So this was supposed to go on at 10, and I was totally supposed to get like another hour to sober up.
Dammit.
This is going to be a really interesting Black Ops. Not only is this the first Black Ops that I've done exploits,
this is the first Black Ops where I have been kind of sober.
Oh, no, no, no, there's lots of people here providing booze, let me tell you.
So, what are we here to do? We got an hour from now.
Who am I? You should know by now.
What are we here to do? So like last year, you know, I had like one topic, just DNS.
It was kind of fun and, you know, left the whole ADD thing alone.
Yeah, we're back to ADD. It's fun.
We're going to talk about a whole bunch of stuff. We're going to kick MD5.
We're going to play with some IP fragments. We are going to mess with intrusion protection systems,
which are being really, really abused.
We're going to do some DNS poisoning, which again is about the most black hat thing I've ever done.
And if that didn't help, we are going to send about 4 billion packets onto the Internet.
I have a new toy. It has 170 gigabits and permission to use it.
I've never actually cackled before. You know, giggled a little, laughed, but...
We're going to make some pretty pictures, because I like pretty pictures.
You know why I like pretty pictures? Because I can show them to non-geeks,
and they're like, holy crap, that is cool. I have no idea what it is, but it is cool.
Usually it's just I have no idea what it is. It just ends there.
And finally, you know, watch some TV.
Attacking MD5. Instead of going through all the background, here is the web page for Lockheed Martin.
Fun company. Some of you might have heard of it.
Here is the web page for Boeing. Another fun company. You might have heard of it.
Let's see what the hashes of these two pages...
Let's see what the hashes of those two pages happen to be.
C0F3AD. C0F3AD.
These two web pages have the exact same hash.
How could that have happened?
Oh, I know you like the hash.
I was wondering how you came up with that shit, man. Holy crap.
Okay, I have to actually turn off my email client this time.
I had people using their Blackberry on me the last time I did this talk.
That was really annoying.
So what is MD5 supposed to do?
MD5 is supposed to be basically a data fingerprint.
You know, you got some file, however big it happens to be.
The end result is supposed to come down to 128-bit signature.
The magic word is computationally infeasible to find two files with the same hash.
Now, we've known since about, what was it, 96, 97? Bullshit.
And, you know, about 2004, Zhang Yun Wang over in China said,
Hell yeah, that's bullshit. Here's two files with the same hash.
And you know what the response was from a lot of people?
Yeah, there you have two hashes.
But you could never use that for actual production data that had any kind of real-life meaning.
Absolutely not.
Okay, hype aside, I do actually try to have some technical data.
So here's what the story is.
MD5, it's pretty simple.
You start out with some initial state.
And they use magic numbers like pi and 6, 7, 8, 9, 1.
You know, numbers decreasing, whatever.
I'm too drunk to go 9, 8, 7, 6, 5, 4, 3, 2, 1.
I've got a problem.
More than that, I gotta drink.
Oh, the way this works at my talks, I like questions.
Ask a good one, and you get to drink.
And if I can't answer, I have to drink.
And, you know, if I'm not done drinking, well, that's the drinking game.
So, MD5 basically is really simple.
Start with some state.
You loop over all your data, 512 bits at a time.
And it shuffles that state.
And at the end, you end up with some value.
You mix in, like, the amount of data that you did, some metadata.
And you end up with what's called the MD5 hash.
Now, the idea is, anything's different in the input data.
A single bit should cause half the output bits in the hash to change.
Half. It's a big number.
What we have here is a visualization of the internals of MD5.
You know, we've got 64 sub-rounds and 3 rounds.
Half of those things are supposed to be flickering.
Now maybe you can't see the flicker.
You see those little dots?
There's supposed to be a hell of a lot more.
But, you know, we've got the Chinese girl, so, you know, guess what?
Almost none of them are different.
You know, first round, second round.
By the third round, nothing is different.
That's this big advance of this, you know, this new MD5 attack.
And what's interesting is, once you have two files with the same hash,
because it operates 512 bits at a time,
once you do end up at an alignment, you can add new stuff.
And it's not like you can go back in time, back to earlier in the file and say,
hey, wait, it was different earlier in the file.
Because you're never supposed to have a collision,
because that's what the whole point of a hash is.
So in mathematical terms, if MD5 of X equals MD5 of Y,
MD5 of X plus Q, that's going to equal MD5 of Y plus Q.
