1
00:00:00,090 --> 00:00:01,050
In this lesson,

2
00:00:01,050 --> 00:00:03,180
we're going to take a look at a network log

3
00:00:03,180 --> 00:00:05,910
and see if we can find something malicious or suspicious

4
00:00:05,910 --> 00:00:07,020
inside of it.

5
00:00:07,020 --> 00:00:10,380
Now for this example, I have a network log from a router

6
00:00:10,380 --> 00:00:13,170
that's going to show us a couple of key pieces of information.

7
00:00:13,170 --> 00:00:15,000
You'll have the first column which is the date,

8
00:00:15,000 --> 00:00:16,740
the second column which is the time,

9
00:00:16,740 --> 00:00:18,510
the third column which is the interface,

10
00:00:18,510 --> 00:00:20,250
the fourth column which is the action,

11
00:00:20,250 --> 00:00:22,320
and the fifth column which is the details.

12
00:00:22,320 --> 00:00:23,910
When we look at the interface,

13
00:00:23,910 --> 00:00:28,290
you see that this is Gi0/1 or Gi0/2,

14
00:00:28,290 --> 00:00:30,330
and these are two ports on our router.

15
00:00:30,330 --> 00:00:33,120
There's another one of Gi0/3 in there.

16
00:00:33,120 --> 00:00:35,010
So we have three different ports that are being used

17
00:00:35,010 --> 00:00:36,720
on this particular router.

18
00:00:36,720 --> 00:00:38,010
Then we have the action.

19
00:00:38,010 --> 00:00:40,560
Is it an allow action, a deny action,

20
00:00:40,560 --> 00:00:42,510
or something like an ARP replay

21
00:00:42,510 --> 00:00:44,220
as you see here on the screen?

22
00:00:44,220 --> 00:00:45,870
And then we have our details.

23
00:00:45,870 --> 00:00:47,850
And the details is going to give you information about

24
00:00:47,850 --> 00:00:49,980
where the traffic is coming from or going to,

25
00:00:49,980 --> 00:00:52,050
over which ports, and what protocol,

26
00:00:52,050 --> 00:00:53,490
or other things like that.

27
00:00:53,490 --> 00:00:54,360
So let's go through this

28
00:00:54,360 --> 00:00:56,460
and read from the action and the details column

29
00:00:56,460 --> 00:00:58,920
to see what we think might be malicious.

30
00:00:58,920 --> 00:01:00,450
Here we see there's an allow action

31
00:01:00,450 --> 00:01:04,971
for inbound traffic going from 192.168.1.105

32
00:01:04,971 --> 00:01:09,180
to 192.168.1.10 on TCP port 80.

33
00:01:09,180 --> 00:01:11,070
Now you may think it might be unusual

34
00:01:11,070 --> 00:01:13,590
that there is a internal address to an internal address,

35
00:01:13,590 --> 00:01:18,217
such as 192.168.1.105 going to 192.168.1.10.

36
00:01:19,500 --> 00:01:21,570
If you work as a network administrator in the real world,

37
00:01:21,570 --> 00:01:23,580
you may see that and go, "Hey, they're both internal.

38
00:01:23,580 --> 00:01:25,110
We shouldn't need a router for that."

39
00:01:25,110 --> 00:01:27,600
But as you know, there may be two different subnets here

40
00:01:27,600 --> 00:01:29,250
and a router would still be used.

41
00:01:29,250 --> 00:01:31,320
Also when you're dealing with an exam,

42
00:01:31,320 --> 00:01:34,350
many times they don't want to use any public IP addresses

43
00:01:34,350 --> 00:01:36,030
because they don't want anybody saying

44
00:01:36,030 --> 00:01:37,470
that we are calling them malicious

45
00:01:37,470 --> 00:01:40,200
because we happen to use their IP address on the exam.

46
00:01:40,200 --> 00:01:41,130
And so a lot of times,

47
00:01:41,130 --> 00:01:43,273
they'll use things like a 10.something,

48
00:01:43,273 --> 00:01:46,230
a 172.something, or 192.something

49
00:01:46,230 --> 00:01:48,600
because those are all considered private IP addresses,

50
00:01:48,600 --> 00:01:50,940
but they'll still use those as public IP addresses

51
00:01:50,940 --> 00:01:53,040
in the exam for those purposes.

