GCIH · Question #405
An incident handler investigating abnormal system behavior has captured traffic from two client workstations. Both clients sent dozens of SYN packets to an external host WW3.ACME.NET on port 80. In…
The correct answer is C. Whether the clients are infected and using crafted packets to transmit information. The asymmetry between the infected clients' SYN-RST pattern and the investigator's normal traffic indicates the clients may be using crafted TCP packets as a covert data exfiltration channel.
Question
An incident handler investigating abnormal system behavior has captured traffic from two client workstations. Both clients sent dozens of SYN packets to an external host WW3.ACME.NET on port 80. In response, WW3.ACME.NET returned RST packets. When the incident handler browses to WW3.ACME.NET on port 80 from a workstation reserved for incident investigations, the traffic patterns do not match what is seen on the other two clients. Based on this information, what should the incident handler look for next?
Options
- AWhether an IPS is identifying the outbound client traffic as malicious and blocking it.
- BWhether the external server is controlling infected hosts to map the internal network.
- CWhether the clients are infected and using crafted packets to transmit information.
- DWhether a firewall between the clients and external host is dropping packets.
How the community answered
(46 responses)- A7% (3)
- B28% (13)
- C54% (25)
- D11% (5)
Why each option
The asymmetry between the infected clients' SYN-RST pattern and the investigator's normal traffic indicates the clients may be using crafted TCP packets as a covert data exfiltration channel.
An IPS dropping outbound traffic would prevent the SYN packets from reaching the external host, yet RST responses are being received, proving the packets are reaching their destination.
The external server returning RST packets indicates it is not accepting TCP connections, making it implausible that it is actively commanding infected hosts.
Malware can encode data inside TCP header fields such as the initial sequence number, IP identification field, or TCP options while appearing to initiate normal HTTP connections. The RST responses from the server are expected and irrelevant to the covert channel - the malware extracts meaning from the packets themselves, not from a completed TCP session. The investigator's different traffic pattern confirms the clients are not performing ordinary browsing.
A firewall dropping packets would result in no response at all - the fact that RST packets are returned to the clients rules out packet-dropping as the explanation.
Concept tested: Covert channel detection via crafted TCP packet analysis
Source: https://www.sans.org/white-papers/covert-channels-tcp-ip/
Topics
Community Discussion
No community discussion yet for this question.