Contents
        Summary
        Questions
            What is the operating system of the honeypot? How did you determine that? (see day1)
            How did the attacker(s) break into the system? (see day1)
            Which systems were used in this attack, and how? (see day1)
            Create a diagram that demonstrates the sequences involved in the attack. (see day1)
            What is the purpose/reason of the ICMP packets with 'skillz' in them? (see day1)
            Following the attack, the attacker(s) enabled a unique protocol that one would not expect to find on a n IPv4 network. Can you identify that protocol and why it was used? 
            Can you identify the nationality of the attacker? (see day3)
Links and further reading

Summary:

On the 29th November A SunOS 8.8 honeypot was attacked.
The attacker found a known vulnerability in dtspcd and used widely available exploit. After they gained a root shell (interactive access with root privileges) he configured both as an IRC proxy for him and his friends, and as an agent in a complex DDoS network.

The attacker, presumably Italian using interbusiness.it as their ISP (part of telecom Italia) then actively used the machine both to mask his identity on IRC (a chat network) and to attack another host, javairc.tiscali.it (a chat server for the Tiscali ISP).

For more information about how the attack progressed view this series of diagrams / data captures.

Q1, What is the operating system of the honeypot? How did you determine that? (see day1)

From the log files supplied for review, a safe deduction can be made that the honeypot is a SunOS running on a sparc box. Many things point to this OS / Architecture, including the following.

• Passive OS fingerprinting recognises the host as
  192.168.100.28 [1 hops]: SunOS 5.8
• The NOOP slide leading to the exploit code uses a sparc NOOP instruction

• The first command executed by the exploit included a name -a, showing the OS version

• On day 3 the attacker rebooted the box, this is probably to enable IPv6 support, the following syslog entry is captured

• The rootkit included tools for automatically patching known vulnerable daemons, and locked the box down further to prevent attacks. The patches used were for SunOS, in fact the rootkit install script even included the following lines.

2 How did the attacker(s) break into the system? (see day1) 


The attacker can be seen connecting to the vulnerable dtspcd daemon in frame 576. The actual exploit code can be seen in frame 580

This code can be cleaned up to be read as...

/bin/ksh -c echo "ingreslock stream tcp nowait root /bin/sh sh-i" > /tmp/x; /usr/sbin/inetd -s /tmp/x;sleep 10;/bin/rm -f /tmp/x

This creates a root shell backdoor on TCP port 1524.
For a list of commands executed refer to the series of diagrams / data captures.

3: Which systems were used in this attack, and how? (see day1) 

From the logs given, a safe assumption can be made that the attacker is sitting at a MS Windows XP professional box connected via ADSL to the Italian ISP interbusiness.it. He also has remote shells on numerous linux box's. On the third day the attacker connected again from his XP machine to use the psybnc daemon he installed on day 1. This connection was from another IP in ISP's pool, confirming further the idea of him having an ADSL or account with them.

The first communication shows came from a Linux 2.4.2 machine connected to the hinet.net network. It is most likely that this is another hacked box used to scan and penetrate other hosts.

61.219.90.180 [21 hops away]: Linux 2.4.2 - 2.4.14
The original box that sent exploit to the sun machine, downloaded the rootkit / DDoS client software / PsyBNC / patched the machine ( For commands executed see appendix)

His desktop computer is a Windows XP Pro machine (80.117.14.44 [16 hops away). He uses this box to chat and converse on IRC.
On day 3 (presumably) the same box connected with another IP address (80.117.14.222 [16 hops away]). 

Another Linux machine was used to further abuse the honeypot on day3 (1 December) (62.101.108.86 [19 hops away]). It connected to the SSH Backdoor and enabled IPv6 on the box.

4 Create a diagram that demonstrates the sequences involved in the attack. (see day1)

View this series of diagrams / data captures.

5 What is the purpose/reason of the ICMP packets with 'skillz' in them? (see day1) 

The attacker installed a DDoS agent on the honeypot. The "skillz" packets (example below) are used to converse with its controlling handler / clients.
The handlers it tries to communicate with are 217.116.38.10 & 61.134.3.11, examples of these can be seen in packets 205 and 206.

6 Can you identify the nationality of the attacker? (see day3)

All clues point to the fact the attacker is Italian.

• They are using an Italian ISP, interbusiness.it  (part of telecom Italia) http://www.191.biz/
• They Attacked an Italian IRC Channel      http://javairc.tiscali.it ( http://chat.tiscali.it )
• They speak Italian.  

Appendix, Links and further reading

Ethereal: http://www.ethereal.com
Snort: http://www.snort.org
DDoS analysis http://staff.washington.edu/dittrich/misc/stacheldraht.analysis
nardware.co.uk http://www.nardware.co.uk