So that means if we have two files with the same hash,
we can append anything we want to it, including webpages.
Funny thing about web browsers, who here has written a crappy webpage?
Thank you!
All of you who haven't raised your hands are fucking liars.
Web browsers accept everything. That was one of the big advances.
You can put a turd in your fucking webpage that's going to render something.
And it turns out we can even put these two files that have the same hash.
But not only do they render anything,
oh, there's a programming environment, we got JavaScript.
Speaking of turds...
The browsers accept everything and they are programmable.
So this is what we're going to do.
By the way, GraphViz is the code to use all this. It's freaking cool.
So what we do is we take some file.
This is X, this is Y. These are our two files with the same hash.
We are going to prepend our file with one of these.
And we're going to put some extra crap on.
Remember, we can put anything on and it will have the same hash.
Where did my mouse go? Here we are.
Here's the first webpage, Lockheed Martin.
Here's the second page, Boeing. And now we have some JavaScript.
Now the idea is that MD5 is blind because all this crap is Q.
X, Y, all this crap is Q.
MD5 is blind but we can put a program in that isn't.
So the program goes back and goes,
Ah, fuck, I was put on X. Okay, Lockheed.
Hey, look, I was put on Y. Shows Boeing.
And that's your output.
And so that, in a nutshell, is how Lockheed Martin and Boeing can have the same MD5 hash.
That was a lot of stuff that had nothing to do with packets.
Okay, I better get back to this shit.
I need to have my little segue that's all smooth and elite and whatnot.
You know, we're talking about interpretation.
Speaking of other things that have to do with fucked up interpretation,
God damn, I really should not be doing this drunk.
You bastards, you moved my talk up.
Alright, yes, you put my talk at the same time it said in the schedule.
IP fragmentation, and I quote,
Fragmentation, an interesting early architectural error that shows how much experimentation was going on while IP was being designed.
Quote by Paul Vixie, someone who I truly expected to kick my ass when I first met him,
but it turns out he's about as fucked up as I am.
Sweet.
So, what is fragmentation all about?
Well, IP packets can be like 65 kilobytes long.
Okay, there is no physical network that can send a 65 kilobyte packet.
Well, okay, none that's actually used in common usage.
So, the idea behind IP fragmentation is we can take these ginormous packets and shrink them down into little chunks.
Fragments. It's fairly straightforward.
Why is this a problem?
The whole idea with IP is that it's supposed to be stateless.
You got a packet, you send it, you move the fuck on.
With fragments, hey, you know, you can send fragments and not have to worry about it,
but when you receive them, you have to store these things,
because you get one fragment and later on you might get another and another and maybe you will and maybe you won't,
but the point is you got to keep this stuff around in RAM.
That's annoying.
Not just as annoying, it's about 98.
Tim Newsham and Tom Pacek actually showed,
look, we can get around like every IDS out there by just doing strange games with our fragmentation.
We have overlapping fragments.
You know, this fragment says it has the same data as that one.
Which one is going to be, you know, what is the correct interpretation?
The RFCs are just like, fuck if I know.
And then FragRouter comes out and is just like, no, really, we can kick your ass.
Here, watch.
And so this is like 98, 99.
This is old shit, right?
Look, IP has been picked clean.
There's a reason I moved on to DNS.
Because, like, layer 3 and 4 are done.
So I thought.
In the crypto realm, you know, I did all this stuff with OpenSSH,
you know, we've been dealing with timing attacks lately.
All this crypto is all vulnerable to, like, how long things take.
And I'm thinking about this.
I'm going, I wonder if I can apply timing stuff to IP.
And it turns out, oh, yes.
It turns out there's an IP fragment reassembly timer.
It turns out that there's only a certain amount of time.
Are you pointing at me?
What are you pointing at me?
Oh, now you're the middle finger.
What is this shit?
Oh, I'll take this opportunity.
So speaking of pointing, there's all these shirts that have me pointing
that say scanran motherfucker.
And it's done by the TorCon sluts.
Hey, you've got a new title.
Would you rather be a goon?
Should have had a better t-shirt.
TorCon is absolutely rad.
I've loved that con for years.
And, you know, they have these shirts for me.
So speaking of good questions, good questions get a shirt.
And trashed off your ass.
