One of the company test servers has been hacked! Fortunately your networking team was recording the traffic going to and from the server while diagnosing an unrelated fault. You have a complete log of the attack! The CEO has asked you to use your knowledge of networking to answer four key questions:

What scans and reconnisance did the attacker do before attacking?
How did they gain access?
What did they do once they had access?
What are the three most important things we have to do to recover and stop this happening again?

Задание:

Download the file attack-RESIT.pcap from Moodle and open it in Wire- shark (either in the virtual machine image or on your own computer).
Using your knowledge of network protocols and the features of Wireshark work out what has happened.
Write a short report (4 pages max!) in PDF which covers the following four topics:
Information Gathering How did the attacker gather information about the test server? What kind of information did they get? Give all of the relevant details. You need to work out what is relevant.
Gaining Access How did they gain access to the test server? Which protocols were used? What kind of attack was it? How did it work? Were they successful with just one attack or did they require multiple attempts?
Compromised What did the attackers do once they had access? Are we sure we know everything that they did?
Recovery and Defence Give three things that must be done to recover from the attack. Give three changes to the network or the configura- tion of the server which would prevent this kind of attack happening again. You must connect these to your description of the attack. Generic suggestions will not do; you must say what steps of the at- tack it will stop.
• Every claim or observation you make must be linked to one or more packets or parts of packets in the pcap file. Use the packet number (on the far left of the main display) to identify packets. Screen shots are not required but you can include them if you feel it is the best way of explaining something.