52
00:01:53,040 --> 00:01:54,600
So in the logs, if you see that,

53
00:01:54,600 --> 00:01:55,860
don't worry too much about that

54
00:01:55,860 --> 00:01:56,970
and just think about the fact

55
00:01:56,970 --> 00:01:59,220
that we're going from one system to another.

56
00:01:59,220 --> 00:02:01,320
The second line, we have an outbound traffic

57
00:02:01,320 --> 00:02:06,320
going from 192.168.1.15 over to an external IP of 8.8.8.8

58
00:02:07,740 --> 00:02:09,630
on UDP port 53.

59
00:02:09,630 --> 00:02:12,330
And that makes sense to me because 8.8.8.8

60
00:02:12,330 --> 00:02:16,470
is Google's DNS server and it operates over UDP port 53,

61
00:02:16,470 --> 00:02:18,390
which is what we use for DNS.

62
00:02:18,390 --> 00:02:20,670
The next two lines are ARP replies,

63
00:02:20,670 --> 00:02:24,420
and we have 192.168.1.10 is at,

64
00:02:24,420 --> 00:02:25,890
and then it has a MAC address.

65
00:02:25,890 --> 00:02:29,370
The second line is saying 192.168.1.10

66
00:02:29,370 --> 00:02:31,530
is at a different MAC address.

67
00:02:31,530 --> 00:02:34,140
That to me is a little suspicious. Why?

68
00:02:34,140 --> 00:02:36,510
Because normally the MAC address is hardcoded

69
00:02:36,510 --> 00:02:39,270
into your network adapter, and if it changes like this,

70
00:02:39,270 --> 00:02:41,190
somebody had to tell it to change.

71
00:02:41,190 --> 00:02:42,600
And the fact that it's changing

72
00:02:42,600 --> 00:02:45,030
within just a couple of seconds of each other

73
00:02:45,030 --> 00:02:48,290
tells me they may be using a MAC changing software

74
00:02:48,290 --> 00:02:49,623
to be able to spoof their MAC

75
00:02:49,623 --> 00:02:51,180
to be able to do some kind of an ARP spoof.

76
00:02:51,180 --> 00:02:52,350
So that's what I'm thinking right now

77
00:02:52,350 --> 00:02:54,030
as I'm going through these logs.

78
00:02:54,030 --> 00:02:56,580
The next line we have is the three allow lines

79
00:02:56,580 --> 00:02:58,740
going for inbound traffic, outbound traffic,

80
00:02:58,740 --> 00:02:59,850
and inbound traffic.

81
00:02:59,850 --> 00:03:02,250
And, again, we just have some other traffic happening

82
00:03:02,250 --> 00:03:03,180
on this router,

83
00:03:03,180 --> 00:03:06,420
like going from an internal server to another server

84
00:03:06,420 --> 00:03:09,750
on TCP port 443, which is a secure web server.

85
00:03:09,750 --> 00:03:11,310
We see one using ICMP,

86
00:03:11,310 --> 00:03:13,290
which is essentially what we use for pinging.

87
00:03:13,290 --> 00:03:15,930
And then we have another one that we use on TCP port 22,

88
00:03:15,930 --> 00:03:17,940
which is an SSH connection.

89
00:03:17,940 --> 00:03:20,100
Then we have two more ARP replies,

90
00:03:20,100 --> 00:03:23,580
and here we're seeing 192.168.1.10,

91
00:03:23,580 --> 00:03:26,460
that same system is once again reverting itself back

92
00:03:26,460 --> 00:03:27,660
to the original MAC address

93
00:03:27,660 --> 00:03:30,660
and then changing it again about five seconds later.

94
00:03:30,660 --> 00:03:33,240
So again, that seems pretty suspicious to me.

