1 00:00:10,770 --> 00:00:18,250 So this was supposed to go on at 10, and I was totally supposed to get like another hour to sober up. 2 00:00:19,810 --> 00:00:20,870 Dammit. 3 00:00:22,430 --> 00:00:25,490 This is going to be a really interesting Black Ops. 4 00:00:25,490 --> 00:00:33,670 Not only is this the first Black Ops that I've done exploits, this is the first Black Ops where I have been kind of sober. 5 00:00:36,670 --> 00:00:41,070 Oh, no, no, no, there's lots of people here providing booze, let me tell you. 6 00:00:41,790 --> 00:00:43,590 So, what are we here to do? 7 00:00:43,590 --> 00:00:45,410 We got an hour from now. 8 00:00:46,330 --> 00:00:47,410 Who am I? 9 00:00:47,530 --> 00:00:49,130 You should know by now. 10 00:00:50,470 --> 00:00:52,090 What are we here to do? 11 00:00:52,170 --> 00:00:55,970 So like last year, you know, I had like one topic, just DNS. 12 00:00:56,030 --> 00:00:59,890 It was kind of fun and, you know, left the whole ADD thing alone. 13 00:01:00,470 --> 00:01:02,070 Yeah, we're back to ADD. 14 00:01:02,070 --> 00:01:03,110 It's fun. 15 00:01:03,110 --> 00:01:04,710 We're going to talk about a whole bunch of stuff. 16 00:01:04,710 --> 00:01:06,170 We're going to kick MD5. 17 00:01:06,170 --> 00:01:07,850 We're going to play with some IP fragments. 18 00:01:07,850 --> 00:01:14,490 We are going to mess with intrusion protection systems, which are being really, really abused. 19 00:01:15,050 --> 00:01:20,590 We're going to do some DNS poisoning, which again is about the most black hat thing I've ever done. 20 00:01:21,290 --> 00:01:26,690 And if that didn't help, we are going to send about 4 billion packets onto the Internet. 21 00:01:26,750 --> 00:01:28,650 I have a new toy. 22 00:01:28,810 --> 00:01:32,930 It has 170 gigabits and permission to use it. 23 00:01:33,450 --> 00:01:36,350 I've never actually cackled before. 24 00:01:36,370 --> 00:01:38,130 You know, giggled a little, laughed, but... 25 00:01:41,270 --> 00:01:44,270 We're going to make some pretty pictures, because I like pretty pictures. 26 00:01:44,270 --> 00:01:45,810 You know why I like pretty pictures? 27 00:01:45,810 --> 00:01:49,370 Because I can show them to non-geeks, and they're like, holy crap, that is cool. 28 00:01:49,370 --> 00:01:51,410 I have no idea what it is, but it is cool. 29 00:01:51,910 --> 00:01:54,290 Usually it's just I have no idea what it is. 30 00:01:54,570 --> 00:01:55,990 It just ends there. 31 00:01:56,730 --> 00:01:58,730 And finally, you know, watch some TV. 32 00:02:00,770 --> 00:02:02,210 Attacking MD5. 33 00:02:02,730 --> 00:02:07,950 Instead of going through all the background, here is the web page for Lockheed Martin. 34 00:02:08,210 --> 00:02:09,010 Fun company. 35 00:02:09,010 --> 00:02:10,550 Some of you might have heard of it. 36 00:02:10,670 --> 00:02:13,170 Here is the web page for Boeing. 37 00:02:13,230 --> 00:02:14,450 Another fun company. 38 00:02:14,450 --> 00:02:15,790 You might have heard of it. 39 00:02:15,810 --> 00:02:19,170 Let's see what the hashes of these two pages... 40 00:02:25,680 --> 00:02:29,200 Let's see what the hashes of those two pages happen to be. 41 00:02:31,380 --> 00:02:32,560 C0F3AD. 42 00:02:33,240 --> 00:02:34,600 C0F3AD. 43 00:02:34,960 --> 00:02:39,140 These two web pages have the exact same hash. 44 00:02:39,520 --> 00:02:41,680 How could that have happened? 45 00:02:42,700 --> 00:02:46,560 Oh, I know you like the hash. 46 00:02:50,800 --> 00:02:53,820 I was wondering how you came up with that shit, man. 47 00:02:53,820 --> 00:02:55,060 Holy crap. 48 00:02:55,060 --> 00:02:59,560 Okay, I have to actually turn off my email client this time. 49 00:02:59,680 --> 00:03:03,920 I had people using their Blackberry on me the last time I did this talk. 50 00:03:04,500 --> 00:03:06,320 That was really annoying. 51 00:03:07,360 --> 00:03:09,280 So what is MD5 supposed to do? 52 00:03:09,340 --> 00:03:11,980 MD5 is supposed to be basically a data fingerprint. 53 00:03:12,020 --> 00:03:15,220 You know, you got some file, however big it happens to be. 54 00:03:15,220 --> 00:03:18,640 The end result is supposed to come down to 128-bit signature. 55 00:03:18,640 --> 00:03:26,780 The magic word is computationally infeasible to find two files with the same hash. 56 00:03:26,800 --> 00:03:30,420 Now, we've known since about, what was it, 96, 97? 57 00:03:31,280 --> 00:03:32,320 Bullshit. 58 00:03:33,380 --> 00:03:40,480 And, you know, about 2004, Zhang Yun Wang over in China said, Hell yeah, that's bullshit. 59 00:03:40,480 --> 00:03:42,580 Here's two files with the same hash. 60 00:03:42,580 --> 00:03:45,240 And you know what the response was from a lot of people? 61 00:03:45,240 --> 00:03:47,780 Yeah, there you have two hashes. 62 00:03:47,780 --> 00:03:54,180 But you could never use that for actual production data that had any kind of real-life meaning. 63 00:03:54,400 --> 00:03:56,400 Absolutely not. 64 00:03:58,340 --> 00:04:02,260 Okay, hype aside, I do actually try to have some technical data. 65 00:04:02,260 --> 00:04:04,160 So here's what the story is. 66 00:04:04,500 --> 00:04:06,300 MD5, it's pretty simple. 67 00:04:06,640 --> 00:04:08,480 You start out with some initial state. 68 00:04:08,480 --> 00:04:12,720 And they use magic numbers like pi and 6, 7, 8, 9, 1. 69 00:04:12,720 --> 00:04:14,740 You know, numbers decreasing, whatever. 70 00:04:15,020 --> 00:04:19,380 I'm too drunk to go 9, 8, 7, 6, 5, 4, 3, 2, 1. 71 00:04:19,380 --> 00:04:20,880 I've got a problem. 72 00:04:21,440 --> 00:04:24,820 More than that, I gotta drink. 73 00:04:31,260 --> 00:04:35,820 Oh, the way this works at my talks, I like questions. 74 00:04:35,840 --> 00:04:38,580 Ask a good one, and you get to drink. 75 00:04:38,700 --> 00:04:41,300 And if I can't answer, I have to drink. 76 00:04:41,300 --> 00:04:45,860 And, you know, if I'm not done drinking, well, that's the drinking game. 77 00:04:46,820 --> 00:04:49,240 So, MD5 basically is really simple. 78 00:04:49,240 --> 00:04:50,440 Start with some state. 79 00:04:50,700 --> 00:04:53,500 You loop over all your data, 512 bits at a time. 80 00:04:53,500 --> 00:04:55,040 And it shuffles that state. 81 00:04:55,140 --> 00:04:57,240 And at the end, you end up with some value. 82 00:04:57,240 --> 00:05:00,460 You mix in, like, the amount of data that you did, some metadata. 83 00:05:00,460 --> 00:05:03,400 And you end up with what's called the MD5 hash. 84 00:05:03,400 --> 00:05:07,500 Now, the idea is, anything's different in the input data. 85 00:05:07,500 --> 00:05:12,740 A single bit should cause half the output bits in the hash to change. 86 00:05:13,160 --> 00:05:13,840 Half. 87 00:05:13,840 --> 00:05:14,900 It's a big number. 88 00:05:15,800 --> 00:05:19,800 What we have here is a visualization of the internals of MD5. 89 00:05:19,800 --> 00:05:23,180 You know, we've got 64 sub-rounds and 3 rounds. 90 00:05:24,060 --> 00:05:26,340 Half of those things are supposed to be flickering. 91 00:05:26,340 --> 00:05:28,060 Now maybe you can't see the flicker. 92 00:05:28,560 --> 00:05:30,360 You see those little dots? 93 00:05:30,360 --> 00:05:32,460 There's supposed to be a hell of a lot more. 94 00:05:32,780 --> 00:05:36,500 But, you know, we've got the Chinese girl, so, you know, guess what? 95 00:05:36,500 --> 00:05:38,320 Almost none of them are different. 96 00:05:38,320 --> 00:05:40,760 You know, first round, second round. 97 00:05:40,760 --> 00:05:43,200 By the third round, nothing is different. 98 00:05:43,200 --> 00:05:47,080 That's this big advance of this, you know, this new MD5 attack. 99 00:05:47,280 --> 00:06:00,780 And what's interesting is, once you have two files with the same hash, because it operates 512 bits at a time, once you do end up at an alignment, you can add new stuff. 100 00:06:00,780 --> 00:06:06,700 And it's not like you can go back in time, back to earlier in the file and say, hey, wait, it was different earlier in the file. 101 00:06:06,700 --> 00:06:11,540 Because you're never supposed to have a collision, because that's what the whole point of a hash is. 102 00:06:11,540 --> 00:06:19,580 So in mathematical terms, if MD5 of X equals MD5 of Y, MD5 of X plus Q, that's going to equal MD5 of Y plus Q. 103 00:06:19,600 --> 00:06:26,200 So that means if we have two files with the same hash, we can append anything we want to it, including webpages. 104 00:06:26,420 --> 00:06:30,140 Funny thing about web browsers, who here has written a crappy webpage? 105 00:06:31,800 --> 00:06:33,100 Thank you! 106 00:06:33,100 --> 00:06:36,580 All of you who haven't raised your hands are fucking liars. 107 00:06:37,960 --> 00:06:40,680 Web browsers accept everything. 108 00:06:40,680 --> 00:06:42,520 That was one of the big advances. 109 00:06:42,520 --> 00:06:46,980 You can put a turd in your fucking webpage that's going to render something. 110 00:06:47,300 --> 00:06:51,680 And it turns out we can even put these two files that have the same hash. 111 00:06:51,680 --> 00:06:57,980 But not only do they render anything, oh, there's a programming environment, we got JavaScript. 112 00:06:58,040 --> 00:06:59,860 Speaking of turds... 113 00:07:02,260 --> 00:07:05,820 The browsers accept everything and they are programmable. 114 00:07:05,820 --> 00:07:07,300 So this is what we're going to do. 115 00:07:07,860 --> 00:07:10,120 By the way, GraphViz is the code to use all this. 116 00:07:10,120 --> 00:07:11,060 It's freaking cool. 117 00:07:11,380 --> 00:07:13,800 So what we do is we take some file. 118 00:07:14,440 --> 00:07:16,040 This is X, this is Y. 119 00:07:16,040 --> 00:07:17,640 These are our two files with the same hash. 120 00:07:17,640 --> 00:07:21,120 We are going to prepend our file with one of these. 121 00:07:21,200 --> 00:07:23,220 And we're going to put some extra crap on. 122 00:07:23,220 --> 00:07:25,920 Remember, we can put anything on and it will have the same hash. 123 00:07:25,920 --> 00:07:28,700 Where did my mouse go? 124 00:07:29,160 --> 00:07:29,980 Here we are. 125 00:07:29,980 --> 00:07:32,480 Here's the first webpage, Lockheed Martin. 126 00:07:32,480 --> 00:07:34,340 Here's the second page, Boeing. 127 00:07:34,340 --> 00:07:36,580 And now we have some JavaScript. 