What? I can't be the only one.
So, okay, look.
IP fragment reassembly timer.
Basically, these fragments come in.
And we can't reassemble the packet because we don't have all of them.
Eventually, the system gives up, right?
Well, how long is it going to wait before it gives up?
Well, it turns out we can fingerprint operating systems with that value.
You know, some things will wait 30 seconds.
Some things will wait two minutes.
You know, boom, OS fingerprint.
Ooh.
But that's easy.
That's cheap.
Let's go ahead and do some more hardcore stuff.
All right.
What if you have an IDS?
An IDS may very well have a different idea of how long a fragment can live
before it just gives up on trying to reassemble it.
In fact, this is actually true.
Linux and FreeBSD have a 30-second timer.
Snort's frag2 timer will wait 60 seconds.
Now, if the timer was less, if the IDS was going to keep fragments around for less time,
well, hell, you know, we just send fragments too slow for the IDS but fast enough for the host.
But what if it's the other way around?
What if the IDS, because it's all hardcore and, you know, it's going to keep things around for as long as it possibly can,
what if the IDS keeps fragments around longer?
Ooh.
We can do some stuff.
The problem is, it's keeping stuff around longer.
How are we supposed to make the host see one thing and the IDS see another?
Well, our problem is the IDS is keeping fragments around for too long.
Our solution?
Make the IDS drop our fragments.
Well, that sounds really easy.
How are we going to do that?
Well, there are two ways a fragment leaves the reassembly queue.
Either A, it times out, or B, it's reassembled against something.
Hmm.
I like that B.
I like the idea that it's just going to work, but not the way it plans to.
Watch this.
Here's what we're going to do, right?
Look.
Take our payload.
Up to 65 kilobytes.
We are going to split it into a whole bunch of fragments.
We're going to take the even-numbered fragments.
We're going to make a copy of them.
And we're going to fill those fragments' payload with noise.
Absolute crap.
And we're going to send this absolute crap.
And you know what we're going to do?
We're going to wait.
So we send the crap.
And the host has some crap.
And the IDS has some crap.
But you know what happens after 30 seconds?
The host drops the crap.
But the IDS, it likes the crap.
It keeps it around.
It thinks it might be useful.
Oh, and indeed, it is useful.
Because we go ahead and we send the odd-numbered fragments.
And the odd-numbered fragments go to the host, and the host has nothing.
So the host holds on to these odd-numbered fragments and says,
Well, you know, gotta wait for some stuff in the future.
IDS, no.
IDS has been holding on to some crap.
So the IDS has crappy even and good odd.
It reassembles.
It's like, what the hell is this?
And it drops it on the floor.
Ah, but now we send the legitimate even-numbered fragments.
And the IDS, well, it already dropped all that stuff from before on the floor,
so the IDS now has to keep it in its cache.
But the host?
Host has legitimate even.
Host has legitimate odd.
Host reassembles just fine.
And then you win.
And now my favorite line.
It gets worse.
Right now, we're giving the IDS crap.
Well, IDSs are meant to look for crap.
They might alarm.
They might be worried.
Is there a way we can, instead of giving it crap,
can we make the IDS see something completely different?
You know, like, the IDS sees a get slash,
and the host sees a SQL injection attack?
Ooh.
Here's what we're going to do.
Now, get slash has some headers,
and the SQL injection attack has some headers,
and it turns out a fair amount of these headers can be exactly the same.
So what we're going to do is we're going to split our stuff into three packets.
A common header, good stuff, and you're going to die.
And what we do is the first thing we send is, you're going to die.
No, no, excuse me. No, no.
That's later.
We're going to send the good stuff first.
Good stuff goes first.
You know why? Because I want the IDS to see some good stuff.
I want to give it some happy, nice feelings.
No problem. I would never attack you.
So here's what we're going to do.
So we send the good stuff, and we wait.
And we wait long enough so the host goes, fuck this good stuff.
It drops it.
But the IDS still has it around, and we send the shared common header,
and the IDS goes, I got the header, and it's nice,
and I got the good stuff, and it's nice.
So it assembles and says, hey, this guy just asked for a git slash.
He's cool.
But the host still has, at this point in time, where's the host at?
The stuff in its header.
Just the header packet, because it already dropped the good stuff.
But it has the header, and now we give it the evil packet.
