start	end	text
26940	30240	Hey, is that Finnish kid Miko here at all?
30750	32340	The Finnish kid?
32520	33840	Yeah.
34020	35880	Nah, I guess not.
43540	44580	Foundation.
44620	51350	It's a sad, sad state of affairs.
56780	57500	Hello.
57500	61200	Welcome to Linguistic Platform for Threat Development,
61200	63460	the Extreme Hangover Edition.
63860	67280	I'm Ben Kurtz, I work for a company called Imperfect Networks
67280	68930	out in Burlington, Massachusetts.
70790	73790	Today I'm going to talk to you about what I have cooked up
73790	76810	over the past year, why I did it,
76810	78910	and how it can help you do what you do.
88550	90550	That's all well and good, but basically I'm going to talk
90550	93990	about a design pattern for a...
94790	97830	I'm going to give you a view from like 30,000 feet,
97830	100770	it's just going to be like a broad overview,
100770	102250	real abstract.
102250	104870	I don't really have the time to go into the sort of details
104870	109650	I'd like, but let's see.
109870	112270	By applying some often overlooked corners
112270	114310	of programming language theory to the development
114310	116830	of network attacks, we can create a new type
116830	119910	of threat platform which can handle every conceivable
119910	123590	network protocol and run readily on any architecture
123590	125430	that can handle embedded Linux.
125730	127870	The ultimate goal is to reduce the total time
127870	130470	to develop a threat to the time it takes to research
130470	135790	and understand its behavior, plus two minutes or so.
135950	137990	Once the threat is implemented, we also want
137990	139870	the ability to store it in a database
139870	142110	and play it back whenever.
145870	149890	This presentation is divided into four sections, roughly.
150250	151500	First, we'll look at the motivations
152030	154650	for a new threat platform, which is hopefully
154650	156470	not going to be too dull.
156770	158910	Second, we'll take a closer look at what we need
158910	161230	threats for and how the threat development
161230	162970	and testing cycle works.
162970	165270	The reason I'm going to go through that is because
165910	168630	many people here look at threat development
168630	170950	and threat testing from an enterprise standpoint
170950	174010	or a pen testing standpoint, and I'm kind of
174010	175610	coming at it from a slightly different angle.
175610	177730	I need to encompass a broader spectrum
177730	179890	of threats in a single system.
180230	183850	I'm looking at it more from a manufacturing testing
183850	186250	and regression testing standpoint.
187810	189530	I'm going to take a little time and reframe
190450	195110	what threat testing is in terms of the talk.
196730	199490	Next, we'll summarize the design goals
199490	201730	of the new system, then we get into the good bit.
201810	204530	We'll look at some ideas from programming language theory
204530	207990	and how we can use them to get what we want.
209810	211690	Now, motivation.
214150	216010	Why do we want a threat development platform
216010	217210	in the first place?
217570	220230	Simply, we want to break stuff.
221030	223970	We want to break stuff and we're incredibly lazy.
224290	227610	We want a tool that makes it easier to break stuff quickly.
228010	229330	We also want to minimize the time
229330	231290	from the first rumor we hear of a new threat
231290	233210	to the ability to play it back on the wire
233210	234530	with the touch of a button.
235190	237430	Being up to date on new threats is a foot race
237430	240050	and anything that helps us go faster is our friend.
245430	247270	Why do we want to break stuff?
248170	249930	There's two main reasons
249930	253250	along the standard black hat, white hat divide.
253870	256170	What I'm focusing on is we want to break
256170	259190	network equipment and services that we develop and use
259190	261110	so we can assure our customers
261110	264250	of some degree of protection and reliability.
265130	267930	There is no trust without testing.
268150	270890	A lot of things are advertised as being secure
270890	275150	and that's never been verified by anybody in many cases.
275150	277950	And on the other side,
277950	282110	we want to break stuff because we have malice in our hearts.
282910	285250	Like any powerful technology,
285330	288830	a threat platform can be a tool of assurance or a weapon.
288930	291790	Since the malicious uses are fairly obvious,
291790	294130	developing a threat and executing it quickly
294130	296830	with a great amount of throughput,
296830	299530	I won't really revisit this.
300190	303390	Many security products such as intrusion detection systems
303390	304710	are developed and brought to market
304710	308050	with little or no testing against real live threats.
308510	310610	Usually they're tested against a small set
310610	312370	of handcrafted sample traffic
312370	316070	that is designed to trigger existing threat signatures in the IDS.
316210	319010	This means that the test cases are usually written
319010	321470	to test what the IDS already does
321470	325030	rather than to test its ability to protect against real threats.
326630	328390	At some point you're going to have to test
328390	331190	your network security products against real attacks
331190	336070	rather than, you know, just handcrafted stuff.