128 00:07:36,840 --> 00:07:42,160 Now the idea is that MD5 is blind because all this crap is Q. 129 00:07:42,160 --> 00:07:44,380 X, Y, all this crap is Q. 130 00:07:45,260 --> 00:07:49,100 MD5 is blind but we can put a program in that isn't. 131 00:07:49,340 --> 00:07:52,880 So the program goes back and goes, Ah, fuck, I was put on X. 132 00:07:52,880 --> 00:07:54,040 Okay, Lockheed. 133 00:07:54,040 --> 00:07:56,240 Hey, look, I was put on Y. 134 00:07:56,240 --> 00:07:57,220 Shows Boeing. 135 00:07:57,380 --> 00:07:58,640 And that's your output. 136 00:07:59,000 --> 00:08:05,920 And so that, in a nutshell, is how Lockheed Martin and Boeing can have the same MD5 hash. 137 00:08:12,090 --> 00:08:15,850 That was a lot of stuff that had nothing to do with packets. 138 00:08:16,070 --> 00:08:18,450 Okay, I better get back to this shit. 139 00:08:20,450 --> 00:08:24,670 I need to have my little segue that's all smooth and elite and whatnot. 140 00:08:24,670 --> 00:08:27,570 You know, we're talking about interpretation. 141 00:08:27,590 --> 00:08:33,390 Speaking of other things that have to do with fucked up interpretation, God damn, I really should not be doing this drunk. 142 00:08:34,810 --> 00:08:37,550 You bastards, you moved my talk up. 143 00:08:38,030 --> 00:08:42,170 Alright, yes, you put my talk at the same time it said in the schedule. 144 00:08:44,490 --> 00:08:53,530 IP fragmentation, and I quote, Fragmentation, an interesting early architectural error that shows how much experimentation was going on while IP was being designed. 145 00:08:53,530 --> 00:09:00,650 Quote by Paul Vixie, someone who I truly expected to kick my ass when I first met him, but it turns out he's about as fucked up as I am. 146 00:09:00,650 --> 00:09:01,510 Sweet. 147 00:09:02,510 --> 00:09:04,830 So, what is fragmentation all about? 148 00:09:04,830 --> 00:09:08,950 Well, IP packets can be like 65 kilobytes long. 149 00:09:09,330 --> 00:09:13,150 Okay, there is no physical network that can send a 65 kilobyte packet. 150 00:09:13,150 --> 00:09:16,010 Well, okay, none that's actually used in common usage. 151 00:09:16,010 --> 00:09:23,130 So, the idea behind IP fragmentation is we can take these ginormous packets and shrink them down into little chunks. 152 00:09:23,210 --> 00:09:23,950 Fragments. 153 00:09:23,950 --> 00:09:25,250 It's fairly straightforward. 154 00:09:25,670 --> 00:09:26,890 Why is this a problem? 155 00:09:27,270 --> 00:09:29,890 The whole idea with IP is that it's supposed to be stateless. 156 00:09:29,890 --> 00:09:32,010 You got a packet, you send it, you move the fuck on. 157 00:09:32,550 --> 00:09:44,990 With fragments, hey, you know, you can send fragments and not have to worry about it, but when you receive them, you have to store these things, because you get one fragment and later on you might get another and another and maybe you will and maybe you won't, 158 00:09:44,990 --> 00:09:47,910 but the point is you got to keep this stuff around in RAM. 159 00:09:47,990 --> 00:09:49,150 That's annoying. 160 00:09:49,730 --> 00:09:52,770 Not just as annoying, it's about 98. 161 00:09:52,770 --> 00:10:01,450 Tim Newsham and Tom Pacek actually showed, look, we can get around like every IDS out there by just doing strange games with our fragmentation. 162 00:10:01,450 --> 00:10:03,110 We have overlapping fragments. 163 00:10:03,110 --> 00:10:05,510 You know, this fragment says it has the same data as that one. 164 00:10:05,510 --> 00:10:08,630 Which one is going to be, you know, what is the correct interpretation? 165 00:10:08,630 --> 00:10:10,930 The RFCs are just like, fuck if I know. 166 00:10:10,930 --> 00:10:15,250 And then FragRouter comes out and is just like, no, really, we can kick your ass. 167 00:10:15,250 --> 00:10:16,090 Here, watch. 168 00:10:16,990 --> 00:10:19,290 And so this is like 98, 99. 169 00:10:19,290 --> 00:10:21,090 This is old shit, right? 170 00:10:21,590 --> 00:10:23,830 Look, IP has been picked clean. 171 00:10:23,830 --> 00:10:25,770 There's a reason I moved on to DNS. 172 00:10:25,770 --> 00:10:28,410 Because, like, layer 3 and 4 are done. 173 00:10:29,850 --> 00:10:30,970 So I thought. 174 00:10:32,490 --> 00:10:37,450 In the crypto realm, you know, I did all this stuff with OpenSSH, you know, we've been dealing with timing attacks lately. 175 00:10:37,450 --> 00:10:40,690 All this crypto is all vulnerable to, like, how long things take. 176 00:10:40,690 --> 00:10:41,790 And I'm thinking about this. 177 00:10:41,790 --> 00:10:44,770 I'm going, I wonder if I can apply timing stuff to IP. 178 00:10:44,770 --> 00:10:47,530 And it turns out, oh, yes. 179 00:10:47,670 --> 00:10:51,770 It turns out there's an IP fragment reassembly timer. 180 00:10:51,810 --> 00:10:54,250 It turns out that there's only a certain amount of time. 181 00:10:54,250 --> 00:10:55,710 Are you pointing at me? 182 00:10:55,990 --> 00:10:57,430 What are you pointing at me? 183 00:10:57,430 --> 00:10:58,530 Oh, now you're the middle finger. 184 00:10:58,530 --> 00:10:59,630 What is this shit? 185 00:11:00,850 --> 00:11:02,650 Oh, I'll take this opportunity. 186 00:11:02,810 --> 00:11:08,450 So speaking of pointing, there's all these shirts that have me pointing that say scanran motherfucker. 187 00:11:09,250 --> 00:11:11,770 And it's done by the TorCon sluts. 188 00:11:14,030 --> 00:11:15,890 Hey, you've got a new title. 189 00:11:15,890 --> 00:11:17,230 Would you rather be a goon? 190 00:11:17,230 --> 00:11:18,750 Should have had a better t-shirt. 191 00:11:22,670 --> 00:11:24,230 TorCon is absolutely rad. 192 00:11:24,230 --> 00:11:25,930 I've loved that con for years. 193 00:11:25,930 --> 00:11:27,470 And , you know, they have these shirts for me. 194 00:11:27,470 --> 00:11:31,330 So speaking of good questions, good questions get a shirt. 195 00:11:32,230 --> 00:11:34,050 And trashed off your ass. 196 00:11:34,550 --> 00:11:34,830 What? 197 00:11:34,830 --> 00:11:36,270 I can't be the only one. 198 00:11:37,030 --> 00:11:38,410 So, okay, look. 199 00:11:38,410 --> 00:11:40,830 IP fragment reassembly timer. 200 00:11:40,890 --> 00:11:43,710 Basically, these fragments come in. 201 00:11:43,770 --> 00:11:46,450 And we can't reassemble the packet because we don't have all of them. 202 00:11:46,610 --> 00:11:48,790 Eventually, the system gives up, right? 203 00:11:48,850 --> 00:11:52,190 Well, how long is it going to wait before it gives up? 204 00:11:52,190 --> 00:11:55,570 Well, it turns out we can fingerprint operating systems with that value. 205 00:11:55,570 --> 00:11:57,230 You know, some things will wait 30 seconds. 206 00:11:57,230 --> 00:11:58,790 Some things will wait two minutes. 207 00:11:58,970 --> 00:12:00,850 You know, boom, OS fingerprint. 208 00:12:00,870 --> 00:12:01,630 Ooh. 209 00:12:01,810 --> 00:12:02,850 But that's easy. 210 00:12:02,850 --> 00:12:03,410 That's cheap. 211 00:12:03,410 --> 00:12:05,450 Let's go ahead and do some more hardcore stuff. 212 00:12:05,450 --> 00:12:06,170 All right. 213 00:12:06,530 --> 00:12:08,530 What if you have an IDS? 214 00:12:08,690 --> 00:12:16,890 An IDS may very well have a different idea of how long a fragment can live before it just gives up on trying to reassemble it. 215 00:12:16,890 --> 00:12:18,470 In fact, this is actually true. 216 00:12:18,470 --> 00:12:21,190 Linux and FreeBSD have a 30-second timer. 217 00:12:21,190 --> 00:12:24,190 Snort's frag2 timer will wait 60 seconds. 218 00:12:24,430 --> 00:12:33,550 Now, if the timer was less, if the IDS was going to keep fragments around for less time, well, hell, you know, we just send fragments too slow for the IDS but fast enough for the host. 219 00:12:33,550 --> 00:12:35,290 But what if it's the other way around? 220 00:12:35,290 --> 00:12:45,330 What if the IDS, because it's all hardcore and, you know, it's going to keep things around for as long as it possibly can, what if the IDS keeps fragments around longer? 221 00:12:45,370 --> 00:12:45,950 Ooh. 222 00:12:45,950 --> 00:12:47,230 We can do some stuff. 223 00:12:47,550 --> 00:12:50,310 The problem is, it's keeping stuff around longer. 224 00:12:50,310 --> 00:12:54,070 How are we supposed to make the host see one thing and the IDS see another? 225 00:12:54,170 --> 00:12:57,850 Well, our problem is the IDS is keeping fragments around for too long. 226 00:12:57,850 --> 00:12:58,910 Our solution? 227 00:12:58,950 --> 00:13:01,390 Make the IDS drop our fragments. 228 00:13:01,730 --> 00:13:03,010 Well, that sounds really easy. 229 00:13:03,010 --> 00:13:03,830 How are we going to do that? 230 00:13:03,830 --> 00:13:09,250 Well, there are two ways a fragment leaves the reassembly queue. 231 00:13:09,250 --> 00:13:13,850 Either A, it times out, or B, it's reassembled against something. 232 00:13:14,010 --> 00:13:15,050 Hmm. 233 00:13:15,630 --> 00:13:17,170 I like that B. 234 00:13:17,170 --> 00:13:22,590 I like the idea that it's just going to work, but not the way it plans to. 235 00:13:23,770 --> 00:13:25,330 Watch this. 236 00:13:25,590 --> 00:13:26,790 Here's what we're going to do, right? 237 00:13:26,790 --> 00:13:27,390 Look. 238 00:13:27,390 --> 00:13:28,370 Take our payload. 239 00:13:28,370 --> 00:13:30,210 Up to 65 kilobytes. 240 00:13:30,210 --> 00:13:33,690 We are going to split it into a whole bunch of fragments. 241 00:13:33,690 --> 00:13:35,590 We're going to take the even-numbered fragments. 242 00:13:35,590 --> 00:13:36,650 We're going to make a copy of them. 243 00:13:36,650 --> 00:13:39,510 And we're going to fill those fragments' payload with noise. 244 00:13:40,230 --> 00:13:41,430 Absolute crap. 245 00:13:42,210 --> 00:13:45,370 And we're going to send this absolute crap. 246 00:13:45,390 --> 00:13:46,250 And you know what we're going to do? 247 00:13:46,250 --> 00:13:47,450 We're going to wait. 248 00:13:47,830 --> 00:13:49,170 So we send the crap. 249 00:13:49,490 --> 00:13:51,530 And the host has some crap. 250 00:13:51,550 --> 00:13:53,770 And the IDS has some crap. 251 00:13:53,810 --> 00:13:55,690 But you know what happens after 30 seconds? 252 00:13:55,690 --> 00:13:57,850 The host drops the crap. 253 00:13:57,850 --> 00:14:01,490 But the IDS, it likes the crap. 254 00:14:01,570 --> 00:14:03,350 It keeps it around. 255 00:14:03,350 --> 00:14:05,350 It thinks it might be useful. 256 00:14:05,350 --> 00:14:08,110 Oh, and indeed, it is useful. 257 00:14:08,110 --> 00:14:12,010 Because we go ahead and we send the odd-numbered fragments. 