And what happens when the header meets the evil packet?
Reassembles a SQL injection exploit.
You win.
What's up?
Quite a few.
So, what about checksums?
There's a problem.
Our hosts may actually go ahead and, you know,
SQL injections should not have the same checksum as git slash, right?
I mean, there's 65,000 possibilities.
Why would the things match up?
Well, it turns out, there's this great book.
It's called TCPIP Lean, by this guy, Jeremy Bentham.
It's hardcore.
I ain't saying it's hardcore.
Like, the guy debugs Ethernet with an oscilloscope.
That kind of hardcore.
So, look.
He's got this thing.
He's dealing with hardware that doesn't have enough RAM
to have an entire packet in RAM at the same time.
Holy crap!
So, he talks about how you do this stuff.
He says, well, you know, your checksum.
You don't want to have to go and go over all your data.
How do we go ahead and stream out a packet
and not have to worry about the checksums?
Well, the idea is you put in the wrong checksum.
But there's a funny thing about IP checksums.
They're crap.
They are.
They really suck.
They're just a one's compliment.
They're just like adding numbers, right?
So, there's a really funny thing you can do.
At the end of your payload,
you can be like, wow, I'm like 32,000 off
from what my checksum should be.
And so, you like, you know, add a little bit of a comment.
Fix by 32,000.
And it works.
So, you just do that,
and now you're going to have a constant checksum
for different payloads.
We can actually backport this attack
to all the original mechanisms
used by PatchEck and Nooshum and Song.
And it turns out what we can do,
and I haven't built this one yet
because I really fucked up my arm.
Be happy I'm here at all.
But it turns out you could actually send
a series of packets such that
on Linux, they assemble into a Linux exploit.
And on Windows, they assemble into a Windows exploit.
And all because there's a whole bunch of different ways
that IP stacks can reorganize data.
And you could actually, and I haven't built this yet,
and I'm fully honest,
you could actually create a sequence of packets
such that when they arrive on the host,
the particular host being used
will reassemble it into a way
that is relevant for that host.
And you don't even need to get any kind of feedback back.
It's kind of cool.
Now, hitting the brakes.
There's a couple IPS vendors out there
who are like, dude, you're full of crap.
Because our stuff is going to see you,
it's going to see these overlapping fragments,
we're going to deal with you,
and we're going to shut your session down.
Shut my session down, that's not nice.
And not only is it not nice,
there's not a lot of people
who are going to be able to do that.
That's really unique.
And...
Some jackasses, actually.
Complete and utter fucking jackasses.
Alright, no, I'm kidding.
Anyway.
Look, there's a funny little thing
that happens when you block a session.
You send a bit of information.
I blocked you, I stopped you,
I got in your way,
I'm telling you I'm here
and I'm getting in your way.
Yo, that's a fingerprint.
It turns out that anytime
an intrusion detection system
or a firewall gets in your way,
it has actually identified itself.
Because there's about a million different ways
that these things can go ahead.
Do they block invalid checksums?
Do they block invalid options?
Do they block invalid ICMP types?
How about HTTP?
How about SQL injection?
How about SQL injection of this type?
How about invalid DNS packets?
How about tipping point?
Oh, you sent a TCP fragment out of order.
We're going to drop you on the floor
because we don't like RFCs.
They're overrated.
Or checkpoint.
Oh, you're using DNSSEC.
That's never going to be feasible.
Point is, you can go ahead and identify
pretty much every firewall
and every intrusion protection system
based on whether, in a given session,
if you do something it doesn't like,
if it kills your session.
And it turns out you can find out the precise hop
that the IDS and IPS is at
by using Mike Schiffman's firewalk method.
Which is basically, you go ahead
and you send your nastiest off
one hop before the firewall
and then you send it one hop after.
If your session dies one hop after,
you know the hop where the firewall lives at.
Hi, how you doing?
Not that this is anything wildly new.
This is a slide from like 2003.
And it basically shows you
how you detect a PIX firewall.
And I'm not giving any details,
but if anyone ever tells you
it's ever impossible to remotely detect a firewall,
dude, I've been doing it for like two years.
So I can't say what that's in reference to,
but you can always detect
a firewall remotely.
There's just too many different variations
on how the protocol can be broken.
So...
IP shunning.
Turns out, a bunch of intrusion protection systems,
they are, they're acting all hardcore.