336070	337530	Otherwise you're providing your customers
337530	339450	with only the illusion of security.
343640	346340	There are numerous places that release vulnerabilities
346340	348260	or exploits to the public.
348500	351520	You probably all know most of these.
351520	356160	You've got BugTrack, Security Focus, Full Disclosure,
356160	356740	Mike Lynn...
359080	360720	That's a drink.
360720	362640	As soon as an exploit shows up on the net
362640	365300	every potential attacker has access to it.
366440	367320	Me?
369460	370560	I do?
373930	376010	I've got to put a stop to that right now.
377730	378610	Alright.
379470	380910	You need to know that you're safe
380910	383410	from each new threat as soon as it becomes public.
384750	386550	Private threats are kind of an unknown quantity
386550	389710	but you can definitely keep up with the mailing list.
389710	392810	You have to do this partly out of prudence
392810	395230	and partly because your boss called you in a panic
395230	396910	because his boss called him in a panic
396910	398610	because the CEO called him in a panic
398610	400750	after hearing about some worm on the news.
401510	403890	The threat developer needs to stay on top of the
403890	406470	the O-Day threats, mostly to be able to say
406470	408530	yes, we've already accounted for that
408530	410290	and we're testing against it.
411730	413170	You could just say this anyway
413170	414790	but you're still going to want to actually go out
414790	417730	and do the work before anyone checks up on you.
418910	422330	To be assured that you can handle all publicly known threats
422330	424270	you have to keep up the mailing lists.
424710	427850	Zero-day protection requires zero-day testing.
431370	433130	Honestly, there's only three steps here
433130	435470	but it looks better with five.
437310	439890	We're going to spend a few minutes talking about threat testing.
439890	443270	This is from a manufacturing, network equipment manufacturer standpoint
443270	445010	rather than from a pen testing
445010	449430	or enterprise security testing standpoint.
450390	452990	For each new threat that you want to develop and test
453170	455270	a threat developer goes through several steps.
455470	457570	And that's three, not five.
458510	460070	First, the threat must be researched.
460070	461550	You have to figure out what it targets,
461550	464390	what the packets look like, what protocols it uses,
464390	466370	how it behaves, and so on.
467530	469010	Next, you have to implement the threat
469010	472130	which means writing the PERL code or the C code.
472130	474510	And finally, your service or equipment is tested
474510	477310	against the new threat to see if it's vulnerable.
478570	480690	Then you begin the cycle again with the next threat
480690	485830	or sometimes developing one will lead you to another like a variant.
489810	491890	All these steps can be very time consuming
491890	495730	to the point that many QA departments don't bother.
496370	500130	The time period from when an exploit first enters the public domain
500130	502210	until you release a patch to defend against it
502210	503710	is your window of vulnerability.
504350	506270	The testing side of the equation is at
506450	508330	a serious disadvantage from the start
508330	510250	since a would-be attacker can usually
510250	512350	just download sample code for an exploit
512350	513810	and go to town.
514430	516350	If it takes two weeks to research,
516350	517530	implement, and test a threat,
517530	520070	that's including all your QA guys' vacation times,
520070	521830	coffee breaks, and so on.
522110	523290	Mind sweeper.
525070	526850	But if it takes you two weeks to research,
526850	527930	implement, and test a threat,
527930	529610	your window of vulnerability is two weeks
529610	532690	where an attacker doesn't need more than an hour or two
532690	536850	and that's a pretty conservative estimate.
538610	541490	It's easier to break something than it is to fix it.
543390	545870	So if you're on the defense, you have a disadvantage.
547790	550230	So what are your options to speed up threat turnaround time
550230	552850	and to minimize your window of vulnerability?
553670	555290	Your first option is to hire more people
555290	557210	to handle the daily updates.
557210	559410	Some places have upwards of 20 employees
559730	562210	working on researching and implementing new threats
562210	563770	as they come out.
564150	566650	Some places. No names.
567010	570090	This approach allows you to deal with more threats concurrently,
570090	572730	but each threat must be developed and tested in parallel
572730	575810	using the same time-consuming tools.
576370	578130	So for any single threat,
578130	580530	your window of vulnerability remains the same.
580670	582570	It's kind of like, you know,
582570	586310	you can't parallelize baby creation.
586310	589090	From start to finish it takes a certain amount of time,
589090	590990	given a certain set of tools.
597170	599350	Alright, I'll drink for that one.
607740	609620	The second option is to improve the tools
609620	612180	that threat developers use to speed up the process
612180	614140	of developing a single threat.
614340	616160	And that's what we're going to talk about.
616160	618480	By automating the common and repetitive tasks
619080	620480	associated with threat development
620480	622900	and by only forcing a developer
622900	625940	to describe the unique aspects of a threat,
625940	628750	the threat turnaround time can be greatly reduced.