258 00:14:12,010 --> 00:14:16,130 And the odd-numbered fragments go to the host, and the host has nothing. 259 00:14:16,130 --> 00:14:22,090 So the host holds on to these odd-numbered fragments and says, Well, you know, gotta wait for some stuff in the future. 260 00:14:22,250 --> 00:14:23,610 IDS, no. 261 00:14:24,150 --> 00:14:26,490 IDS has been holding on to some crap. 262 00:14:26,490 --> 00:14:31,630 So the IDS has crappy even and good odd. 263 00:14:31,630 --> 00:14:32,570 It reassembles. 264 00:14:32,570 --> 00:14:34,510 It's like, what the hell is this? 265 00:14:34,570 --> 00:14:36,850 And it drops it on the floor. 266 00:14:37,650 --> 00:14:42,130 Ah, but now we send the legitimate even-numbered fragments. 267 00:14:42,670 --> 00:14:51,810 And the IDS, well, it already dropped all that stuff from before on the floor, so the IDS now has to keep it in its cache. 268 00:14:52,310 --> 00:14:53,710 But the host? 269 00:14:53,710 --> 00:14:55,550 Host has legitimate even. 270 00:14:55,550 --> 00:14:57,330 Host has legitimate odd. 271 00:14:57,410 --> 00:14:59,830 Host reassembles just fine. 272 00:15:00,710 --> 00:15:02,070 And then you win. 273 00:15:09,200 --> 00:15:11,360 And now my favorite line. 274 00:15:11,460 --> 00:15:13,620 It gets worse. 275 00:15:15,400 --> 00:15:18,160 Right now, we're giving the IDS crap. 276 00:15:18,380 --> 00:15:20,440 Well, IDSs are meant to look for crap. 277 00:15:20,440 --> 00:15:21,740 They might alarm. 278 00:15:21,740 --> 00:15:23,220 They might be worried. 279 00:15:23,280 --> 00:15:29,120 Is there a way we can, instead of giving it crap, can we make the IDS see something completely different? 280 00:15:29,120 --> 00:15:33,920 You know, like, the IDS sees a get slash, and the host sees a SQL injection attack? 281 00:15:34,680 --> 00:15:35,500 Ooh. 282 00:15:37,280 --> 00:15:38,900 Here's what we're going to do. 283 00:15:39,360 --> 00:15:49,000 Now, get slash has some headers, and the SQL injection attack has some headers, and it turns out a fair amount of these headers can be exactly the same. 284 00:15:49,000 --> 00:15:53,620 So what we're going to do is we're going to split our stuff into three packets. 285 00:15:53,660 --> 00:15:57,960 A common header, good stuff, and you're going to die. 286 00:15:57,960 --> 00:16:04,000 And what we do is the first thing we send is, you're going to die. 287 00:16:04,720 --> 00:16:05,240 No, no, excuse me. 288 00:16:05,240 --> 00:16:05,440 No, no. 289 00:16:05,880 --> 00:16:06,820 That's later. 290 00:16:06,820 --> 00:16:08,440 We're going to send the good stuff first. 291 00:16:09,180 --> 00:16:11,040 Good stuff goes first. 292 00:16:11,180 --> 00:16:11,740 You know why? 293 00:16:11,740 --> 00:16:14,020 Because I want the IDS to see some good stuff. 294 00:16:14,040 --> 00:16:16,900 I want to give it some happy, nice feelings. 295 00:16:17,560 --> 00:16:18,500 No problem. 296 00:16:18,500 --> 00:16:20,660 I would never attack you. 297 00:16:21,920 --> 00:16:23,200 So here's what we're going to do. 298 00:16:23,200 --> 00:16:25,660 So we send the good stuff, and we wait. 299 00:16:25,660 --> 00:16:28,480 And we wait long enough so the host goes, fuck this good stuff. 300 00:16:28,480 --> 00:16:29,600 It drops it. 301 00:16:29,940 --> 00:16:38,160 But the IDS still has it around, and we send the shared common header, and the IDS goes, I got the header, and it's nice, and I got the good stuff, and it's nice. 302 00:16:38,260 --> 00:16:43,040 So it assembles and says, hey, this guy just asked for a git slash. 303 00:16:43,040 --> 00:16:44,040 He's cool. 304 00:16:44,880 --> 00:16:49,140 But the host still has, at this point in time, where's the host at? 305 00:16:49,140 --> 00:16:50,440 The stuff in its header. 306 00:16:51,080 --> 00:16:54,800 Just the header packet, because it already dropped the good stuff. 307 00:16:54,800 --> 00:16:58,700 But it has the header, and now we give it the evil packet. 308 00:16:59,040 --> 00:17:01,980 And what happens when the header meets the evil packet? 309 00:17:03,240 --> 00:17:05,540 Reassembles a SQL injection exploit. 310 00:17:05,540 --> 00:17:06,680 You win. 311 00:17:09,930 --> 00:17:10,910 What's up? 312 00:17:14,310 --> 00:17:15,510 Quite a few. 313 00:17:16,750 --> 00:17:18,970 So, what about checksums? 314 00:17:20,390 --> 00:17:21,970 There's a problem. 315 00:17:21,970 --> 00:17:30,510 Our hosts may actually go ahead and, you know, SQL injections should not have the same checksum as git slash, right? 316 00:17:30,510 --> 00:17:32,290 I mean, there's 65,000 possibilities. 317 00:17:32,290 --> 00:17:34,550 Why would the things match up? 318 00:17:34,550 --> 00:17:36,750 Well, it turns out, there's this great book. 319 00:17:36,750 --> 00:17:40,370 It's called TCPIP Lean, by this guy, Jeremy Bentham. 320 00:17:40,470 --> 00:17:41,550 It's hardcore. 321 00:17:41,750 --> 00:17:43,150 I ain't saying it's hardcore. 322 00:17:43,150 --> 00:17:46,630 Like, the guy debugs Ethernet with an oscilloscope. 323 00:17:46,630 --> 00:17:48,350 That kind of hardcore. 324 00:17:49,270 --> 00:17:50,130 So, look. 325 00:17:50,130 --> 00:17:51,030 He's got this thing. 326 00:17:51,070 --> 00:17:57,770 He's dealing with hardware that doesn't have enough RAM to have an entire packet in RAM at the same time. 327 00:17:57,930 --> 00:17:59,530 Holy crap! 328 00:18:00,590 --> 00:18:02,850 So, he talks about how you do this stuff. 329 00:18:02,850 --> 00:18:04,890 He says, well, you know, your checksum. 330 00:18:04,890 --> 00:18:07,690 You don't want to have to go and go over all your data. 331 00:18:08,130 --> 00:18:12,670 How do we go ahead and stream out a packet and not have to worry about the checksums? 332 00:18:12,670 --> 00:18:15,370 Well, the idea is you put in the wrong checksum. 333 00:18:15,690 --> 00:18:17,750 But there's a funny thing about IP checksums. 334 00:18:17,750 --> 00:18:18,610 They're crap. 335 00:18:19,430 --> 00:18:20,130 They are. 336 00:18:20,130 --> 00:18:20,850 They really suck. 337 00:18:20,850 --> 00:18:21,950 They're just a one's compliment. 338 00:18:21,950 --> 00:18:23,810 They're just like adding numbers, right? 339 00:18:23,950 --> 00:18:25,770 So, there's a really funny thing you can do. 340 00:18:26,050 --> 00:18:32,910 At the end of your payload, you can be like, wow, I'm like 32,000 off from what my checksum should be. 341 00:18:32,990 --> 00:18:35,690 And so, you like, you know, add a little bit of a comment. 342 00:18:35,810 --> 00:18:37,730 Fix by 32,000. 343 00:18:38,130 --> 00:18:39,430 And it works. 344 00:18:40,150 --> 00:18:46,710 So, you just do that, and now you're going to have a constant checksum for different payloads. 345 00:18:47,550 --> 00:18:55,110 We can actually backport this attack to all the original mechanisms used by PatchEck and Nooshum and Song. 346 00:18:55,110 --> 00:19:00,630 And it turns out what we can do, and I haven't built this one yet because I really fucked up my arm. 347 00:19:00,630 --> 00:19:02,230 Be happy I'm here at all. 348 00:19:03,350 --> 00:19:10,690 But it turns out you could actually send a series of packets such that on Linux, they assemble into a Linux exploit. 349 00:19:10,690 --> 00:19:13,430 And on Windows, they assemble into a Windows exploit. 350 00:19:13,430 --> 00:19:19,430 And all because there's a whole bunch of different ways that IP stacks can reorganize data. 351 00:19:19,450 --> 00:19:34,270 And you could actually, and I haven't built this yet, and I'm fully honest, you could actually create a sequence of packets such that when they arrive on the host, the particular host being used will reassemble it into a way that is relevant for that host. 352 00:19:34,270 --> 00:19:36,750 And you don't even need to get any kind of feedback back. 353 00:19:36,750 --> 00:19:37,710 It's kind of cool. 354 00:19:38,510 --> 00:19:40,330 Now, hitting the brakes. 355 00:19:40,330 --> 00:19:43,950 There's a couple IPS vendors out there who are like, dude, you're full of crap. 356 00:19:43,950 --> 00:19:51,730 Because our stuff is going to see you, it's going to see these overlapping fragments, we're going to deal with you, and we're going to shut your session down. 357 00:19:51,950 --> 00:19:54,130 Shut my session down, that's not nice. 358 00:19:54,430 --> 00:19:58,610 And not only is it not nice, there's not a lot of people who are going to be able to do that. 359 00:19:58,610 --> 00:20:00,030 That's really unique. 360 00:20:00,850 --> 00:20:01,290 And... 361 00:20:03,690 --> 00:20:05,670 Some jackasses, actually. 362 00:20:05,850 --> 00:20:08,710 Complete and utter fucking jackasses. 363 00:20:11,230 --> 00:20:13,050 Alright, no, I'm kidding. 364 00:20:14,530 --> 00:20:15,650 Anyway. 365 00:20:17,310 --> 00:20:22,170 Look, there's a funny little thing that happens when you block a session. 366 00:20:22,930 --> 00:20:25,250 You send a bit of information. 367 00:20:25,310 --> 00:20:31,450 I blocked you, I stopped you, I got in your way, I'm telling you I'm here and I'm getting in your way. 368 00:20:31,570 --> 00:20:34,450 Yo, that's a fingerprint. 369 00:20:35,390 --> 00:20:43,030 It turns out that anytime an intrusion detection system or a firewall gets in your way, it has actually identified itself. 370 00:20:43,030 --> 00:20:47,010 Because there's about a million different ways that these things can go ahead. 371 00:20:47,070 --> 00:20:48,430 Do they block invalid checksums? 372 00:20:48,430 --> 00:20:49,670 Do they block invalid options? 373 00:20:49,670 --> 00:20:51,270 Do they block invalid ICMP types? 374 00:20:51,270 --> 00:20:52,290 How about HTTP? 375 00:20:52,290 --> 00:20:53,330 How about SQL injection? 376 00:20:53,330 --> 00:20:54,810 How about SQL injection of this type? 377 00:20:54,810 --> 00:20:56,530 How about invalid DNS packets? 378 00:20:56,530 --> 00:20:58,230 How about tipping point? 379 00:20:58,230 --> 00:21:00,710 Oh, you sent a TCP fragment out of order. 380 00:21:00,710 --> 00:21:04,210 We're going to drop you on the floor because we don't like RFCs. 381 00:21:04,210 --> 00:21:05,770 They're overrated. 382 00:21:06,950 --> 00:21:08,110 Or checkpoint. 383 00:21:08,110 --> 00:21:09,870 Oh, you're using DNSSEC. 384 00:21:09,870 --> 00:21:11,690 That's never going to be feasible. 