harassment at
DESCRIPTION
Harassment at. The case. You are a staff member at the Nitroba University Incident Response Team. Lily Tuckrige is teaching chemistry CHEM109 this summer at NSU. Tuckrige has been receiving harassing email at her personal email address. Tuckrige's personal email is [email protected] - PowerPoint PPT PresentationTRANSCRIPT
![Page 1: Harassment at](https://reader033.vdocuments.mx/reader033/viewer/2022061514/56813a2c550346895da21388/html5/thumbnails/1.jpg)
Harassment at
![Page 2: Harassment at](https://reader033.vdocuments.mx/reader033/viewer/2022061514/56813a2c550346895da21388/html5/thumbnails/2.jpg)
The case
You are a staff member at the Nitroba University Incident Response Team.
Lily Tuckrige is teaching chemistry CHEM109 this summer at NSU.
Tuckrige has been receiving harassing email at her personal email address.
• Tuckrige's personal email is [email protected]
• She thinks that it is from one of the students in her class.
Tuckrige contacted IT support.
• She sent a screen shot of one of the harassing email messages.
• She wants to know who is doing it.
istockphoto.com
![Page 3: Harassment at](https://reader033.vdocuments.mx/reader033/viewer/2022061514/56813a2c550346895da21388/html5/thumbnails/3.jpg)
The email message.
![Page 4: Harassment at](https://reader033.vdocuments.mx/reader033/viewer/2022061514/56813a2c550346895da21388/html5/thumbnails/4.jpg)
Nitroba's IT wrote back to Lily.
The IT tech told Lily:
• The screen shot wasn't tremendously useful.
• Can you get the full headers?
Lily sent back a screen shot with the headers:
![Page 5: Harassment at](https://reader033.vdocuments.mx/reader033/viewer/2022061514/56813a2c550346895da21388/html5/thumbnails/5.jpg)
The IP address points to a nitroba dorm room.
$ host 140.247.62.34
34.62.247.140.in-addr.arpa domain name pointer G24.student.nitroba.org
$
![Page 6: Harassment at](https://reader033.vdocuments.mx/reader033/viewer/2022061514/56813a2c550346895da21388/html5/thumbnails/6.jpg)
The Dorm Room
Three women share the room:
• Alice
• Barbara
• Candice
Nitroba provides 10mbps Ethernet in every room but no Wi-Fi.
Barbara's boyfriend Kenny installed a Wi-Fi router in the room.
There is no password on the router.
photo credit: epa.gov
![Page 7: Harassment at](https://reader033.vdocuments.mx/reader033/viewer/2022061514/56813a2c550346895da21388/html5/thumbnails/7.jpg)
To find out what's going on, Nitroba's IT sets up a packet sniffer
Who is sending the harassing mail?
![Page 8: Harassment at](https://reader033.vdocuments.mx/reader033/viewer/2022061514/56813a2c550346895da21388/html5/thumbnails/8.jpg)
Now we wait
![Page 9: Harassment at](https://reader033.vdocuments.mx/reader033/viewer/2022061514/56813a2c550346895da21388/html5/thumbnails/9.jpg)
The guy attacked!
![Page 10: Harassment at](https://reader033.vdocuments.mx/reader033/viewer/2022061514/56813a2c550346895da21388/html5/thumbnails/10.jpg)
And here is the message:
![Page 11: Harassment at](https://reader033.vdocuments.mx/reader033/viewer/2022061514/56813a2c550346895da21388/html5/thumbnails/11.jpg)
No, here is the message
![Page 12: Harassment at](https://reader033.vdocuments.mx/reader033/viewer/2022061514/56813a2c550346895da21388/html5/thumbnails/12.jpg)
And there goes the message:
![Page 13: Harassment at](https://reader033.vdocuments.mx/reader033/viewer/2022061514/56813a2c550346895da21388/html5/thumbnails/13.jpg)
So who did it?
Chemistry 109 class list:
Teacher: Lily Tuckrige
Students:
Amy Smith
Burt Greedom
Tuck Gorge
Ava Book
Johnny Coach
Jeremy Ledvkin
Nancy Colburne
Tamara Perkins
Esther Pringle
Asar Misrad
Jenny Kant
![Page 14: Harassment at](https://reader033.vdocuments.mx/reader033/viewer/2022061514/56813a2c550346895da21388/html5/thumbnails/14.jpg)
How to solve this problem:
Map out the Nitroba dorm room network.
Find who sent email to [email protected]
• Look for a TCP flow that includes the hostile message
• Find information that can tie that message to a particular web browser.
Identify the other TCP connections that below to the attacker
Find information in one of those TCP connections that IDs the attacker.