635220	637880	This is probably not a popular idea.
637880	639760	I love my job.
640000	642880	My inclination is to say, hey, we'll hire more people.
642880	646280	We'll give more people jobs that they can love.
646740	648840	But this is an expensive proposition.
648840	650080	You suck.
658990	660990	I'm trying not to.
661110	663010	Peer pressure, you know.
667590	670190	That was your fault, man.
673110	674730	You have a drinking song?
681010	683110	He just did.
683230	693540	This is going downhill quickly.
697840	727210	I'm Ben Kurtz.
767980	771780	This is tequila, you know.
779030	780270	Yeah.
783830	786350	Only in the morning, right.
789850	790790	All right.
795630	796350	Very good.
796350	797950	Well, I've got to press on.
797950	799250	Or I'm going to run over.
802730	805890	I can't actually focus on my notes at the moment.
808170	809210	All right.
809490	811490	So, where was I?
811490	813890	We were talking about hiring more people, right.
814690	816610	Or not hiring more people, right.
816610	818770	It's an expensive proposition for a smaller company
818770	821870	and a difficult proposition for a larger company.
822730	828530	If you look around this conference, you guys and your friends back home are pretty much the hiring pool for our entire country.
829590	833370	Yeah, it's a problem.
836610	839230	There aren't really any college curriculums that teach this stuff
839230	845230	and it can be incredibly difficult to find the sort of employees with the passion and personal drive to learn it on their own.
845230	847150	Which is you guys, really.
850470	856330	Even if you do find a skilled security guru, you're going to want to maximize his or her output.
856370	858690	This means we need better tools.
862970	866590	There are a couple of existing threat platforms.
868290	870690	Metasploit is pretty cool.
870690	875870	It gives you a mix and match ability with exploits written in Perl and various types of shell codes.
875870	878430	The downside is that the scope of the attacks are limited
878430	883830	and it's difficult to add new exploits quickly even if you know Perl.
883870	890330	It doesn't provide an easy interface or any regression testing tools or reporting.
891130	894670	There's also Canvas which is similar but in Python.
895590	897730	Metasploit and Canvas are good at what they do
897730	902310	which is primarily running exploits that will result in control of a box.
902310	905170	It's more of an enterprise pen testing type solution.
905170	911650	They don't really deal with denial of service or worm simulation or man-in-the-middle attacks or fuzzing
911650	918570	or a variety of other types of threats that concern IDS vendors or network equipment manufacturers.
918890	923590	We also have Nessus which is primarily an auditing tool
923590	928290	and is designed to report on vulnerable version numbers of services
928290	933430	and to avoid running an actual exploit as much as possible.
934350	938650	It's great for use on a live network where you don't really want to break anything.
939530	948670	It's not so great for testing with live threats on network equipment, IDS systems, stuff like that.
949870	958590	Historically speaking, the most widely used threat platform has been Perl or C with some escaped shellcode.
959450	965690	Many threat developers are of the opinion that if you can't write an exploit in Perl, you have no business messing with it.
966090	973190	This is kind of a societal safety valve, but it stands in the way of speed and efficiency in threat development.
974110	979730	IDS vendors and network equipment manufacturers just want a QA guy to check off a list of threats
979730	983350	and run a test, see what happens.
983350	991550	When the CEO hears about a new threat on the news, he wants assurance that his product copes with it quickly.
991550	996850	There isn't a lot of time for inefficiency, which means mucking about with Perl.
997690	1006450	So, a new threat platform has to provide the versatility to handle all types of attacks, not just shellcode exploits.
1006450	1013990	It has to include tools to develop new threats quickly and the ability to run live threats,
1013990	1019370	not just to check to see if something might possibly be vulnerable. You want to know yes or no.
1023860	1029520	So, we're past the boring bit. We're on to the good stuff.
1029820	1033700	We've talked a bit about the problems we're hoping to solve with our new systems,
1033700	1037480	so now we're on to our wish list, the design goals of our new platform.
1037480	1044800	We want one tool that can handle all possible threats, including exploit shellcode, denial of service, man-in-the-middle, and fuzzing.
1045060	1049460	We don't want to limit ourselves to running on a particular hardware architecture.
1049760	1058160	We might want to run from a laptop, or from a blade server, or from every blade in a bunch of...
1058160	1060460	Wow, sorry, tequila moment.
1063240	1066980	Racks? Ah, that's the word. Good deal. Yeah, one more.
1073760	1077240	We also don't want to limit ourselves to a particular network medium.
1078100	1082960	We want to be able to handle copper pairs, but we also want to do fiber and wireless.
1083620	1088480	Additionally, we want to be able to target anything, regardless of what it is or where it is on the network.
1088480	1095360	We're not limiting ourselves to services. In fact, we're focusing on hardware-level testing.