385 00:21:11,690 --> 00:21:23,210 Point is, you can go ahead and identify pretty much every firewall and every intrusion protection system based on whether, in a given session, if you do something it doesn't like, if it kills your session. 386 00:21:23,290 --> 00:21:31,190 And it turns out you can find out the precise hop that the IDS and IPS is at by using Mike Schiffman's firewalk method. 387 00:21:31,190 --> 00:21:38,730 Which is basically, you go ahead and you send your nastiest off one hop before the firewall and then you send it one hop after. 388 00:21:38,730 --> 00:21:43,430 If your session dies one hop after, you know the hop where the firewall lives at. 389 00:21:43,770 --> 00:21:45,790 Hi, how you doing? 390 00:21:45,830 --> 00:21:47,670 Not that this is anything wildly new. 391 00:21:47,670 --> 00:21:49,790 This is a slide from like 2003. 392 00:21:50,250 --> 00:21:54,330 And it basically shows you how you detect a PIX firewall. 393 00:21:54,690 --> 00:22:04,070 And I'm not giving any details, but if anyone ever tells you it's ever impossible to remotely detect a firewall, dude, I've been doing it for like two years. 394 00:22:04,910 --> 00:22:11,270 So I can't say what that's in reference to, but you can always detect a firewall remotely. 395 00:22:11,270 --> 00:22:15,250 There's just too many different variations on how the protocol can be broken. 396 00:22:16,390 --> 00:22:16,910 So... 397 00:22:17,710 --> 00:22:19,270 IP shunning. 398 00:22:19,410 --> 00:22:23,970 Turns out, a bunch of intrusion protection systems, they are, they're acting all hardcore. 399 00:22:23,970 --> 00:22:31,110 You mess with them a little too much, they're going to block your IP entirely because they're like, well obviously your IP is evil. 400 00:22:31,310 --> 00:22:36,210 And, you know, it's not like anyone ever spoofs IP addresses. 401 00:22:36,470 --> 00:22:37,970 Lies about who they are. 402 00:22:37,970 --> 00:22:40,270 Oh, nobody ever does that. 403 00:22:40,450 --> 00:22:46,930 Let me tell you why it's a really bad idea to block traffic that comes from random IP addresses on the internet. 404 00:22:46,930 --> 00:22:48,570 Anyone ever type dig? 405 00:22:48,630 --> 00:22:52,330 You know, that whole like domain internet grouper DNS thing? 406 00:22:52,330 --> 00:22:55,910 Here's a couple hosts, you might have heard of them, they're called the root servers. 407 00:22:56,030 --> 00:22:58,430 If you can't talk to them, you're fucked. 408 00:23:05,810 --> 00:23:15,510 So like anyone who's running these IPS's is like, hello internet, here is my firewall rule set, would you like to submit new rules? 409 00:23:16,010 --> 00:23:19,330 By any chance, would you like to knock my stuff down? 410 00:23:19,330 --> 00:23:20,310 We'll talk after. 411 00:23:20,950 --> 00:23:22,710 It's like, seriously? 412 00:23:23,190 --> 00:23:30,690 Now, you know, I'm showing this stuff and yeah, you can knock out any of these networks by just like, you know, hi, I'm 128 810 90. 413 00:23:31,110 --> 00:23:33,490 I'm trying to slammer you. 414 00:23:36,150 --> 00:23:40,030 But oh, I can't stop here. 415 00:23:40,390 --> 00:23:48,090 I can't stop here, because it is too large scale, and more importantly, I thought it was all cool, but it's been whispered about for years. 416 00:23:48,650 --> 00:23:55,890 And you know, I can't go ahead and take full credit for something people have been talking about, so let's do a little bit more elegant attack. 417 00:23:55,930 --> 00:23:58,110 Again, it gets worse. 418 00:23:59,370 --> 00:24:01,630 I've been investigating DNS poisoning. 419 00:24:01,630 --> 00:24:02,750 I've been investigating a lot. 420 00:24:02,750 --> 00:24:06,750 Does anyone here know, oh, hang on, we'll deal with that later. 421 00:24:06,790 --> 00:24:09,410 But I've been investigating DNS poisoning quite a bit. 422 00:24:09,670 --> 00:24:11,370 Four billion packets, quite a bit. 423 00:24:12,410 --> 00:24:25,610 Is it possible, given these networks that implement automatic network shunning, to not just like, knock them off the network, but to poison their name servers, to go ahead and redirect traffic from their network arbitrarily? 424 00:24:25,790 --> 00:24:27,210 Oh, yeah. 425 00:24:27,850 --> 00:24:29,930 Well, there's a funny thing. 426 00:24:29,930 --> 00:24:33,250 I showed you before, we will block you from the name servers. 427 00:24:33,250 --> 00:24:34,330 And that's nice. 428 00:24:34,330 --> 00:24:35,730 But let's do worse. 429 00:24:35,730 --> 00:24:38,790 Let's block them from individual name servers. 430 00:24:38,790 --> 00:24:45,410 Not the root, but say, hey, large ISP, see that big bank all your customers go to? 431 00:24:45,410 --> 00:24:48,310 Yeah, we don't want them to do that. 432 00:24:48,450 --> 00:24:49,470 And how can you do that? 433 00:24:49,470 --> 00:24:57,470 Well, block the communication between the name server at the ISP and the name server at the bank. 434 00:24:57,470 --> 00:24:59,790 And there are two sides you can do the blocking. 435 00:24:59,790 --> 00:25:00,370 You can cause the 436 00:25:04,590 --> 00:25:05,010 ISP... 437 00:25:05,010 --> 00:25:06,070 God damn! 438 00:25:19,610 --> 00:25:21,570 Humberdink, I believe I am out. 439 00:25:23,050 --> 00:25:25,110 Hey, I drank everything that was there. 440 00:25:25,110 --> 00:25:26,410 I think you need a drink. 441 00:25:27,930 --> 00:25:32,650 So, there are, you can block at the ISP side, you can block at the bank side. 442 00:25:32,650 --> 00:25:33,750 Both ways. 443 00:25:33,750 --> 00:25:33,850 Humberdink , 444 00:25:38,930 --> 00:25:39,810 no. 445 00:25:43,570 --> 00:25:46,550 So, only if I really screw up. 446 00:25:47,550 --> 00:25:50,430 In which case, you are having a shot with me up here. 447 00:25:51,190 --> 00:25:55,130 So, general theme is to block communication between any two name servers. 448 00:25:55,130 --> 00:25:57,450 You can block at either the server or the client side. 449 00:25:58,510 --> 00:26:03,230 All right, let's say you spoof malicious traffic from the client network to the server network. 450 00:26:03,230 --> 00:26:06,970 So, say, the big bank no longer likes podunk ISP. 451 00:26:07,430 --> 00:26:08,050 All right? 452 00:26:08,050 --> 00:26:14,370 That means podunk ISP sending out requests and nothing's coming back. 453 00:26:14,430 --> 00:26:15,210 All right? 454 00:26:15,390 --> 00:26:17,010 You know, let's think about that for a second. 455 00:26:17,010 --> 00:26:20,830 We got about, assuming a fixed port, we'll talk about that in a second. 456 00:26:20,850 --> 00:26:25,650 We got about 65,000 possibilities for what the transaction ID is going to be. 457 00:26:25,650 --> 00:26:32,870 The transaction ID, of course, controls whether or not when I spoof a packet, it actually is going to get blindly accepted. 458 00:26:33,470 --> 00:26:37,210 Well, kind of funny, is usually it's called a race condition. 459 00:26:37,210 --> 00:26:43,110 I would have to get my fake reply back before the real reply comes back. 460 00:26:43,110 --> 00:26:46,490 But you know what happens when the intrusion protection systems are in place? 461 00:26:46,490 --> 00:26:53,710 Well , it's a race, but I took a bat and knocked out the other guy's kneecap, so he's not running anymore. 462 00:26:54,770 --> 00:27:04,370 So , I got about an average of 32,000 packets to do and instead of about 100 milliseconds, I can do it, like, about as long as I freaking want. 463 00:27:05,470 --> 00:27:10,010 Moral of the story, do not automatically shun IPs. 464 00:27:10,010 --> 00:27:12,630 But, you know, I can do the other side. 465 00:27:12,650 --> 00:27:16,510 I can also spoof malicious traffic from the server network to the client network. 466 00:27:16,510 --> 00:27:21,250 So, you know, use some podunk ISP and it's like, holy crap, the bank is trying to kill me! 467 00:27:21,650 --> 00:27:23,950 I paid my loan, man! 468 00:27:24,670 --> 00:27:35,070 Well, so, there's a little difference here, because you'd think if the ISP is no longer talking to the bank, well, you know, the ISP sends out the request and the reply comes back and the reply is blocked. 469 00:27:35,330 --> 00:27:42,070 But, if the reply, you know, you think, well, when I spoof stuff, it also has to be blocked, right? 470 00:27:43,070 --> 00:27:46,570 Funny thing about IP, there's no affinity. 471 00:27:46,750 --> 00:27:56,490 And by that I mean, IP addresses, you know, you can actually return a DNS, when you send out a DNS request, about 15% of the time some other guy replies. 472 00:27:56,490 --> 00:27:58,150 And it works. 473 00:27:58,710 --> 00:28:06,150 So that means, the legitimate host can't send you back replies, but the entire internet can be spoofing replies back. 474 00:28:06,150 --> 00:28:10,390 And they'll all work if their transaction ID is correct. 475 00:28:10,770 --> 00:28:11,690 Oops. 476 00:28:11,770 --> 00:28:15,570 Again, do not implement automated network shunning. 477 00:28:16,070 --> 00:28:27,550 But there are people who like it, and I'll go ahead and I'll say, okay, make sure you can talk to name servers, see if you can make it so your outbound communications override any automatic shunning. 478 00:28:27,670 --> 00:28:30,670 And, you know, again, do not touch name servers. 479 00:28:31,130 --> 00:28:33,410 But seriously, don't do this stuff. 480 00:28:33,410 --> 00:28:40,850 There's just 80 million ways that automatic shunning, you're giving, they're giving you guys access to their firewall table. 481 00:28:40,850 --> 00:28:42,950 What is wrong with these people? 482 00:28:43,570 --> 00:28:44,950 So don't do that. 483 00:28:46,130 --> 00:28:47,510 Go to the next slide. 484 00:28:47,590 --> 00:28:49,390 But what about complaint emails? 485 00:28:49,670 --> 00:28:54,710 You know, funny thing, you know, often they get assigned complaint emails and they negotiate and find out this stuff's going on. 486 00:28:54,710 --> 00:28:57,650 Well, funny thing happens when you block someone's name server. 487 00:28:57,650 --> 00:29:00,170 You can't send mail to that domain anymore. 488 00:29:00,690 --> 00:29:01,730 Oops. 489 00:29:02,250 --> 00:29:05,410 Now, what would I know about complaints? 490 00:29:05,410 --> 00:29:10,870 Well, when you send 4 billion IP packets, people can tend to notice. 491 00:29:11,970 --> 00:29:15,090 I've been working with these guys called Prolexic. 