GT CS 6035: Introduction to Information Security
Project MITM/PCAP
Learning Goals of this Project:
Students will get familiar with packet capture (PCAP) reading and some common
man in the middle techniques. This is where a malicious user puts themselves in
the middle of the conversation with another user or application and eavesdrops on
all the traffic. Some papers which demonstrate this concept are the following:
● Man-In-The-Middle Attack in Wireless and Computer Networking- A review
● Detection of man-in-the-middle attacks using physical layer wireless security
techniques
● On the Feasibility of Large-Scale Infections of iOS Devices
Students will familiarize themselves with Layer 2 - 7 network traffic and how to analyze
network traffic using Wireshark, a network protocol analyzer, and its libraries such as pyShark.
● For more details about Wireshark you can visit https://www.wireshark.org
● For details about pyShark and tshark you can visit http://kiminewt.github.io/pyshark/
Students will also familiarize themselves with application layer protocols such as HTTP and IRC.
● If you are not familiar with HTTP, we strongly recommend you learn about the protocol,
methods, and requests. You can find a good introduction at Mozilla's developer page
and Sam Barros’ Medium page
● IRC was a very common protocol in the early 2000s. For its simplicity and efficiency it's
still in use on multiple settings. Several Botnets use it for Command and Control (C&C)
and hacking groups still rely on IRC to exchange information. You can read more and
get familiar by reading this Medium article.
Finally, this is a graduate course. So it is expected that students will research and understand
how these network protocols work by reviewing their RFCs:
● RFC1459 (Internet Relay Chat Protocol): https://datatracker.ietf.org/doc/html/rfc1459
● RFC2616 (Hypertext Transfer Protocol): https://datatracker.ietf.org/doc/html/rfc2616
The final deliverables:
A single json formatted file will be submitted to Gradescope. This file should be named
project_mitm.json. A template can be found below please See Submission Details for more
information
Important Reference Material :
● Read the RFCs provided.
● Official Wireshark Guide
● If you have no experience with networking or application layer protocols,
we STRONGLY encourage you to research those topics. There are many
great resources online like Google and YouTube.
, GT CS 6035: Introduction to Information Security
Submission
Gradescope (autograded) - see Submission Details
Requirements
Wireshark - https://www.wireshark.org/download.html
Python3 - Download Python | Python.org
Ensure you have nslookup installed on your OS (DNSUtils) (it should come default on
any Windows, MacOS or Linux environment)
Packet Capture
The packet capture can be downloaded at:
https://cs6035.s3.amazonaws.com/mitm_packetcapture_spring_2023.pcap
BACKGROUND
The Necrocryptors (TNC) is a hacking group known for multiple data leaks and has been active
at underground forums selling personally-identifiable information (PII) and credit card data
stolen from vulnerable websites.
Recently, TNC led a DDoS campaign against multiple targets in the United States, leading to a
Federal Investigation by the National Cyber Investigative Joint Task Force (NCIJTF). This
investigation was coordinated by the FBI Cyber Crime division and after months of undercover
investigation, NCIJTF was able to capture unencrypted communication between members of
TNC. While NCIJTF did not disclose how this communication was captured, we can infer that
either it came from an insider member of the organization or a sophisticated attack led by
NCIJTF allowed this communication to be captured.
In this project, you are playing the role of Mark, an FBI agent from the Cyber Crime division.
You walk into the office, just back from a nice vacation in the Bahamas, and pour some coffee from
the shared pot near your cubicle when you hear, "Mark! Great to see you are back! Come over to
my desk right now, we need to talk." It's your boss, Bill. You think to yourself, Geez! I just came
back. This guy doesn't give me a break.
You take your coffee to Bill’s office, close the door and listen as Bill starts.
"Mark, I have a task for you. We finally got our hands on some incriminating evidence against TNC.
With this pile of evidence, the Attorney General is on my neck to bring those guys to justice. But
we need some strong evidence of criminal activity that can't be disputed in court."
, GT CS 6035: Introduction to Information Security
"Okay…" My wife told me to take some extra days off, but no. I had to come back today…
"I'm sending the packet your way,” Bill says, “You have one week to analyze the data and find
clear evidence of criminal activity. The Attorney General sent us a list of things they are looking
for. It's all on your desk."
"Sounds good, boss. It's great to be back."
You leave his desk, take a sip of coffee and go back to your computer. No time to slowly get up
to speed, you think, but that’s OK. I’m excited to help take TNC down.
Office Setup
Ok, vacation is over. Now it's time to configure your workspace and start the research.
You have two options to complete this assignment:
1) Install Wireshark into the VM; or
2) Create your own environment and install any tools needed.
This project does not require a lot of preparation. Just download wireshark,
the provided PCAP file, and start analyzing.
The next few pages will guide you on installing Wireshark on Windows, MacOS and Ubuntu
setup.
