It was a busy day at [REDACTED]. Any day that four major airports experienced coordinated attacks would be a busy day at [REDACTED], given how it handled [REDACTED] for the entire [REDACTED] in the US of A. Shuttle van mortar attacks at LAX, DFW, and Atlanta; taxi car bombs at Reagan International. It was going to be a busy day for many, many days at [REDACTED]…
Dinah White left the briefing room and glanced at her tablet. Cube FR-227C. She was going to work with whoever was in that cube on DFW intel. Full network packet captures, courtesy of [REDACTED].
OK, FR-227C… that was on this floor… a check of cube numbers… and they’re going that way, so the cube is on the left. She turned left and walked past five rows, then turned right and went all the way to the last cube on the right, just before the wall.
The nameplate said “Chandni Kapoor.” Cool, another woman. Dinah did not spend much time contemplating this victory for women in the IT workplace because she had a job to do. So she knocked on the metal on top of the cube wall. Chandni finished the last two words of her email, sent it, and swiveled in her chair to face Dinah.
Dinah smiled. “You ready for this?”
Chandni nodded. “There’s nobody in the cube behind you, so you can grab that chair.” Dinah grabbed said chair and moved it into Chandni’s cube. Chandni fired up her Wireshark and loaded the capture file from the DFW Airport shuttle van SSID. It was a beast-size file, six hours of capture, 137 MB of TCP, UDP, EAPOL, ICMP, and beacon frames. This was no teevee show dealing with h4xx0rz. This was reality, all 137 MB of it.
And Chandni knew how to deal with it. “How do you want to slice this up? Hour by hour?”
Dinah had another thought. “I’d like to filter on a MAC address of one of the vans, see if we can find suspicious traffic, and then see if it matches on other van MACs.”
Chandni inspected her screen. She highlighted frame number 20. No particular reason. It just looked like a good frame to start with. “Start with this one?”
“Sure.”
Chandni right-clicked the destination MAC address and selected to filter on it. “OK, let’s get lunch.” They both laughed a little. This was going to take a while. Chandni didn’t like dead air. “Who do you think did this?”
Dinah shook her head. It didn’t pay to speculate at [REDACTED]. “No idea. I like to keep my mind clear. We don’t want a preconceived notion to color our results. We deal with the evidence that’s here, not the evidence we want to be here to prove our hunch right.”
Chandni looked a little beat-down. Dinah immediately regretted coming down like a hardass. “It could have been anyone, really. You know how these vans run, so you’ll tell me who did it, when you know. I’m just here to be another pair of eyes for management.”
Chandni smirked a tiny smirk. Dinah went for a closer. “And, hey, if you really want to find something in a mess, send two women, am I right?” That got Chandni to laugh and the working relationship on better footing.
Wireshark finished its work and then Chandni went to the filter field and typed in the || to add the condition to also filter on that MAC address as a source. Wireshark thrashed accordingly. Once the filters were complete, she exported the packets – about 2% of the total capture – to a new PCAP file. She closed the original file and opened up the much more manageable 3 MB capture.
There were still over 100000 packets, but that was much more preferable than what was packed into the original capture. Chandni started paging down through the packets, focused on source and destination addresses. It wasn’t three pages before she noticed something. “It’s all coming and going from that address there.” She pointed at the address in question. “What is that, the main control station or something?”
Dinah scrolled through her briefing materials on her tablet. “What are the last four letters in that address?”
“45CB.”
Dinah found an address that ended with those letters and squinted back and forth from Chandni’s screen to her tablet to confirm that, yes, it was a wireless tower. “Go ahead and cut that from the capture. Both source and destination. See if there’s an outside source sending instructions.”
Chandni filtered and then they both went through the remaining packets, filtering further on conversations with legitimate DFW towers. They got to the last 2300 packets, and they were all to and from the tower in Terminal D, where the van’s movement had been halted by an agent with an EMP gun that had happened to be on the scene. Chandni let go of her mouse and leaned back in her chair. “All the traffic was from the towers. Nothing outside.”
Dinah didn’t like that, either. Outside source of transmissions would have made things easier. She did not relish trying to sort commands from authentication and keepalive traffic in this stream and then seeing if there was a matching pattern in the other vans’ traffic. Ugh.
“Umm… what about the grenade launchers in the vans? When did they start firing?” Chandni had a great idea.
“Load up the main capture, and let’s take a look at the moment everything started firing. Better, chop off the last 20 minutes and look there. If the things weren’t integrated in the van systems, and I’ll bet they weren’t, I’ll say you’re right in about half an hour, when we see the commands.”
Chandni never loaded a massive capture file with more enthusiasm than she did at that moment. She went to the end of the capture, scrolled up to 1200 seconds before the time of the last packet, highlighted a frame, hit SHIFT CTRL END and became crestfallen when her keyboard shortcut-fu failed to highlight the packets she wanted to export.
She left the last packet highlighted, scrolled up to the packet 1200 seconds before the last one, SHIFT-clicked and got the right packets selected. Stupid Wireshark. Deep down, she knew the program wasn’t to blame, but, like everyone in IT, felt better about things when she cursed the computer.
Dinah read off known MAC addresses of the passenger vans and Chandni filtered them out, one by one, until only a few hundred packets remained. Communications to and from the grenade launchers. Chandni exulted, “High five!”
Dinah returned the gesture, taking special care to look at Chandni’s elbow, so as to not mess up the celebrations. But, in that moment of analytical-mindedness, she had a realization. “Hang on, how did the grenade launchers get on the shuttle van SSID?”
Chandni and Dinah pored over the re-authentication traffic that happened as the weapons moved between tower coverage areas. That traffic was more fascinating to them than the commands sent over the wireless to activate them. These things were getting RADIUS-Accept packets from the wireless controller, like they were supposed to be on that network. Who set them up with that kind of access? And the command and control IP address – that was somewhere on the inside of DFW sending the commands.
Filtering on the C&C IP address, Chandni showed it was the source of all the communications, vans and weapons alike. How did that get set up?
For all the network captures at [REDACTED], Dinah figured that not one of them would answer that question or any of the others that came up after the high-five. Someone was going to have to get into DFW’s RADIUS server setup and look over its settings. Hopefully, whoever permitted the weapons on the network didn’t erase the admin logs. And then, there was the matter of the C&C server embedded in DFW’s infrastructure…
But that was for someone else to dig into. Dinah kept focus. “Get the capture of the C&C traffic off to [REDACTED] and let them see if it’s a pattern anywhere else in [REDACTED] or anywhere else we’re [REDACTED] the routers.”
“Is it usable? I mean, it’s encrypted and there’s no guarantee the guy sending it didn’t use Tor or a randomizer on the order the packets were sent. Or stuff like that.”
“Oh, it’s usable. Have you had a class in side-channel traffic analysis?”
“No.”
Dinah smiled. “You should sign up for one. Amazing stuff. Everyone at [REDACTED] should take it. Be sure to get [REDACTED] as your instructor. I had him, and he’s [REDACTED].”
Chandni, thankful for the career advice nodded and said, “[REDACTED]” And then, she emailed the C&C traffic to [REDACTED] while Dinah placed a call to the lead agent on the scene at DFW.