492 00:29:15,250 --> 00:29:15,710 And... 493 00:29:17,790 --> 00:29:19,430 God damn it. 494 00:29:27,020 --> 00:29:28,460 All right, look. 495 00:29:28,640 --> 00:29:33,740 So, basically, you know how you have these third-party spam filters? 496 00:29:33,740 --> 00:29:37,280 They get your mail and they send you the good stuff? 497 00:29:37,300 --> 00:29:39,020 These guys do that for IP. 498 00:29:39,300 --> 00:29:46,500 They announce your route and they take all the crap that you guys send and be like, that's a very nice 10 gig UDP flood. 499 00:29:46,500 --> 00:29:47,900 I'm going to filter that. 500 00:29:47,900 --> 00:29:52,240 These guys have just ridiculous amounts of extra bandwidth and they gave it to me. 501 00:29:53,780 --> 00:30:00,820 I've never actually been able to, like, I can't send packets faster than this network can route them. 502 00:30:00,820 --> 00:30:02,880 I feel like less of a man. 503 00:30:04,440 --> 00:30:10,840 I've been working with all sorts of cool people and, you know, I've been doing all sorts of stuff to be all legitimate. 504 00:30:10,840 --> 00:30:13,300 You know, don't do this at home. 505 00:30:13,300 --> 00:30:15,200 Your colo will die. 506 00:30:15,720 --> 00:30:16,780 I tried. 507 00:30:16,780 --> 00:30:18,520 It was out in an hour. 508 00:30:18,520 --> 00:30:26,020 You will get complaints and very scary people will be calling you personally and be like, what the hell are you doing? 509 00:30:26,180 --> 00:30:29,400 So seriously, I can't emphasize this enough. 510 00:30:29,400 --> 00:30:36,720 I'm doing this because there's a little problem with, you know, large scale network attackers having better intelligence on the network than I do. 511 00:30:36,760 --> 00:30:37,900 That's not cool. 512 00:30:38,740 --> 00:30:40,480 But yeah, don't do this at home. 513 00:30:40,920 --> 00:30:43,260 I've set up, you know, reverse lookups. 514 00:30:43,260 --> 00:30:44,640 I'm in Aaron. 515 00:30:45,500 --> 00:30:47,600 There's Dan Kaminski security research. 516 00:30:47,600 --> 00:30:49,220 How rad is that? 517 00:30:50,300 --> 00:30:51,520 Like abuse mails. 518 00:30:51,520 --> 00:30:53,660 Someone has hacked in your box. 519 00:30:53,920 --> 00:30:55,320 Dude, that's me. 520 00:30:57,780 --> 00:31:02,320 So yeah, you know, oh, best email is like, you know, thank you for your information. 521 00:31:02,480 --> 00:31:04,100 We will see you in Vegas. 522 00:31:04,100 --> 00:31:05,400 Like, oh, crap. 523 00:31:06,020 --> 00:31:06,820 Handcuffs. 524 00:31:09,380 --> 00:31:11,080 So, what do I want to do? 525 00:31:11,080 --> 00:31:14,680 I wanted to go ahead and find, you know, Google's taken out by some DNS poisoning attack. 526 00:31:14,680 --> 00:31:17,380 You know, who is actually hit by this thing? 527 00:31:17,380 --> 00:31:29,320 So, you know, we scan the world, the entire world, and we find somewhere between, we find actually 9 million name servers, but after the scan, only about 2.5 million of them would actually talk to me. 528 00:31:31,440 --> 00:31:32,560 Shit. 529 00:31:33,360 --> 00:31:42,560 Um, I needed to find, because it turns out you had to have a Microsoft server talking to a Windows server. 530 00:31:42,560 --> 00:31:46,120 No, excuse me, Microsoft server talking God damn it. 531 00:31:50,740 --> 00:31:55,980 Okay, the problem with this plan is, like, the more I drink, the more mistakes I'll make. 532 00:31:57,060 --> 00:32:00,260 Okay, so, I'm totally getting that ever clear. 533 00:32:00,980 --> 00:32:06,000 So, look, you have to have Windows servers who are linking to bind date servers. 534 00:32:06,000 --> 00:32:08,160 Fairly obscure situation, right? 535 00:32:08,360 --> 00:32:10,120 Um, okay. 536 00:32:10,120 --> 00:32:12,640 Well, how do we find that one server is linking to another? 537 00:32:12,640 --> 00:32:17,420 By linking, I mean, instead of going out and resolving it itself, it asks its buddy. 538 00:32:17,720 --> 00:32:19,480 How do we find these links? 539 00:32:19,840 --> 00:32:29,900 And, um, the way that I ended up using is basically to just ask everyone, hey, you know, hey you, go ahead, you know, what's your name? 540 00:32:29,900 --> 00:32:30,760 Your name's Bob? 541 00:32:30,760 --> 00:32:35,780 Go ahead and look up bob.madness.net and madness is a domain I own. 542 00:32:35,860 --> 00:32:41,500 If some guy named Charlie walks up to me, okay, I know Bob asked Charlie to look something up. 543 00:32:41,500 --> 00:32:44,660 So I know there's a link between those two domains and those name servers. 544 00:32:44,660 --> 00:32:46,180 That's how I did it. 545 00:32:46,640 --> 00:32:48,280 What were the end results? 546 00:32:48,760 --> 00:32:53,900 Um , well, we got about two and a half million verified name servers, meaning, um, they would still talk to me. 547 00:32:54,600 --> 00:33:04,560 And, uh, of those two and a half million, we used a tool called fpDNS, fingerprint DNS, and we fingerprinted every single one of them. 548 00:33:05,320 --> 00:33:08,020 Ooh, I got some emails out of that one. 549 00:33:08,560 --> 00:33:09,840 Ooh, crap. 550 00:33:09,840 --> 00:33:14,020 There are a lot of IDSs that are like, you tried to check version. 551 00:33:14,020 --> 00:33:16,660 How could you possibly do that? 552 00:33:16,660 --> 00:33:21,380 You know, your attack is detected by 100%. 553 00:33:22,660 --> 00:33:25,100 You know it without fail. 554 00:33:26,120 --> 00:33:28,420 Like, seriously, people did not like it. 555 00:33:28,420 --> 00:33:29,100 But you know what? 556 00:33:29,100 --> 00:33:38,800 We're dealing with security and, um, you know, we found about 230,000 hosts that are possibly broken, 13,000 that are definitely broken, and you know what? 557 00:33:38,800 --> 00:33:40,760 I'm going to be sending some emails. 558 00:33:41,120 --> 00:33:44,020 And we're going to get this problem dealt with. 559 00:33:44,240 --> 00:33:48,200 And incidentally, uh, scan was done in under a day. 560 00:33:48,480 --> 00:33:50,140 It's good to be the author of scanrand. 561 00:33:50,140 --> 00:33:51,560 I send packets fast. 562 00:33:51,680 --> 00:33:52,520 Fuck yeah. 563 00:33:52,520 --> 00:33:55,140 Oh, oh, who said that? 564 00:33:55,920 --> 00:33:56,460 Who said that? 565 00:33:56,460 --> 00:33:57,100 Oh. 566 00:33:57,900 --> 00:33:59,180 Hell yeah. 567 00:33:59,200 --> 00:34:00,300 Well, maybe not. 568 00:34:00,640 --> 00:34:02,600 Hey, someone get him that shirt. 569 00:34:04,700 --> 00:34:07,560 Um, I'm not replying. 570 00:34:08,540 --> 00:34:12,140 So look, kind of, uh, reversing the thing. 571 00:34:12,160 --> 00:34:14,660 Normally with an exploit, you're like, I've got this box. 572 00:34:14,660 --> 00:34:16,720 I wonder what it's vulnerable to. 573 00:34:16,800 --> 00:34:17,440 Reverse. 574 00:34:17,440 --> 00:34:20,400 Um, I wonder if someone fucked this up. 575 00:34:20,400 --> 00:34:22,140 Let's ask everyone. 576 00:34:23,140 --> 00:34:31,220 So I'm like, you know, I wonder, you know, there's these transaction IDs and if there's a known transaction ID, you can DNS spoof on demand. 577 00:34:31,220 --> 00:34:40,860 I wonder, is anyone using the same transaction ID when I make a request, when they go out to the outside world, does anyone use the same thing? 578 00:34:40,860 --> 00:34:42,240 Because that'd be really insecure. 579 00:34:42,240 --> 00:34:43,980 That'd be dumb. 580 00:34:43,980 --> 00:34:48,340 You'd have to be like, you know, one in a hundred thousand to be this dumb. 581 00:34:48,340 --> 00:34:52,760 But there's a funny thing that happens when you ask two and a half million people a question. 582 00:34:52,760 --> 00:34:55,360 You find the dumb ones. 583 00:34:55,820 --> 00:34:59,780 So there's like, uh, so we asked everyone with a fixed, you know, transaction ID. 584 00:34:59,780 --> 00:35:01,140 I had the data anyway. 585 00:35:01,140 --> 00:35:06,220 And we found about 110 hosts that are dumb. 586 00:35:06,320 --> 00:35:16,500 And of these 110 hosts, it's major vendors ADSL modem, so wow, look at all these networks I can completely own on demand. 587 00:35:16,700 --> 00:35:22,320 And the name server that I was using to host my own data. 588 00:35:24,830 --> 00:35:26,750 God dammit. 589 00:35:26,750 --> 00:35:31,230 In my defense, it was an old version, but oh yeah. 590 00:35:34,200 --> 00:35:34,760 So... 591 00:35:34,760 --> 00:35:36,220 Oh, fuck that. 592 00:35:38,770 --> 00:35:40,190 God dammit. 593 00:35:42,670 --> 00:35:43,790 Speaking of... 594 00:35:43,790 --> 00:35:47,590 You fucking assholes, I need to do the drinking game. 595 00:35:48,150 --> 00:35:49,090 Alright. 596 00:35:49,270 --> 00:35:50,210 I'm liking this. 597 00:35:50,210 --> 00:35:52,090 I may do all my talks smashed. 598 00:35:53,950 --> 00:35:55,150 Hello, sir. 599 00:35:55,150 --> 00:35:56,590 I'm drunk. 600 00:35:57,430 --> 00:36:00,550 I don't know how we never noticed this before. 601 00:36:02,010 --> 00:36:05,050 You know on TCP you can scan for servers? 602 00:36:05,470 --> 00:36:07,170 Well, UDP is a little different. 603 00:36:07,170 --> 00:36:10,270 There really is no difference between a client and a server. 604 00:36:10,790 --> 00:36:16,270 How did we not realize until 2005 that you can scan for client ports as well? 605 00:36:16,470 --> 00:36:21,110 Name servers very often have fixed ports that they send all their requests from. 606 00:36:21,110 --> 00:36:22,550 They use a single socket. 607 00:36:22,810 --> 00:36:26,930 And it turns out, you can scan for this client socket. 608 00:36:26,930 --> 00:36:29,590 You can find out who they're sending requests out to. 609 00:36:29,730 --> 00:36:31,450 And I'm like, well, what are these ports? 610 00:36:31,450 --> 00:36:36,190 I bet there's lots of servers that send out questions from a source port of 53. 611 00:36:36,630 --> 00:36:42,950 But you see, that's, I think, the nice thing about having ASLO to data is you can know. 612 00:36:42,950 --> 00:36:44,530 Let's look at the data. 613 00:36:44,530 --> 00:36:46,470 Oh, look at that. 614 00:36:46,950 --> 00:36:53,350 823 ,000 times the source port was 32,768 on an outgoing request. 615 00:36:53,590 --> 00:36:57,970 And 195 ,000 times it was 32,769. 616 00:36:57,970 --> 00:37:07,530 And 54 ,000 times, oh, you're telling me on a large portion of the internet infrastructure I can monitor load levels on remote name servers? 617 00:37:07,810 --> 00:37:08,930 Sweet. 