1097320	1102760	Since it's often the case that a developer gets a packet capture of an attack before it's even identified,
1102760	1109560	we need to support PCAP imports into our system, so you can import a PCAP file, edit it, and play it back.
1110460	1116200	To accurately reproduce some types of network threats, such as a man-in-the-middle or a DDoS,
1116200	1121800	we need the ability to support playback of network traffic from multiple sources on a network.
1123100	1130720	We're going to require a distributed architecture where we can have a number of different threat engines on a network
1130720	1136800	that can all play back different roles of a conversation, like something you import from a PCAP file.
1137980	1142060	To accurately reproduce some types of network... oh, I just did that one.
1142060	1148420	Our tool is going to have a few bells and whistles that make it easier to use as a threat testing platform,
1148420	1153000	including the collection and aggregation of a variety of statistics.
1153940	1158160	But statistics are insanely boring, so I'm going to skip over that bit.
1158280	1165160	Since the execution of one threat might involve playback from different network nodes,
1165160	1167220	the statistics have to be aggregated.
1168520	1172920	And that will happen... we'll get into that in a little bit.
1176010	1177570	Wow, I've got to take a moment.
1180610	1181830	You guys suck.
1192130	1194450	This is harder than it looks, guys, come on.
1195830	1196710	Alright.
1197750	1203830	Now we're going to do a quick review of some of the concepts of programming language theory we use in this system.
1203970	1209830	By quick, I mean that this is probably going to go right over your heads if you never took a Foundations of CS class.
1209950	1217890	But the reason I feel comfortable kind of skimming over it is that there's tons of books on this subject written by people much smarter than I am.
1218550	1226150	So, if you haven't taken a Foundations class, this is basically a list of words to put into Google or Wikipedia.
1228630	1236250	The bits we're interested in are all related to languages and translating one language to another, which is pretty much all of programming language theory.
1236350	1243710	The most important concept is the idea of a grammar, which is a set of formal rules describing the structure of valid expressions in a language.
1244250	1246230	Grammars serve two purposes.
1247490	1255010	They can be used generatively to produce valid expressions, or they can be used to determine whether a given string is a valid expression in a language.
1255010	1256930	So it's kind of like an input and output.
1256990	1262050	You can use a grammar to generate an output, or you can use a grammar to interpret an input.
1263090	1275110	The most common method of describing a grammar is the extended Bacchus-Noer form, or eBNF, which we'll touch on briefly later, but that's something I'll have to Google.
1278590	1284610	Compilers. A compiler is something that translates a valid expression in one language to a valid expression in another language.
1284610	1286790	It's basically a language translator.
1288170	1296210	The compilers you're used to translate from a programming language like C to a particular architecture's instruction language.
1296470	1304470	Or another one that many people are familiar with is the Java compiler, which translates from the Java language to Java bytecode.
1304670	1307630	A compiler makes use of two grammars.
1307750	1313070	The grammar of the input language for Java would be the Java language spec.
1313070	1317810	And the grammar of the output language, in this case bytecode.
1319770	1324970	It uses the input grammar for validation and the output grammar for generation.
1325670	1329510	Compilers work in four stages. I'm just going to skim through this.
1329510	1335210	First is lexing, where the input expression is broken into tokens based on whitespace and other syntax.
1336290	1338510	Next, these tokens are parsed.
1338510	1344510	During the parse, the input grammar is used to build a parse tree, which represents the meaning of the expression.
1344730	1350670	This meaning is stored in an internal data structure called the intermediate representation.
1351470	1361650	And finally, the output grammar is applied to the intermediate representation to generate a valid expression in the destination language that has the same meaning as the original expression.
1367690	1373550	So, this is the key part.
1373890	1375690	The parser generator.
1376170	1383890	A parser generator is just a special compiler that can read its input and output grammars dynamically at runtime.
1384550	1391090	So it's sort of like a general purpose compiler that you can use to translate any one language to any other language.
1393070	1397670	You may have heard of YACC or Java CC.
1400930	1401970	Bison?
1403550	1408130	Yeah, Bison, YACC, Lex, that suite of tools like Java CC.
1409050	1412590	If I had any books left, I'd give you one. I should have held out.
1414070	1416030	I'm switching to water.
1419330	1420850	Please.
1422790	1424710	It's true.
1427170	1428690	Okay.
1428690	1435090	YACC and Java CC predominantly just generate parsing code for eBNF grammars.
1435090	1443230	They take eBNF grammars in as an input and then those two tools are fixed for their output grammar.
1443230	1447570	So Java CC puts out Java code that parses an eBNF spec.
1447950	1451710	Not the spec, but the grammar specified by an eBNF file.
1452250	1462070	The advantage of a parser generator over a compiler is that it's very easy to modify and update the input and output languages without code changes.
