Summary
Hunting Down Hackers: Incident Response with Wireshark Diving into the ocean of packets to trace back hackers using Wireshark Hunting Down Hackers using Wireshark requires a deep understanding of networking, protocols, Wireshark filters, features, and many more things. For demonstration purposes, I have used “2008 Nitroba University Harassment Scenario”. Scenario Summary The Incident Lily Tuckrige, a Chemistry 109 instructor at Nitroba State University, received harassing emails at her personal account (lilytuckrige@yahoo.com) during the Summer 2008 semester. She suspects a student in her class is the perpetrator. Initial Investigation
- Source Attribution: Email headers revealed the messages originated from an IP address 140.247.62.34.
- The Location: This IP belongs to a Nitroba student dorm room shared by three women.
- Network Vulnerability: The room features a wired Ethernet port. However, a friend installed an unsecured, password-free Wi-Fi router in the room, meaning anyone nearby could have used the connection. The Network Interception
- The Action: Nitroba IT placed a network sniffer on the dorm’s Ethernet port to log all traffic.
- The New Clue: On Monday, 7/21, Tuckrige received another harassing message.
- The Evasion Technique: The perpetrator sent this message using willselfdestruct.com, a web service that destroys the text immediately after the recipient views it. Suspected Student List
- Amy Smith
- Burt Greedom
- Tuck Gorge
- Ava Book
- Johnny Coach
- Jeremy Ledvkin
- Nancy Colburne
- Tamara Perkins
- Esther Pringle
- Asar Misrad
- Jenny Kant Your Objective Using the provided packet capture (.pcap), screenshots, and the Chemistry 109 class roster, you must determine if a student in the class sent the emails and provide definitive network evidence linking them to the crime. Practical Demo (Solution) Open the nitroba.pcap file in Wireshark. Once open, you can see the dashboard like below As we have the above information, Let’s go through the network traffic as the timeline of the incident. We know that the email header revealed that the messages originated from the IP address 140.247.62.34, which was the IP address of the Nitroba student dorm room associated with the email address lilytuckrige@yahoo.com. Let’s find out with whom the originating IP address 140.247.62.34 has communicated. For this, we have to filter out the network traffic whose IP address is 140.247.62.34. Display filter used: ip.addr eq 140.247.62.34 Now, once the traffic is filtered out, you can see many conversations. To find out how many IP addresses it’s communicating with. For this, go to: Statistics > Conversations > IPv4 We found that the originating IP address is only communicating with the internal IP address: 192.168.15.4 Note down the internal IP address: 192.168.15.4 This internal IP address is the IP address of the perpetrator. But we also have the email address of the victim Lily Tuckrige: lilytuckrige@yahoo.com Get PriOFF’s stories in your inbox Join Medium for free to get updates from this writer. Let’s filter out the packet and find where this email address can be found in the packets. Use this filter to find out the email address: ip contains “lilyruckrige@yahoo.com” You can see, there are only two packets found.
- A POST Request submitted to /send.php
- A POST Request submitted to /secure/submit Let’s analyse both packets.
- Analysing POST /send.php If you click on the packet and inspect the packet a bit, you will find the HTTP request headers, in which you can see the User-Agent of the user. User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) MAC address: 00:17:f2:e2:c0:ce Windows NT 5.1 = Windows XP Timestamp when the mail has been sent: You can inspect the packet that the mail has been sent to the same email ID via this IP address. Note: Also keep the note of the timestamps We also have the MAC address. Now let’s filter the traffic using the MAC address to find out the actual traffic flow of the perpetrator’s device. Use the display filter: eth.addr eq 00:17:f2:e2:c0:ce If we analyse the traffic before the mail has been sent, we can narrow down our traffic load. Use the display filter to filter the traffic before sending the anonymous email: eth.addr eq 00:17:f2:e2:c0:ce and frame.time ⇐ “2008–07–22 06:02:57Z” Now, if we analyse the traffic a bit and get as close as possible to the incident timestamp, we find the interesting traffic. As you analyse a bit, you will know that the perpetrator has been searching and browsing many things from news articles, movies, videos, to Facebook, Google, Apple, Amazon, too. Facebook Login timestamp: 2008–07–22 04:52:10Z Timestamp of perpetrator searching anonymous email: 2008–07–22 05:58:01Z For more efficiency, we can use the filter: eth.addr eq 00:17:f2:e2:c0:ce and ip contains “mail” We have added [ ip contains “mail” ]. This finds the keyword ‘mail’ in the IP packets. You can notice that we removed the timestamp filter because now we have almost filtered out most of the traffic and also the perpetrator’s. In the above image, you can see that we have found that the perpetrator had searched keywords such as “I want to harass my teacher” and “sending anonymous mail” Scrolling down, we also found the POST request on /send.php that we had found earlier. Below that, we can also see the mail URL. When we inspected the mail URL, we found something interesting. We have found the email address of the perpetrator: jcoachj@gmail.com By matching the email address to the suspected student list, the perpetrator was identified as Johnny Coach. You can also notice the timestamp and MAC address to verify that the perpetrator was Johnny Coach. Conclusion The student who sent the harassing email to Lily Tuckrige was Johnny Coach. On Monday, July 21, 2008, Johnny connected to the unsecured Wi-Fi router in the dorm room from his laptop. He accessed the willselfdestruct.com service to draft and send the abusive message. He was positively identified via unencrypted network packets that captured both his unique student credentials and his explicit web browsing activity. So, this is how you can analyse network traffic, inspect every network packet, and uncover everything. Using Wireshark, we can trace back the hacker, as we have shown in the practical demo. Hit clap | subscribe | share Also, comment below if you have any queries or want to discuss a topic. See you in the next article.