618 00:37:10,350 --> 00:37:16,270 So, um, yeah, you should be running a name server that actually buries its local port. 619 00:37:16,810 --> 00:37:21,590 Other stuff, there's like a 15 minute chunk of DNS poisoning things I can't tell you about. 620 00:37:21,590 --> 00:37:24,630 But holy crap, someone's up to some nasty shit. 621 00:37:24,950 --> 00:37:26,070 Wow. 622 00:37:26,070 --> 00:37:28,250 And I wasn't even looking for it. 623 00:37:28,250 --> 00:37:29,890 It just accidentally came back. 624 00:37:29,890 --> 00:37:32,350 Hey, by the way, we're spoofing these guys. 625 00:37:32,650 --> 00:37:34,150 You're what? 626 00:37:35,110 --> 00:37:47,470 And it turns out there's all these systems that automatically investigate what the hell you're doing when you are sending 4 billion packets, but when they investigate they have no idea that the investigation comes back to you. 627 00:37:47,630 --> 00:37:58,310 So I've got traffic from really, really dark networks where it's just like, hi, there's no one within the rest of my class A, but who are you? 628 00:37:59,830 --> 00:38:00,970 No, no, no, no, no. 629 00:38:00,970 --> 00:38:02,450 Who are you? 630 00:38:05,470 --> 00:38:12,370 So, um, as long as we're sending assloads of traffic, can we make some pretty pictures? 631 00:38:12,370 --> 00:38:14,210 Because, you know, people like that. 632 00:38:14,290 --> 00:38:23,650 And so I've actually generated a methodology that goes ahead and create maps all internet routes in about a couple hours. 633 00:38:23,650 --> 00:38:25,990 It's really, really fast. 634 00:38:26,550 --> 00:38:31,870 And , um, you know, rather than just like hype, I'll show you the raw data as it's collected. 635 00:38:32,470 --> 00:38:38,050 And before anyone from DEF CON has a heart attack, this scan is happening from the 170 gigabit pipe. 636 00:38:38,650 --> 00:38:41,590 So we go ahead, we go into it. 637 00:38:45,880 --> 00:38:46,920 Boom! 638 00:38:47,700 --> 00:38:49,800 Hi, internet, how are you doing? 639 00:38:49,800 --> 00:38:53,440 We're sending out about 20,000 packets a second right now. 640 00:38:53,440 --> 00:38:57,960 And, um, we're tracerouting in this massive, uncontrolled manner. 641 00:38:57,960 --> 00:39:01,820 And lots and lots and lots and lots and lots of hosts are talking to us. 642 00:39:01,820 --> 00:39:03,340 That's a mess, right? 643 00:39:03,340 --> 00:39:05,340 How are we going to filter it? 644 00:39:05,340 --> 00:39:07,480 Well, welcome to SQL. 645 00:39:07,480 --> 00:39:10,280 Fun little language, lets us organize things. 646 00:39:10,280 --> 00:39:16,260 Once we run this stupid little query, you know, show me what, you know, reorder this until it makes sense. 647 00:39:16,400 --> 00:39:17,180 Oh, look! 648 00:39:17,200 --> 00:39:22,840 On the way to 12.10.41.178, here's all of our hops. 649 00:39:23,160 --> 00:39:26,020 And here's hop one, hop two, hop three, hop four. 650 00:39:26,020 --> 00:39:30,700 What you were seeing before was wildly disordered, and now we have it in order. 651 00:39:31,140 --> 00:39:33,140 And how do we define that two things are linked? 652 00:39:33,140 --> 00:39:41,380 Well, if that number's three and that number's four, then 67, you know, this host is probably connected to this host. 653 00:39:41,660 --> 00:39:47,760 Mind you, we're scanning the internet over a range of like two hours, so this is actually kind of cool to see it in some degree of order. 654 00:39:48,320 --> 00:39:55,180 And, um, what does this crap look, well, hang on, what does this look like when we actually get it said and done? 655 00:39:56,060 --> 00:39:57,860 Finally, I get to show some pretty pictures. 656 00:40:06,170 --> 00:40:07,210 I know. 657 00:40:08,450 --> 00:40:09,710 I'm well aware. 658 00:40:16,180 --> 00:40:22,540 So this data's been around for a while, but, uh, being able to zoom in on it is kind of new. 659 00:40:23,820 --> 00:40:30,300 And, uh, being able to, like, tilt it down and, you know, raise it up and, like, fly around. 660 00:40:30,300 --> 00:40:36,920 Everyone, you know, Hollywood really wants someone to do this, so fine, here, I'm flying around the internet, ain't that rad? 661 00:40:46,360 --> 00:41:01,220 Now the eventual goal, and this will happen sometime in the next couple of months, yeah, I really broke my arm, um, but the goal is that we can go ahead and we can take live data and we can go ahead and plot it so this is all black and white and as you actually use the net, 662 00:41:01,220 --> 00:41:06,120 it goes, you're going over this path, you're going over this path, here's all the constraints and all that kind of stuff. 663 00:41:06,120 --> 00:41:09,700 And that's the kind of data I want to be able to, you know, collect. 664 00:41:09,720 --> 00:41:23,120 It turns out when you do this kind of large mapping, there's a couple things you can do extra, um, whenever, you know, we have to scan up to a certain range, if we actually find someone, you know, at the, you know, the farthest away possible, we can go back, 665 00:41:23,120 --> 00:41:38,140 fill in the gaps, um, we can actually go ahead and, you know, put out senders all over the internet and have all the reception happen at the same point, so we can say, here's how the net looks from China, here's how the net looks from Japan, here's how the net looks from Abu Dhabi, 666 00:41:38,140 --> 00:41:43,020 and all of it will come back to the same collector, and we can go ahead and we can integrate the data. 667 00:41:43,400 --> 00:41:48,800 Um , and the results look pretty cool, but there is, there is a weakness. 668 00:41:49,300 --> 00:41:51,180 Yeah, how are we going to make this useful? 669 00:41:51,180 --> 00:41:57,380 And beyond that, I don't want to have to do this big preprocessing phase, I would like to graph live data. 670 00:41:57,380 --> 00:41:58,860 How could I do that? 671 00:41:59,140 --> 00:42:07,620 Well, there's these guys, they wrote some code in C++, it makes my nose bleed, but it's really, really cool. 672 00:42:07,620 --> 00:42:14,780 It's really, really cool to the level of, like, it will handle, like, 2 million node networks and be like, huh, sweet, got more? 673 00:42:15,560 --> 00:42:16,760 It's really cool. 674 00:42:16,760 --> 00:42:18,880 It's called the Boost Graph Library. 675 00:42:18,880 --> 00:42:19,660 It's rad. 676 00:42:19,660 --> 00:42:24,580 And not only is it rad, but their developers are like, okay, we're going to support Dan. 677 00:42:24,800 --> 00:42:26,180 Like, sweet. 678 00:42:26,420 --> 00:42:31,340 They're getting, like, updates, like, here is your code, here are the answers to the test. 679 00:42:31,340 --> 00:42:35,200 Like, struggle with this stuff for, like, four days, send them a mail, here you go. 680 00:42:35,680 --> 00:42:36,340 Rad. 681 00:42:37,440 --> 00:42:44,020 So, what kind of stuff can we do now that we have, like, you know, real graph logical stuff? 682 00:42:45,640 --> 00:42:47,100 Let's see here. 683 00:42:51,780 --> 00:42:55,420 This is a router trace on a small network. 684 00:42:57,800 --> 00:42:59,940 That's a little dark, isn't it? 685 00:43:00,400 --> 00:43:03,080 We'll set the next one to be a little lighter. 686 00:43:29,680 --> 00:43:32,100 This is a fairly large-scale network. 687 00:43:33,060 --> 00:43:34,920 And , actually, this is a router trace. 688 00:43:34,920 --> 00:43:36,400 We're watching traffic. 689 00:43:36,780 --> 00:43:40,140 And it's actually animating out in front of us in real time. 690 00:43:40,300 --> 00:43:43,980 And we're watching, basically, nodes that aren't talking to anyone else. 691 00:43:43,980 --> 00:43:47,460 Here's a cluster right here that's just one server talking to lots of hosts. 692 00:43:47,480 --> 00:43:50,460 Here are servers that have a multi-tier relationship. 693 00:43:50,460 --> 00:43:54,080 This is all very early code written in the last week or two. 694 00:43:54,120 --> 00:43:55,660 But, ooh, it's pretty. 695 00:43:56,820 --> 00:44:01,420 And, um, the idea is you can actually, like, stream random data in. 696 00:44:01,420 --> 00:44:10,160 If I had any faith in the networks of these things, I could actually do live TCP dump with all interrelationships shown on that kind of map. 697 00:44:10,160 --> 00:44:11,260 And is this useful? 698 00:44:11,260 --> 00:44:13,320 Well, I haven't made a discovery on it. 699 00:44:13,320 --> 00:44:17,220 I took all my DNS interrelationship data and put it into that graph. 700 00:44:17,220 --> 00:44:18,760 And what did we find? 701 00:44:19,380 --> 00:44:26,680 Interestingly enough, oh, crap, there's a whole bunch of hosts that are all coming back to one that I expected. 702 00:44:26,680 --> 00:44:32,240 What I did not expect, and it'll take, actually, a few seconds for it to show up on this, but you'll just have to believe me. 703 00:44:32,260 --> 00:44:39,340 My expectation was that you would have, you know, lots and lots of hosts that actually went to one backend that talked to me. 704 00:44:39,340 --> 00:44:42,920 What you actually see is a pretty complex multi-tier relationship. 705 00:44:42,920 --> 00:44:47,360 One name server will talk to another name server, will talk to another name server, and will talk to another name server. 706 00:44:47,360 --> 00:44:51,420 This was something that I would not have expected. 707 00:44:51,420 --> 00:45:02,960 I actually don't know the layouts that create this, but having seen the data, having seen it visually, I could now build my systems around that assumption. 708 00:45:03,180 --> 00:45:15,080 The goal of all of this is that when I do mass internet scale scans, every time I send a packet, I can know the route that packet is going to probably take. 709 00:45:15,080 --> 00:45:17,720 I can know the routers it's probably going to go over. 710 00:45:17,720 --> 00:45:20,180 I can know what the bandwidth implications are. 711 00:45:20,180 --> 00:45:23,360 I can look at my pipe as a water hose. 712 00:45:23,420 --> 00:45:26,960 Not a hose, as a pipe of just high pressure water. 713 00:45:26,960 --> 00:45:33,020 And I can go ahead and build taps on that based on what the implications are on the underlying network. 714 00:45:33,020 --> 00:45:35,120 So I can say, here's a T1. 715 00:45:35,120 --> 00:45:36,880 Packets through there can only go at this rate. 716 00:45:36,880 --> 00:45:38,040 Here's an OC48. 717 00:45:38,040 --> 00:45:39,900 Packets on here can only go on this rate. 718 00:45:39,900 --> 00:45:46,240 And most interestingly, I can put monitors on every single router that I'm sending traffic through. 