1462190	1466830	You can simply update the grammar specifications and reload them.
1467170	1471270	Because it's so easy to add support for a new grammar to a parser generator,
1471270	1478130	they're good for situations where you have to deal with a large number of different languages and constantly add support for new ones.
1478830	1483350	An example of such a situation...
1486970	1488670	Network protocols.
1489110	1494550	One of our stated goals is that we want one system to handle all possible threats.
1494790	1498690	We want to be able to fuzz each field of every protocol.
1498830	1502850	We want to deliver a malicious payload in every protocol.
1502850	1507750	And we want to be able to intelligently DOS every protocol.
1508290	1515110	And we want to be able to import PCAP files in any protocol, edit them, and play them back.
1518070	1525410	I'm way too lazy to code and debug all this support for every possible protocol.
1526210	1528330	Fortunately, there's a shortcut.
1531560	1537760	Network protocols are languages that are designed to be easily handled by low-level code.
1538300	1541320	As a result, most of them are very simple.
1541800	1546660	In fact, if you exclude things like checksums and internet header lengths,
1546660	1552320	network protocols can be represented by the simplest subset of grammars, the normal grammars.
1553740	1558020	This allows us to make a lot of assumptions in writing our parser generator,
1558020	1562480	which simplifies the code and speeds things up immensely.
1564340	1570260	We deal with checksums and internet header lengths at the engine level, which we'll get to in a little bit.
1570780	1577660	So we're going to use grammars to represent network protocols, both to understand incoming traffic and to generate outgoing traffic.
1577740	1583780	Since there are an insanely large number of protocols out there, both public and proprietary,
1583780	1589820	the parser generator will allow us to easily add support for new protocols without mucking about with our code.
1598230	1602870	Each network protocol we specify is essentially just an ordered list of fields.
1602970	1606890	Most protocols allow other protocols to be encapsulated in them.
1606930	1613650	We handle this encapsulation, I'm going to call it stacking, of protocols by using a special rule,
1613650	1618810	it's kind of like a non-terminal, called the payload rule, in each of our protocol grammars.
1618810	1620770	You'll see this in a little bit.
1621290	1628090	Each protocol that allows encapsulation will have a payload rule that can be made to point at either another protocol's grammar
1628590	1632750	or to a chunk of arbitrary binary information, like a shellcode.
1641170	1646510	This is the simplest example of a protocol specification, and it's for Ethernet.
1648790	1655070	The start rule goes to just Ethernet, and the Ethernet production rule,
1655070	1657650	on the right hand side is just the list of fields in Ethernet.
1657650	1660870	You've got source MAC, desk MAC, packet type, and the payload rule,
1660870	1666670	which is what would point to whatever you're encapsulating in Ethernet.
1668230	1676030	The various fields go to regular expressions that you can use to validate them.
1676030	1684130	You've got hex fields from 1-bit length, some of them are like 13 bits,
1684130	1688450	they're very strange sizes, up to like 64 or 128 bits.
1688450	1693030	But some of the data types people are used to seeing in human-readable form,
1693650	1696970	IP addresses, MAC addresses, and stuff like this.
1697410	1703910	So you can keep your regular expressions for those types of data type validations in a common location,
1703910	1708670	and refer to them within your specific protocol definitions.
1717750	1721410	One thing that's not on here, but that's important to mention,
1721410	1725230	is that we can't just use a normal grammar like this,
1725230	1728430	we also need to decorate the grammar with a little bit of additional information,
1728430	1732710	which allows us to generate packet streams correctly,
1732710	1736150	and to correctly deal with PCAP imports.
1736150	1740850	The most important thing is that each field needs to be marked with its bit length,
1740850	1745250	so that you know how many bits to read in, how many bits to put out.
1752350	1759150	So each of these protocol definitions is a template for creating a series of packets.
1759350	1766490	The user will be able to stack these templates to create a representation of any type of encapsulated network traffic.
1766590	1770670	A common protocol stack involves combining three different protocol definitions,
1770670	1773430	Ethernet, IP, and TCP.
1775130	1779510	Ethernet's payload points to IP, IP's payload points to TCP,
1779510	1788150	and TCP's payload will be, it could be empty, or it could be a shellcode, or any chunk of binary.
1799270	1799950	Well...
1801270	1803910	Some protocols are a little bit more complicated,
1803910	1808090	and can have a number of different forms based on a type field.
1808090	1815050	Examples of some of these protocols are ICMP, DHCP, and OSPF.
1815050	1820070	We can still deal with these protocols by splitting up their definitions into separate chunks.
1820070	1826210	It's kind of like making lookahead tables, if anyone's written a compiler before.
1830560	1832680	I'm so good with Daya.
1835950	1841590	Here's an example for OSPF, which has several different packet types.