95
00:03:33,240 --> 00:03:37,110
The next one we have is the allow line on Gi0/2,

96
00:03:37,110 --> 00:03:38,640
which is a different interface,

97
00:03:38,640 --> 00:03:43,290
and we're allowing outbound traffic from 192.168.1.13

98
00:03:43,290 --> 00:03:46,620
to 8.8.4.4, which again is Google's DNS server,

99
00:03:46,620 --> 00:03:48,420
it's their secondary DNS server,

100
00:03:48,420 --> 00:03:50,220
and this is on UDP port 53.

101
00:03:50,220 --> 00:03:53,040
So again, that doesn't seem very suspicious to me.

102
00:03:53,040 --> 00:03:55,440
Once again, we're seeing two more ARP replies

103
00:03:55,440 --> 00:03:59,940
and it's the same system once again, 192.168.1.10,

104
00:03:59,940 --> 00:04:01,650
and again, we're seeing the first MAC address

105
00:04:01,650 --> 00:04:03,300
and then the second MAC address.

106
00:04:03,300 --> 00:04:05,760
So it seems like they're switching themself one more time.

107
00:04:05,760 --> 00:04:07,860
The next line we see is a deny statement,

108
00:04:07,860 --> 00:04:12,552
which is denying inbound traffic from 192.168.1.105

109
00:04:12,552 --> 00:04:17,552
to 192.168.1.255, which is the broadcast, over UDP Port 137,

110
00:04:18,720 --> 00:04:20,070
which is NetBIOS.

111
00:04:20,070 --> 00:04:21,750
Again, this doesn't really seem suspicious,

112
00:04:21,750 --> 00:04:23,490
and even if it was, it was denied

113
00:04:23,490 --> 00:04:25,200
so we're not too worried about it.

114
00:04:25,200 --> 00:04:27,570
The next one we have is going to be an allow statement

115
00:04:27,570 --> 00:04:32,570
going from 192.168.1.105 over to 192.168.1.20

116
00:04:34,620 --> 00:04:37,080
on port 80 using TCP

117
00:04:37,080 --> 00:04:39,330
and this is an inbound traffic going to a web server

118
00:04:39,330 --> 00:04:41,580
based on that port and it was being allowed.

119
00:04:41,580 --> 00:04:45,450
So I'm going to assume that the server at 192.168.1.20

120
00:04:45,450 --> 00:04:47,310
is a web server because we're seeing

121
00:04:47,310 --> 00:04:49,740
that traffic over port 80 being allowed.

122
00:04:49,740 --> 00:04:51,720
And then finally, we have another ARP reply.

123
00:04:51,720 --> 00:04:54,810
And here we see 192.168.1.10

124
00:04:54,810 --> 00:04:57,780
and that MAC address went back to the second one again,

125
00:04:57,780 --> 00:05:00,300
which again is an indication of that spoofing.

126
00:05:00,300 --> 00:05:02,370
And so that's what I think this log is showing us,

127
00:05:02,370 --> 00:05:05,340
is that we're looking at a possible ARP spoof event.

128
00:05:05,340 --> 00:05:06,960
And that's about the level of analysis

129
00:05:06,960 --> 00:05:08,940
you'll be asked to perform on the exam.

130
00:05:08,940 --> 00:05:10,200
And if you get a question like this,

131
00:05:10,200 --> 00:05:11,460
this would be actually considered one

132
00:05:11,460 --> 00:05:13,230
of the harder questions on the exam

133
00:05:13,230 --> 00:05:15,630
because an ARP spoof is one that is pretty difficult

134
00:05:15,630 --> 00:05:16,590
to determine.

135
00:05:16,590 --> 00:05:18,360
But the fact that we're looking at network log

136
00:05:18,360 --> 00:05:20,310
and the only thing we're seeing is ARP reply

137
00:05:20,310 --> 00:05:21,810
repeated a couple of times,

138
00:05:21,810 --> 00:05:23,610
and with the same IP address

139
00:05:23,610 --> 00:05:25,260
going to two different MAC addresses,

140
00:05:25,260 --> 00:05:26,850
that would be an indication of some kind

141
00:05:26,850 --> 00:05:28,140
of an ARP spoofing attack.

142
00:05:28,140 --> 00:05:29,310
And so that's what you should be selecting

143
00:05:29,310 --> 00:05:32,003
if you see something on the exam that looks like this.