a pcap file that contains network traffic generated by the following scenario: An unsuspecting user opens a compromised web page, which redirects the user's web browser to a URL of a malicious PDF file. As the PDF plug-in of the browser opens the PDF, the unpatched version of Adobe Acrobat Reader is exploited and, as a result, downloads and silently installs malware on the user's machine.
We prepared a set of questions that requires you to dive deep into the portable document format. Submit your solution by November 30th 2010. The top three submissions will receive small prizes.
Chief Communications Officer
The Honeynet Project Read more »
Folks, Sebastien, Anton, Raffy and Julia have judged all submissions and results have been posted on the challenge web site. The winners are:
Congratulations to the winners.
Apparently challenge 5 was a true challenge. While we had many folks hit the challenge web site, we only received 7 submissions in total and quite a few participants missed more subtle attacks embedded in the deep corner of the logs. This illustrates how difficult log analysis is and a reason why we included it in the mix of challenges. The original challenge files remain on the web site and we have posted the top three submissions from Wiliam, Nikunj and David. Take a look and see whether you would have been able to identify all attacks in the logs.
With challenge 5 completed, we are getting ready to launch challenge 6 on November 1st. This challenge has been prepared by Mahmud and Ahmad from the Malaysian Chapter. It deals with 'Analyzing Malicious Portable Destructive File' and we hope to see you participating.
Chief Communications Officer
The Honeynet Project
I'm interested in infostealers and specifically in banking-trojans so I didn't want to miss this one. Samples of Carberp are floating around at least since last spring but in late September we saw such numbers increasing.
Taking a look at how Carberp hooks API it looks like yet another Zeus "clone". What I found interesting is how it hooks system calls. This is how a normal syscall looks like
The deadline for the Forensic Challenge 2010/5 - Log Mysteries is quickly approaching. It seems like this challenge is a hard nut to crack as we only received a few submissions so far. If you like a challenge, give it a try. The deadline is September 30th 2010. You can access the challenge at http://honeynet.org/challenges/2010_5_log_mysteries. Did I mention there are prizes?
After a short break, I am pleased to announce the next forensic challenge: Forensic Challenge 5 - Log Mysteries. This challenge takes you into the world of virtual systems and confusing log data. Figure out what happened to a virtual server using all the logs from a possibly compromised server.
Challenge 5 has been created by Raffael Marty from the Bay Area Chapter, Anton Chuvakin from the Hawaiian Chapter, and Sebastien Tricaud from the French Chapter. It is a bit more open ended than the last challenges, so I am really looking forward to some creative answers!
Submission deadline is September 30th and we will be announcing winners around October 21st. We have a few small prizes for the top three submission.
A new improvement in PHoneyC DOM emulation code was committed in SVN r1624. The idea is to better emulate the DOM behaviour depending on the selected browser personality. Let's take a look at the code starting from the personalities definition in config.py.