1841730	1844870	All of the different OSPF packets share a common header,
1844870	1848870	which contains the type field indicating what the rest of the packet looks like.
1849050	1854250	To handle this situation, we can simply create a protocol definition to represent the header,
1854250	1857430	and a separate definition for each of the packet types.
1857430	1865650	What I have been calling protocol definitions is actually somewhat inaccurate,
1865650	1872390	because you may be using more than one of these grammar chunks to define a particular protocol.
1873870	1877910	OSPF, I think, has six different packet types?
1878170	1879690	Is it five?
1879690	1884710	So you'd have the header, and then five subtypes that would follow from there.
1889710	1893910	This is something we do in order to keep using normal grammars,
1893910	1898210	so we can keep our nice assumptions about how to write our parser generator.
1899090	1902770	Does anyone in here know about the LLK algorithm?
1904510	1905750	LLK?
1909550	1910630	Right.
1910630	1915910	LLK basically just keeps increasing the lookahead until it finds a match.
1916010	1919950	So it's pretty inefficient from a code standpoint.
1921530	1926790	Using this scheme, basically breaking off the header allows us to avoid going into LLK territory,
1926790	1928530	which keeps our code very simple.
1934330	1935970	Man, this tequila.
1936510	1938290	It's getting on top of me.
1939310	1943550	The basic flow of creating a threat file goes like this.
1945770	1946730	Is it?
1949290	1950330	No, it's not...
1951390	1953070	Thank you.
1954430	1956110	Bunch of sadists.
1957310	1960490	The protocol definitions are loaded into a GUI.
1960950	1964610	The GUI examines the protocol files for information about fields,
1964610	1966570	and what sort of data types they're expecting,
1966570	1972970	so that it can represent the values of the various fields in the way that the user is expecting.
1973090	1976750	This is really only an issue for Mac addresses and IP addresses.
1976890	1980750	For your 13-bit HEX field, no one's expecting anything other than HEX.
1984270	1990730	The user then creates a threat file by selecting which protocols to use and filling in the fields.
1991030	1993770	This information is fed into the parser generator,
1993770	1997510	which uses the selected protocol definitions as the input grammar,
1997510	2003130	and outputs to a threat file, which can be stored in a database for later use.
2009290	2012510	The GUI provides the user with three abilities.
2012510	2020610	First, the user can select and stack protocols to create an arbitrary encapsulation of network protocols.
2020750	2025450	Second, the user can arrange any number of these stacks in any order,
2025450	2030470	and define the behavior of the threat in terms of iteration or looping.
2030530	2037310	And finally, the user can assign functions, variables, or values to any field of any protocol.
2047570	2049370	Here's a sample screenshot.
2050470	2054410	It's an example of how a GUI can be used to create a protocol stack.
2055230	2062450	All of the protocols or subsections of protocols that we have defined appear on the left,
2062450	2065170	and your stack appears on the right.
2065750	2071630	The interface must allow you to create any protocol stack you want, even ones that are complete madness.
2073290	2078370	If you want to do three levels of Ethernet or something, we can't limit that in the GUI,
2078370	2081430	because you have no idea what people are going to want to do.
2081430	2083330	You're trying to create bad traffic.
2083830	2092630	So you can't hold the users of your interface to any kind of sane standards.
2093490	2095270	Common sense no longer applies.
2099490	2105170	The interface also allows you to add a series of outputs of any combination of protocols.
2105790	2107390	It's pretty simple.
2107710	2112410	In this example, the left panel shows you a list of the available protocol stacks,
2112410	2117910	and the user just chooses a stack and adds an empty instance of it to the series,
2117910	2120690	which is on the right, although there's only one thing in the series.
2122630	2124510	It's kind of like Ethereal, actually.
2126330	2129090	You all have looked at PCAP files in Ethereal, I'm assuming.
2129090	2134770	When you see a packet capture in Ethereal, in the middle panel, you see this expandable tree,
2134770	2137050	and it's broken out by Ethernet frames.
2137330	2140250	So you see your first frame, your second frame, your third frame.
2140250	2147430	When you open those up, you see all of the protocols that are in that stack, essentially.
2147950	2154210	So what I'm calling a stack is everything that's encapsulated in one Ethernet frame in Ethereal.
2154210	2159150	And what I'm calling a series is like your list of all the frames.
2159470	2164850	So basically, our GUI allows you to create these structures rather than just viewing them.
2164870	2170450	And we'll also be able to import from PCAP, edit, boot it back out.
2177420	2184020	And then, with your empty instance, you just fill in the values you want for each field.
2184020	2191300	Values that are left blank should be filled in with typical defaults at the time the thread is executed.
2191680	2197520	You'll notice that some of our fields are set to values, such as internet header length,
2197520	2201220	and the flags CE, DF, and MF.