719 00:45:46,260 --> 00:45:56,980 And the moment those monitors, I call it canaries, you send five or ten packets a second to each router you expect to go through, as soon as these canaries stop responding, you know you killed them. 720 00:45:58,100 --> 00:45:58,500 So... 721 00:45:58,500 --> 00:46:00,400 I'm going to start killing canaries. 722 00:46:00,400 --> 00:46:01,400 Ain't that fun? 723 00:46:04,860 --> 00:46:06,260 And now the last thing. 724 00:46:06,260 --> 00:46:09,340 I have no idea if I've gone over, but I hope you guys have had fun. 725 00:46:10,880 --> 00:46:13,120 Who here was at my ATalk here last year? 726 00:46:16,950 --> 00:46:19,090 Hey, I haven't screwed up yet. 727 00:46:19,610 --> 00:46:19,930 So... 728 00:46:23,740 --> 00:46:25,780 You're wearing a power glove! 729 00:46:25,780 --> 00:46:27,040 How can I resist? 730 00:46:28,400 --> 00:46:30,180 Anyone got shot glasses? 731 00:46:30,180 --> 00:46:32,160 Can I get some shot glasses up here? 732 00:46:32,380 --> 00:46:33,340 What's your name? 733 00:46:33,340 --> 00:46:34,380 Patrick! 734 00:46:34,420 --> 00:46:37,280 Patrick, this is why I fucking come to DEF CON. 735 00:46:37,320 --> 00:46:40,100 Because people will get me really fucked up. 736 00:46:40,500 --> 00:46:42,500 Mind you, I've never had Everclear before. 737 00:46:47,340 --> 00:46:50,380 Hey, am I shying away from this? 738 00:46:50,380 --> 00:46:52,540 No, because I'm trashed. 739 00:46:53,880 --> 00:46:55,920 I am so fucked. 740 00:47:00,900 --> 00:47:02,640 Hey, I am drinking. 741 00:47:10,580 --> 00:47:12,320 Alright, we're here. 742 00:47:12,320 --> 00:47:13,560 You know what we're drinking to? 743 00:47:13,560 --> 00:47:15,040 We're drinking to TourCon. 744 00:47:15,040 --> 00:47:17,880 Probably my favorite small con in the world. 745 00:47:17,880 --> 00:47:19,640 It is just the shit. 746 00:47:19,820 --> 00:47:21,160 DEF CON is rad. 747 00:47:21,200 --> 00:47:23,020 TourCon is just... 748 00:47:23,700 --> 00:47:24,740 Hikari is awesome. 749 00:47:24,740 --> 00:47:25,980 Is Hikari even here? 750 00:47:25,980 --> 00:47:26,800 Dude! 751 00:47:28,360 --> 00:47:29,700 Fucking Hikari. 752 00:47:29,920 --> 00:47:30,640 Dude! 753 00:47:31,380 --> 00:47:32,340 Hey, wait, wait, wait. 754 00:47:32,340 --> 00:47:35,460 Do we have a third shot glass by any chance? 755 00:47:36,020 --> 00:47:37,540 Hikari , get the fuck up here. 756 00:47:39,620 --> 00:47:41,300 Here, you're drinking this shit. 757 00:47:41,540 --> 00:47:42,500 I'm drinking Everclear . 758 00:47:42,500 --> 00:47:44,280 You can drink the fucking Morgans . 759 00:47:45,160 --> 00:47:46,380 Just drink. 760 00:47:46,780 --> 00:47:47,660 Alright. 761 00:47:48,140 --> 00:47:49,920 To a great fucking con. 762 00:47:49,920 --> 00:47:50,800 You guys all rule. 763 00:47:50,800 --> 00:47:52,680 Thank you so much for coming here. 764 00:48:50,200 --> 00:48:51,920 It's actually working. 765 00:48:51,920 --> 00:48:54,380 Holy hell, I didn't think it would actually work. 766 00:48:55,200 --> 00:48:57,700 Alright, I'm putting audio out through the PC interface. 767 00:48:57,700 --> 00:48:59,040 This better work, guys. 768 00:48:59,660 --> 00:49:01,040 I'm warning you. 769 00:49:01,040 --> 00:49:02,320 Audio's coming any minute now. 770 00:49:02,320 --> 00:49:09,600 Oh, so I had to put on a huge cache on this thing because the Black Hat network was broken beyond all description. 771 00:49:10,120 --> 00:49:13,040 It was like wireless from like 20 feet away. 772 00:49:13,700 --> 00:49:19,000 Michael Flackley is the Lord of the Dance. 773 00:49:20,040 --> 00:49:24,120 Darth Vader is the Lord of the Sith. 774 00:49:26,220 --> 00:49:30,160 Okay, Robot Chicken is the best fucking show in the world. 775 00:49:30,580 --> 00:49:43,880 Robot Chicken rocks. 776 00:49:43,880 --> 00:49:47,520 And that's all about all I have for you fucking guys. 777 00:49:58,160 --> 00:49:59,040 Wow. 778 00:50:13,620 --> 00:50:18,540 So, just fucking come up here. 779 00:50:18,540 --> 00:50:20,040 I want people to hear your shit. 780 00:50:20,740 --> 00:50:23,620 Seriously, I really want people to come up and ask questions. 781 00:50:23,940 --> 00:50:25,760 Can I fucking have your babies? 782 00:50:27,840 --> 00:50:29,740 Dude, you're a guy. 783 00:50:31,800 --> 00:50:34,880 Seriously, someone came up with some auto-shunning question? 784 00:50:34,880 --> 00:50:35,900 Come on, come here. 785 00:50:35,980 --> 00:50:37,520 Alright, what you got, man? 786 00:50:37,980 --> 00:50:43,740 Do the IPSs that you're aware of, will they auto-shun their loopback interface? 787 00:50:44,960 --> 00:50:47,600 I had totally not thought of that. 788 00:50:48,620 --> 00:50:49,740 That would... 789 00:50:50,980 --> 00:50:53,740 I seem to have nothing to drink. 790 00:50:53,740 --> 00:50:57,160 You guys are falling down on the job. 791 00:50:57,160 --> 00:50:58,940 I bring you here for... 792 00:50:58,940 --> 00:50:59,880 What, you want me to drink? 793 00:50:59,880 --> 00:51:00,760 Okay. 794 00:51:08,920 --> 00:51:11,020 That's a really interesting question. 795 00:51:11,020 --> 00:51:15,040 Okay, so here's the idea, and this is fucked. 796 00:51:15,200 --> 00:51:17,780 This is really, really impressively fucked up. 797 00:51:17,780 --> 00:51:26,760 The idea is that you spoof a whole bunch of traffic to some network from the address 127.0.0.1, which is, of course, the loopback address on a host. 798 00:51:26,760 --> 00:51:30,420 Will the IPS actually block local host? 799 00:51:30,420 --> 00:51:34,060 Because if it does, all sorts of shit's going down. 800 00:51:37,640 --> 00:51:40,460 IPS vendors in this room, test. 801 00:51:40,460 --> 00:51:41,500 Like, now. 802 00:51:41,520 --> 00:51:44,760 Because there's, like, a thousand people who have the idea of testing it. 803 00:51:45,400 --> 00:51:46,560 Hey, you have your hand up. 804 00:51:46,560 --> 00:51:47,560 Get the fuck up here. 805 00:51:49,680 --> 00:51:50,820 No, no, come up. 806 00:51:50,820 --> 00:51:51,680 Come up. 807 00:51:52,820 --> 00:51:54,080 Seriously, come on up. 808 00:51:54,080 --> 00:51:57,140 There's, like, booze and books and, like, good shit and, like... 809 00:51:57,140 --> 00:51:58,260 God damn it. 810 00:52:00,440 --> 00:52:06,620 No, it's just a rebuttal to the earlier question is if you've got your router set up right, your edge router 127 shouldn't get in? 811 00:52:07,320 --> 00:52:15,360 If your edge router's automatic, already blocking 127.0.0.1, then, uh, of course, yeah, you're not going to go ahead and get nasty traffic. 812 00:52:15,360 --> 00:52:19,020 But, um, a lot of people have the attitude, well, I got an IPS. 813 00:52:19,020 --> 00:52:21,940 What do I need to put custom firewalls rules in for? 814 00:52:21,940 --> 00:52:25,980 The internet will be giving me firewall rules! 815 00:52:27,080 --> 00:52:41,240 Actually, honestly, probably a lot of IPSs already have blocks against 127 and have blocks against RFC 1918 space, but I'm sure there's one that doesn't because there's some really crappy IPSs out there. 816 00:52:42,040 --> 00:52:42,680 What's up? 817 00:52:42,680 --> 00:52:43,780 Hang on, hang on, hang on. 818 00:52:44,140 --> 00:52:48,060 You're trying to kick my ass, and so, of course, I have to give you the mic. 819 00:52:48,980 --> 00:52:50,780 What happens to overlapping segments, Dan? 820 00:52:50,940 --> 00:52:53,080 What do you mean, what happens to overlapping segments? 821 00:52:53,080 --> 00:52:57,980 What happens to the segments, uh, the timeout values if the segments are overlapping, Dan? 822 00:52:58,020 --> 00:53:00,580 Ah, yes, yes, yes, that's one of the things I pointed out. 823 00:53:00,580 --> 00:53:02,280 There are some very good... 824 00:53:02,280 --> 00:53:03,120 Okay. 825 00:53:03,800 --> 00:53:12,220 There are some relatively good IPSs because they're all shit, but there are some relatively good IPSs that will notice hey, look, this... 826 00:53:12,220 --> 00:53:28,720 They basically will go ahead and have their timing value for how long the fragment can live, but fragments have a particular IP ID associated with them, and there will be a separate timer, a much longer timer that notes, hey, I may have flushed this from my queue, 827 00:53:28,720 --> 00:53:34,600 but this is a fragment on a session from an old... 828 00:53:34,600 --> 00:53:38,300 This is an old... This is a fragment that could be applied to an old session. 829 00:53:38,300 --> 00:53:40,900 In other words, someone could be trying to mess with me. 830 00:53:41,000 --> 00:53:41,440 Hmm. 831 00:53:41,440 --> 00:53:43,240 Why would I try to be messing with anyone? 832 00:53:43,240 --> 00:53:45,100 Yeah, I guess they can bust me. 833 00:53:45,460 --> 00:53:46,400 Um, those... 834 00:53:47,300 --> 00:53:52,320 Those IPSs are really easy to fingerprint, and there is a problem in this industry. 835 00:53:52,320 --> 00:53:55,320 There are vulnerabilities in security code itself. 836 00:53:55,640 --> 00:53:56,900 I don't want to share that. 837 00:53:56,900 --> 00:53:58,300 I just want you to take a drink. 838 00:54:01,140 --> 00:54:02,660 Get ready to drink. 839 00:54:03,780 --> 00:54:07,500 Really, I am so screwed in TC Baby Drinking Game. 840 00:54:07,600 --> 00:54:08,880 Hey, come up here. 841 00:54:12,740 --> 00:54:14,720 Can I have your baby? 842 00:54:14,860 --> 00:54:17,360 Well, you definitely are a girl. 843 00:54:19,380 --> 00:54:20,860 New comment. 844 00:54:23,820 --> 00:54:25,020 Later. 845 00:54:26,960 --> 00:54:28,340 Come here. 846 00:54:29,920 --> 00:54:34,620 All the fragmenting stuff, does that work if they're filtering fragmented packets? 847 00:54:35,200 --> 00:54:36,900 No, it doesn't. 848 00:54:36,900 --> 00:54:41,680 But that's a problem because fragments are a legitimate part of the IP spec. 849 00:54:41,680 --> 00:54:43,100 They're actually... 850 00:54:43,100 --> 00:54:49,060 No, there's quite a few networks that are tunneled inside of tunnels, and they end up with much smaller... 851 00:54:49,060 --> 00:54:57,340 You know, in the multi-tunneling, end up with packets larger than the MTU because there's a lot of packets that will be sent with an MTU of 1500. 852 00:54:57,640 --> 00:54:59,420 So, fragmentation happens. 