https://forensicscontest.com/2009/09/25/puzzle-1-anns-bad-aim
vidence01.txt
Document
これは下記背景のもと取得されたパケットです。
背景
Anarchy-R-Us, Inc. suspects that one of their employees, Ann Dercover, is really a secret agent working for their competitor. Ann has access to the company’s prize asset, the secret recipe. Security staff are worried that Ann may try to leak the company’s secret recipe.
Security staff have been monitoring Ann’s activity for some time, but haven’t found anything suspicious– until now. Today an unexpected laptop briefly appeared on the company wireless network. Staff hypothesize it may have been someone in the parking lot, because no strangers were seen in the building. Ann’s computer, (192.168.1.158) sent IMs over the wireless network to this computer. The rogue laptop disappeared shortly thereafter.
“We have a packet capture of the activity,” said security staff, “but we can’t figure out what’s going on. Can you help?”
このパケットを解析して次の問題に答えてください。
- What is the name of Ann’s IM buddy?
また、解答に使用したパケット番号を答えてください
名前が直接わからない場合は、IMを始めて開始したと思われるパケットの番号を教えてください。私がそのパケット番号をもとに解析します。