2201940	2208980	Our GUI understands that false is 1 bit 0, and true is 1 bit 1.
2209700	2213440	And some of our fields are variables, which start with a dollar sign.
2214040	2219360	These values, like destination IP, can vary from run to run.
2219380	2222180	Like every time you run the thread, you might be targeting a different machine.
2222400	2225780	So we kind of just put little tags in here that say,
2225780	2228580	hey, when you run this, we're going to ask you to fill these values in,
2228580	2230640	because they're likely to be different from run to run.
2230640	2232300	It's just a little convenience thing.
2234480	2239520	We've also set several of our fields to functions, which start with the at symbol.
2239520	2245730	The only function we're using here is random, which is in source IP,
2246820	2250730	and source port, and sequence number, and source MAC.
2252440	2260740	That just tells the thread engine to put in a random value for each iteration.
2260740	2265440	It just picks a random value from the minimum to the maximum, and puts that in there.
2266460	2271000	We have decided on a minimal subset of functions,
2271000	2274140	because functions are things that get passed down to the engine.
2274140	2278140	Things like timestamp, random values, or ranges.
2278140	2280580	It's something you want the engine to handle at the lowest level.
2280780	2284480	But we want to keep our engine code running quickly,
2284480	2287540	so we want to minimize what we're doing with functions.
2289300	2291780	This syntax doesn't matter at all.
2294060	2299860	You could pick any way of specifying functions, any way of specifying variables.
2305420	2309500	Here is our minimal function subset.
2310390	2315910	From this, you can do most every operation that you want to.
2319360	2322620	I guess they'd be like atomic operations.
2324680	2332400	The most useful are range, which will range from the minimum argument to the maximum argument.
2332400	2341320	So you could target a range of IP addresses from 192.168.0.1 to 192.168.0.255 or something like that.
2341320	2343280	Random I already talked about.
2343540	2346120	Random string is something you might want to do for fuzzing.
2346120	2349740	You can generate a random ASCII string of a particular length.
2349900	2354340	But more useful for fuzzing is the homogenous string of length X.
2354340	2356940	Which is kind of like a fill function.
2356940	2366880	So you can use that with range to, say, make a series of slashes in a URL request
2366880	2369720	that just increase by one each time it loops through.
2372400	2375960	Also, you need concatenation for closure.
2376200	2381100	And checksums are best handled as a function that is something that's dealt with by the engine
2381100	2383320	rather than at the designer level.
2386960	2398590	I've got to hide this.
2400570	2401890	I can't even smoke.
2401890	2403810	Oh, you suck.
2404310	2405470	Alright.
2405470	2408350	The threat file just contains a representation of your threat
2408350	2412110	including the stacks of protocols, the series of stacks,
2412110	2416310	and all the variables and functions and values that you're using.
2416370	2420250	One useful thing to do with threats is to include a good amount of metadata.
2420850	2425270	Metadata descriptions and target info so you can easily sort them into a database.
2426170	2430810	The threat file is just a serialization of all the info from the GUI.
2430810	2433370	So it's pretty much just the information you saw on the screen before
2434190	2436870	dumped out into some common format.
2438210	2440410	You know, XML works.
2442170	2445530	To execute the threat, the variables will have to be substituted
2445530	2449290	for real values and the functions resolved.
2453190	2455950	Which brings us to the next part of our platform,
2455950	2458750	the binding and execution of a threat.
2459770	2464170	This stage runs a threat file from your repository or your database
2464170	2467170	back into the parser generator,
2467170	2472050	but this time we're using the appropriate protocol grammars as the output
2472050	2476430	and the threat file format as the input.
2478110	2482610	This is also when the variables in the threat are substituted for actual values.
2485370	2490350	This produces a chunk of binary that closely resembles the final packet stream,
2490350	2493410	except for the functions which have to be resolved a little later.
2493850	2496390	We call this the bound threat.
2496590	2500890	The bound threat gets passed over a management interface,
2500890	2502470	whatever you're using,
2502470	2507230	from the design machine to the threat engine.
2515110	2520150	The threat engine is like a virtual machine for network traffic.
2520330	2523090	It must be a small, fast piece of code,
2523090	2528570	which is why we wanted to keep the operations that we do with it fairly atomic.
2529250	2531990	Its sole purpose is to read the bound threat in,
2531990	2535530	evaluate the functions, and boot out a packet stream.
2536530	2541330	Another important aspect of the threat engine is that it must allow clustering,
2543510	2550550	so that the management machine can initiate a threat execution on several engines at once.
2550930	2554730	So you can do like a man-in-the-middle or a multi-part conversation.
2555750	2562790	By allowing threat definitions to contain different roles for different nodes in a cluster,
2562790	2568250	you can do fairly complex stuff.