853 00:54:59,420 --> 00:55:07,360 It's supposed to be limited by TCP's MSS value, but sometimes it really does happen, and it does happen entirely legitimately. 854 00:55:07,460 --> 00:55:13,480 Now, small fragments, and this is very obscure, but small fragments at the beginning of a packet should not happen. 855 00:55:13,480 --> 00:55:16,380 And those things are legitimately dropped, and that's good. 856 00:55:17,560 --> 00:55:18,320 Go ahead. 857 00:55:18,320 --> 00:55:20,060 Because I've seen networks that do that. 858 00:55:20,060 --> 00:55:21,600 They filter out the fragmented packets. 859 00:55:21,600 --> 00:55:22,940 What are they missing out on? 860 00:55:23,580 --> 00:55:25,540 Is there anything interesting about them? 861 00:55:25,540 --> 00:55:26,820 Well, there's an interesting thing. 862 00:55:26,820 --> 00:55:29,460 A lot of people say, hey, I can drop 1% of traffic. 863 00:55:29,460 --> 00:55:30,060 No problem. 864 00:55:30,060 --> 00:55:31,100 It's just, you know, 1%. 865 00:55:31,680 --> 00:55:38,300 But you get, you know, this 1%, and this 1%, and this 1%, and suddenly, the internet doesn't work very well anymore. 866 00:55:38,300 --> 00:55:39,400 And that happens. 867 00:55:39,400 --> 00:55:47,340 And that's ultimately, you know, we have this thing called, like, congestion collapse, when there are too much, there's too much traffic that doesn't back off. 868 00:55:47,340 --> 00:55:48,560 There's another kind of collapse. 869 00:55:48,560 --> 00:56:01,800 It's firewall collapse, when there's too many overlapping rules from people who think, well, our one little variation on the IP spec is okay, and, you know, we're just going to do it, and, you know, who cares if we drop 1% of traffic, and then the internet no longer works. 870 00:56:02,640 --> 00:56:05,360 And, tipping point, I'm talking to you. 871 00:56:07,100 --> 00:56:09,300 I can't remember what the denial of service attack is. 872 00:56:09,300 --> 00:56:14,420 It's either New Dawn or Teardrop, where it's based on fragmented TCP packets. 873 00:56:14,420 --> 00:56:16,900 How would that work against an IPS? 874 00:56:18,120 --> 00:56:27,760 The fragmented packet, I dream about Ping of Death, maybe, where you have a packet that reassembles larger than the maximum IP size? 875 00:56:28,460 --> 00:56:35,900 Where the TCP packet reassembles and it's broken, and it causes various problems. 876 00:56:35,900 --> 00:56:38,280 At this point, you know, it's really sad. 877 00:56:38,280 --> 00:56:40,000 It's 2005, right? 878 00:56:40,000 --> 00:56:41,840 When the hell did Teardrop come out? 879 00:56:41,840 --> 00:56:44,280 Wasn't it, like, 97 or 98? 880 00:56:44,380 --> 00:56:54,580 Okay, so very well-known vendor, Netscreen, actually goes ahead and has, like, on their thing, we blocked this many Teardrop attacks. 881 00:56:54,860 --> 00:56:57,540 Dude, it's the 21st century. 882 00:56:57,540 --> 00:56:59,760 We aren't worried about that shit anymore. 883 00:56:59,760 --> 00:57:02,720 It doesn't work, even if it's unblocked. 884 00:57:02,720 --> 00:57:05,480 We're not running Windows 95. 885 00:57:08,040 --> 00:57:09,380 So, I don't know. 886 00:57:09,380 --> 00:57:12,280 I mean, Teardrop, I mean, it's a great brand. 887 00:57:12,500 --> 00:57:15,940 Oh, incidentally, you guys know how names are done in the virus industry? 888 00:57:15,940 --> 00:57:19,760 It's like, you know, they're all, like, named by the guys who find them. 889 00:57:19,760 --> 00:57:22,480 So, just like, you know, we're gonna call this attack Teardrop. 890 00:57:22,480 --> 00:57:33,500 We're gonna call this attack CodeRed, because, you know, hey, you know, they didn't, like, put a big brand copyright on it when they attacked our network, so we're gonna name it whatever gets us the most attention possible. 891 00:57:33,520 --> 00:57:36,160 And that's why they all have sexy names. 892 00:57:36,420 --> 00:57:52,660 Of course, there was a real problem when one of them named their thing Doxpar, because I do Doxpar research, and Doxpar caused me all sorts of problems, especially when the variant happened, Doxpar.A. 893 00:57:53,760 --> 00:57:55,520 You bastards. 894 00:57:57,100 --> 00:57:58,600 All right, other questions? 895 00:57:59,180 --> 00:58:00,520 What, hey, uh-oh. 896 00:58:00,860 --> 00:58:03,720 What do you think of the recent ICMP-based attacks? 897 00:58:07,020 --> 00:58:10,680 There's so much overh... So, it's really funny. 898 00:58:11,280 --> 00:58:19,740 Yes, you can kill ICMP sessions if you can figure out the four tuple of source IP, desk IP, source port, you totally can. 899 00:58:19,740 --> 00:58:26,260 But I went on Deja News, and I found a post from 1993 calling this shit old. 900 00:58:28,400 --> 00:58:29,840 Dear God. 901 00:58:30,760 --> 00:58:36,060 No, I mean, okay, the actual attacks are real, but old. 902 00:58:36,120 --> 00:58:39,840 To his credit, he's right, they still work, and they shouldn't. 903 00:58:40,020 --> 00:58:43,840 His stuff about slow... There's this guy, he has this stuff about slowing down networks. 904 00:58:43,840 --> 00:58:44,560 Why am I drinking? 905 00:58:44,560 --> 00:58:45,680 I was right. 906 00:58:46,440 --> 00:58:47,540 Okay, his stuff... 907 00:58:47,540 --> 00:58:48,580 Fuck. 908 00:58:54,080 --> 00:58:55,380 Funny guy. 909 00:58:55,380 --> 00:58:56,720 He should test his shit. 910 00:58:57,320 --> 00:59:02,000 He has this whole thing, well, I can slow down communication of BGP sessions. 911 00:59:02,140 --> 00:59:06,880 I can reduce a session down to one packet sent per round trip time. 912 00:59:07,520 --> 00:59:11,700 So, BGP sessions, I don't know if you guys know, they're about three kilobytes a second. 913 00:59:11,780 --> 00:59:13,560 Three kilobytes a second, okay. 914 00:59:13,660 --> 00:59:24,200 So, you reduce a session down to one packet per round trip time on a session that has somewhere between one millisecond and a tenth of a millisecond latency. 915 00:59:24,220 --> 00:59:25,420 Oh, no! 916 00:59:25,420 --> 00:59:33,480 I can only send a thousand to ten thousand packets a second on my three kilobyte a second link. 917 00:59:33,480 --> 00:59:34,540 No! 918 00:59:35,860 --> 00:59:37,560 It's ridiculous. 919 00:59:38,180 --> 00:59:39,380 Any other questions? 920 00:59:39,380 --> 00:59:42,840 Seriously, you don't even have to come up if I can somehow hear you. 921 00:59:46,640 --> 00:59:49,360 Says the guy from Prolexic. 922 00:59:49,360 --> 00:59:50,620 That took some balls. 923 00:59:50,620 --> 00:59:51,900 Here, have a book. 924 00:59:53,820 --> 00:59:55,660 Prolexic's been rad, by the way. 925 00:59:55,660 --> 00:59:56,840 I mean, seriously. 926 00:59:56,840 --> 01:00:00,920 They've been giving me shit tons of bandwidth and taking calls from DoD. 927 01:00:00,920 --> 01:00:01,920 Rad. 928 01:00:03,800 --> 01:00:05,800 Oh, shit, it's George. 929 01:00:06,380 --> 01:00:08,840 It's ScanRan motherfucker George. 930 01:00:15,430 --> 01:00:17,310 I hate you. 931 01:00:18,350 --> 01:00:21,050 So, I'm going to the T2 con out in Finland. 932 01:00:21,070 --> 01:00:22,850 Who here is from Europe? 933 01:00:24,550 --> 01:00:27,510 Dude, Euro guys, I'm coming out to you guys mostly. 934 01:00:27,510 --> 01:00:28,770 That's the plan. 935 01:00:29,370 --> 01:00:37,290 So, T2, I didn't intend to give them props, because TorCon is the shit, but yeah, T2 should be good. 936 01:00:38,270 --> 01:00:38,890 What? 937 01:00:39,010 --> 01:00:40,550 I didn't screw up! 938 01:00:40,550 --> 01:00:41,630 You drink! 939 01:00:41,630 --> 01:00:43,950 Hey, someone get these fuckers drinks. 940 01:00:43,950 --> 01:00:45,970 They need to be drunk so they'll shut up. 941 01:00:45,970 --> 01:00:48,470 I'm not drinking. 942 01:00:48,870 --> 01:00:50,150 No, stop. 943 01:00:55,340 --> 01:00:56,880 All right, do we have anything else? 944 01:00:56,880 --> 01:00:59,060 Because I should probably give this shit up to Hacker Jeopardy. 945 01:00:59,060 --> 01:00:59,780 OK, go ahead. 946 01:00:59,780 --> 01:01:00,580 You have a good question? 947 01:01:01,000 --> 01:01:02,060 No dude, hang on. 948 01:01:02,060 --> 01:01:03,440 I want this guy to ask a question. 949 01:01:04,800 --> 01:01:10,480 You said that one of your attacks is based on a difference between IDS timing and host timing. 950 01:01:10,480 --> 01:01:22,060 Well, in Linux and FreeBSD, isn't it possible, even in extreme situations, just to rebuild the stack so if you know your vendor in advance just to match Man gets a book. 951 01:01:22,060 --> 01:01:24,080 Man gets both books. 952 01:01:25,040 --> 01:01:27,660 That is an excellent point. 953 01:01:27,660 --> 01:01:37,580 Those of you who are very smart admins can go ahead, adapt your host to your shit ass IDS and make things align perfectly. 954 01:01:37,580 --> 01:01:39,280 Absolutely correct. 955 01:01:39,280 --> 01:01:41,060 Fantastic point. 956 01:01:41,060 --> 01:01:46,180 Are you advocating we break our host and match our IDS? 957 01:01:46,400 --> 01:01:51,500 Hey, I'm advocating we adapt our host to agree with our IDS's fucked up view of the universe. 958 01:01:51,500 --> 01:01:52,320 Thank you very much. 959 01:01:52,320 --> 01:01:53,140 Absolutely. 960 01:01:53,620 --> 01:01:54,780 What's up? 961 01:01:57,970 --> 01:02:02,270 And I think, unless there's any more questions, I think I am done here. 962 01:02:02,270 --> 01:02:04,090 You guys are fantastic! 963 01:02:04,330 --> 01:02:06,030 I love you guys! 964 01:02:11,130 --> 01:02:15,890 As a note, I talk at Black Hat as practice for you guys. 965 01:02:15,890 --> 01:02:17,470 You guys are awesome. 966 01:02:17,490 --> 01:02:20,810 I cannot even say thank you so much for all. 967 01:02:20,930 --> 01:02:25,050 Oh, there's one last thing that is really important that you all know. 968 01:02:25,090 --> 01:02:30,270 I have an insane network pipe and I'm taking proposals for how to use it. 969 01:02:30,270 --> 01:02:37,770 If you have an idea for what will help secure the internet, I will take the shit of spreading it everywhere. 970 01:02:38,490 --> 01:02:40,110 Talk to me! 971 01:02:40,730 --> 01:02:41,850 Don't do it yourself! 972 01:02:41,850 --> 01:02:43,510 No, not porn! 973 01:02:45,090 --> 01:02:46,990 You sick fuck! 974 01:02:46,990 --> 01:02:49,450 Especially for the kind of porn you want! 975 01:02:50,750 --> 01:02:54,710 Alright, I'm off to the drinking game where I will puke my guts out. 976 01:02:54,710 --> 01:02:55,470 Thank you.