malphx://blog

The Honeynet Project's team has published the results for the 4th Forensic Challenge 2010 VoIP.

My official results:

Thank you for participating in the 4th Honeynet Project Forensic Challenge 2010: VoIP.
Sjur, Ben, Jianwei, Roland, and Julia finished evaluating your submission. You have received a total of 62 of 63 points.
Below you will find your score per answer:

• Answer 1.1 (1point): 1 points
• Answer 1.2 (1point): 1 points
• Answer 1.3a (1point): 1 points
• Answer 1.3b (1point): 1 points
• Answer 1.3c (2points): 2 points
• Answer 1.4a (2points): 2 points
• Answer 1.4b (6points (2 each)): 6 points
• Answer 1.5 (1point): 1 points
• Answer 1.6 (3points): 3 points
• Answer 1.7 (5points): 5 points
• Answer 1.8a (3points): 3 points
• Answer 1.8b (3points): 3 points
• Answer 2.1 (4points): 4 points
• Answer 2.2a (1points): 1 points
• Answer 2.2b (1points): 0 points
• Answer 2.3 (2points): 2 points
• Answer 2.4 (2points): 2 points
• Answer 2.5a (10points): 10 points
• Answer 2.5b (3points): 3 points
• Answer 2.5c (2points): 2 points
• Answer 2.6 (3points): 3 points
• Answer 3.1 (2points): 2 points
• Answer 3.2 (2points): 2 points
• Answer 3.3 (2points): 2 points

A sample solution as well as the submissions of the winners has been posted to the challenge web page at http://honeynet.org/challenges/2010_4_voip. Sjur, Ben, Jianwei, Roland, and Julia will be summarizing highlights from various submissions in a blog post shortly.

We are still finalizing our next challenge. Please subscribe to our RSS feed or check our web sites for announcements.

For this 4th challenge, we received a total of 21 submissions. With your score of 62, you came into position 1. Congratulations!!!!

You could find my submission for FC4 on the Honeynet Project's site. For this one, I've used a great visualization tool named PicViz written by Sébastien Tricaud from the French Chapter.
You should read his paper about his tool: Know Your Tools: use Picviz to find attacks

Feel free to leave a comment !

The second "2010" Forensic Challenge published by the Honeynet Project is now closed, and the results have been published.
This time the investigators (or contestants) had to dissect a pcap file containing network traces of "browsers under attack".
The analysis revealed that a "lab setup" has been used to mimic the interactions between victim's browsers and some malicious Web sites.
Feel free to review my submission, all the winners submissions and the solution given by the Honeynet Project's Team.
I haved scored 43/43 for this one, and so I'm one of the 4 winners
I'm now waiting the publication of #3 ('Banking Troubles'), which promises to be very interresting.
Finally, I would also like to thank all the Honeynet Project's team for giving us such interresting and educationnal contests !