2568250	2571040	Like the man-in-the-middle.
2577610	2581470	Now, our last design goal.
2581470	2583690	Import from PCAP.
2583990	2588830	Once you have the parser generator and the protocol definitions,
2588830	2591130	this is pretty straightforward.
2591170	2593510	All you need to do is write an importer,
2593510	2595430	which strips off the PCAP header,
2595430	2599530	and gives you the binary of your packets.
2599530	2604390	So you basically just get binary of all of your Ethernet frames in a series.
2605210	2607370	You can then use your parser generator,
2607370	2610750	with your protocol definitions as the input grammar,
2611110	2613430	to decompose the PCAP file,
2613430	2617450	and translate it into your own intermediate representation.
2617450	2618610	Thank you.
2618950	2620490	I'm dying.
2639820	2641380	You people and your tequila.
2641380	2642260	Ten?
2645730	2646850	What?
2647210	2648710	Oh, crap.
2650890	2651510	Okay.
2653430	2656430	So this time we're using the protocol definitions,
2656430	2660890	which have each field for each segment of our protocol stacks,
2660890	2662870	broken out by bit length.
2662990	2665410	So you look at your list of fields and bit lengths,
2665410	2669110	and you can decompose a PCAP file,
2672910	2676050	which, like, protocol objects,
2676050	2678630	you can pull out the values for all your fields and all this.
2681690	2683250	Once you have it loaded in the GUI,
2683250	2685570	you can edit it like any other threat,
2686250	2688310	and boot out a threat file.
2688810	2691150	You know, a common thing to do is to substitute
2691150	2693150	some of your fields with variables,
2693150	2696670	rather than just playing back the PCAP exactly as it was.
2696830	2699090	You may want to put in, like, a different destination MAC address,
2699090	2701030	or a different destination IP.
2702030	2703670	If you're going the clustering route,
2703670	2705510	there's an additional step for PCAP files
2705510	2708090	with multiple traffic sources.
2708230	2711210	The user will have to explicitly assign each source
2711210	2713810	to one of the clustered threat engines.
2713810	2716130	So if you're going for a multi-node playback,
2716290	2719230	a PCAP import actually requires some user interaction.
2726470	2729250	And here's some amazing word graphics
2729250	2732250	about the general flow of a PCAP import.
2732250	2735250	We take our protocol spec and the PCAP file,
2735250	2737290	and boot out a threat file.
2741820	2744980	So, to sum up,
2744980	2747120	the task of developing network threats
2747120	2749380	is essentially that of writing a series of expressions
2749380	2751240	in a variety of languages.
2751320	2754520	By using compilers or parser generators,
2754520	2757100	we can automate a good portion of the grunt work
2757100	2760280	and provide integrated development environments
2760280	2762920	that can speed up most of the common tasks.
2762920	2764740	We can also create more complicated
2764740	2767380	and realistic test beds
2767920	2770320	in the same integrated environment.
2770440	2773340	And we can edit and playback PCAP files
2773340	2776220	and deal with any current or future protocols.
2776280	2778680	We're going to do some questions,
2778680	2780500	which should be rather interesting,
2780500	2784040	because I have no idea if I made any sense at all.
2784540	2786820	But does anyone need clarification on something?
2820770	2825990	Yeah, we kind of took a pretty serious shortcut there.
2826350	2827290	In our protocol...
2828110	2832010	A lot of protocols will have some sort of field
2832010	2834890	which says what's encapsulated within them.
2834890	2837090	Like Ethernet has the packet type and so on.
2837090	2838850	Some of them don't.
2838850	2842950	So, like TCP and FTP, for instance.
2842950	2845950	It's like you don't know by looking at your TCP fields
2846910	2850270	what, if any, protocol is encapsulated in it.
2850650	2854730	In our case, we just added that to the protocol definitions
2855670	2857610	as kind of a hint,
2857610	2860790	rather than trying to figure it out automatically.
2870600	2871940	Cool, yeah.
2873600	2874920	Sounds good.
2875200	2876400	Anyone else?
2877440	2878160	Shoot.
2880140	2881440	No demo.
2882460	2883260	Sorry.
2884480	2907470	It has to be another...
2907470	2909890	It's something you add to the threat file.
2913110	2915690	Yeah, you have to manually add something to the threat file
2915690	2919750	and you have to manually add a case to your engine to deal with it.
2920030	2923090	So you say, well, we want to fragment in this manner,
2923530	2925490	from here to here in our series.
2925490	2929750	And then the engine has to accommodate that.
2951410	2955390	You mean by streams, you mean fragmentation or like sessions?
2958850	2959570	Yeah.
2974140	2975560	I don't think I can...
2975560	2977660	Are we done?
2979160	2980420	Okie dokie.
2982380	2984160	I'm going to clear out.