Project MITM/PCAP
Learning Goals of this Project:
Students will get familiar with packet capture (PCAP) reading and some common
man in the middle techniques. This is where a malicious user puts themselves in
the middle of the conversation with another user or application and eavesdrops on
all the traffic. Some papers which demonstrate this concept are the following:
● Man-In-The-Middle Attack in Wireless and Computer Networking- A review
● Detection of man-in-the-middle attacks using physical layer wireless security
techniques
● On the Feasibility of Large-Scale Infections of iOS Devices
Students will familiarize themselves with Layer 2 - 7 network traffic and how to analyze
network traffic using Wireshark, a network protocol analyzer, and its libraries such as pyShark.
● For more details about Wireshark you can visit https://www.wireshark.org
● For details about pyShark and tshark you can visit http://kiminewt.github.io/pyshark/
Students will also familiarize themselves with application layer protocols such as HTTP and IRC.
● If you are not familiar with HTTP, we strongly recommend you learn about the protocol,
methods, and requests. You can find a good introduction at Mozilla's developer page
and Sam Barros’ Medium page
● IRC was a very common protocol in the early 2000s. For its simplicity and efficiency it's
still in use on multiple settings. Several Botnets use it for Command and Control (C&C)
and hacking groups still rely on IRC to exchange information. You can read more and
get familiar by reading this Medium article.
Finally, this is a graduate course. So it is expected that students will research and understand
how these network protocols work by reviewing their RFCs:
● RFC1459 (Internet Relay Chat Protocol): https://datatracker.ietf.org/doc/html/rfc1459
● RFC2616 (Hypertext Transfer Protocol): https://datatracker.ietf.org/doc/html/rfc2616
The final deliverables:
A single json formatted file will be submitted to Gradescope. This file should be named
project_mitm.json. A template can be found below please See Submission Details for more
information
Important Reference Material :
● Read the RFCs provided.
● Official Wireshark Guide
● If you have no experience with networking or application layer protocols,
we STRONGLY encourage you to research those topics. There are many
great resources online like Google and YouTube.
, GT CS 6035: Introduction to Information Security
Submission
Gradescope (autograded) - see Submission Details
Requirements
Wireshark - https://www.wireshark.org/download.html
Python3 - Download Python | Python.org
Ensure you have nslookup installed on your OS (DNSUtils) (it should come default on
any Windows, MacOS or Linux environment)
Packet Capture
The packet capture can be downloaded at:
https://cs6035.s3.amazonaws.com/mitm_packetcapture_spring_2023.pcap
BACKGROUND
The Necrocryptors (TNC) is a hacking group known for multiple data leaks and has been active
at underground forums selling personally-identifiable information (PII) and credit card data
stolen from vulnerable websites.
Recently, TNC led a DDoS campaign against multiple targets in the United States, leading to a
Federal Investigation by the National Cyber Investigative Joint Task Force (NCIJTF). This
investigation was coordinated by the FBI Cyber Crime division and after months of undercover
investigation, NCIJTF was able to capture unencrypted communication between members of
TNC. While NCIJTF did not disclose how this communication was captured, we can infer that
either it came from an insider member of the organization or a sophisticated attack led by
NCIJTF allowed this communication to be captured.
In this project, you are playing the role of Mark, an FBI agent from the Cyber Crime division.
You walk into the office, just back from a nice vacation in the Bahamas, and pour some coffee from
the shared pot near your cubicle when you hear, "Mark! Great to see you are back! Come over to
my desk right now, we need to talk." It's your boss, Bill. You think to yourself, Geez! I just came
back. This guy doesn't give me a break.
You take your coffee to Bill’s office, close the door and listen as Bill starts.
"Mark, I have a task for you. We finally got our hands on some incriminating evidence against TNC.
With this pile of evidence, the Attorney General is on my neck to bring those guys to justice. But
we need some strong evidence of criminal activity that can't be disputed in court."
, GT CS 6035: Introduction to Information Security
"Okay…" My wife told me to take some extra days off, but no. I had to come back today…
"I'm sending the packet your way,” Bill says, “You have one week to analyze the data and find
clear evidence of criminal activity. The Attorney General sent us a list of things they are looking
for. It's all on your desk."
"Sounds good, boss. It's great to be back."
You leave his desk, take a sip of coffee and go back to your computer. No time to slowly get up
to speed, you think, but that’s OK. I’m excited to help take TNC down.
Office Setup
Ok, vacation is over. Now it's time to configure your workspace and start the research.
You have two options to complete this assignment:
1) Install Wireshark into the VM; or
2) Create your own environment and install any tools needed.
This project does not require a lot of preparation. Just download wireshark,
the provided PCAP file, and start analyzing.
The next few pages will guide you on installing Wireshark on Windows, MacOS and Ubuntu
setup.