You mess with them a little too much,
they're going to block your IP entirely
because they're like,
well obviously your IP is evil.
And, you know, it's not like anyone
ever spoofs IP addresses.
Lies about who they are.
Oh, nobody ever does that.
Let me tell you why it's a really
bad idea to block traffic
that comes from random IP addresses
on the internet. Anyone ever type
dig? You know, that whole like
domain internet grouper DNS thing?
Here's a couple hosts, you might have heard
of them, they're called the root servers.
If you can't talk to them, you're fucked.
So like anyone who's running
these IPS's is like, hello
internet, here is my
firewall rule set, would you like
to submit new rules?
By any chance, would you
like to knock my stuff down?
We'll talk after.
It's like, seriously?
Now, you know, I'm showing this stuff
and yeah, you can knock out any of these networks by just
like, you know, hi, I'm 128
810 90.
I'm trying to slammer you.
But oh,
I can't stop here.
I can't stop here, because it is
too large scale, and more importantly,
I thought it was all cool, but it's
been whispered about for years.
And you know, I can't go ahead and take
full credit for something people have been
talking about, so let's do a little bit
more elegant attack.
Again, it gets worse.
I've been investigating DNS poisoning.
I've been investigating a lot.
Does anyone here know,
oh, hang on, we'll deal with that later.
But I've been investigating DNS poisoning quite a bit.
Four billion packets, quite a bit.
Is it possible, given these networks
that implement automatic network
shunning, to not just like, knock them
off the network, but to poison
their name servers, to go ahead and
redirect traffic from their network arbitrarily?
Oh, yeah.
Well,
there's a funny thing.
I showed you before, we will block you
from the name servers. And that's nice.
But let's do worse.
Let's block them from individual name
servers. Not the root, but
say, hey, large ISP,
see that big bank all your
customers go to? Yeah,
we don't want them to do that.
And how can you do that? Well,
block the communication between
the name server at the
ISP and the name server
at the bank. And there are
two sides you can do the blocking.
You can cause the
ISP...
God damn!
Humberdink,
I believe I am out.
Hey, I drank
everything that was there. I think you need
a drink.
So, there are, you can
block at the ISP side, you can block
at the bank side. Both ways.
Humberdink,
no.
So,
only if I really screw up.
In which case,
you are having a shot with me up here.
So,
general theme is to block communication between
any two name servers. You can block at either the server
or the client side.
All right, let's say you spoof
malicious traffic from the client network
to the server network. So, say, the big
bank no longer likes podunk
ISP. All right?
That means podunk ISP
sending out requests and
nothing's coming back.
All right? You know, let's think
about that for a second. We got about,
assuming a fixed port, we'll talk about
that in a second. We got about
65,000 possibilities for what the
transaction ID is going to be. The
transaction ID, of course, controls whether
or not when I spoof a packet,
it actually is going to get blindly
accepted. Well, kind of
funny, is usually it's called a
race condition. I would have to
get my fake
reply back before the real reply
comes back. But you know what happens
when the intrusion protection systems are in place?
Well, it's a race, but I
took a bat and knocked
out the other guy's kneecap, so he's
not running anymore.
So, I got about an average
of 32,000 packets to do
and instead of about 100 milliseconds,
I can do it, like, about
as long as I freaking want.
Moral of the story,
do not automatically
shun IPs.
But, you know, I can do the other side.
I can also spoof malicious traffic
from the server network to the client network.
So, you know, use some podunk ISP and it's like,
holy crap, the bank is trying to
kill me!
I paid my loan, man!
Well, so, there's a
little difference here, because you'd think
if the ISP is no longer talking to
the bank, well, you know, the ISP sends out
the request and the reply comes back and the reply
is blocked. But,
if the reply, you know, you think, well,
when I spoof stuff,
it also has to be blocked, right?
Funny thing about
IP, there's no affinity.
And by that I mean,
IP addresses, you know, you can actually
return a DNS, when you send out a
DNS request, about 15%
of the time some other guy replies.
And it works.
So that means, the legitimate
host can't send you back replies, but
the entire internet can be spoofing
replies back.
And they'll all work if their transaction
ID is correct.
Oops. Again,
do not implement automated network
shunning.
But there are people who like it, and I'll go
ahead and I'll say, okay, make sure
you can talk to name servers,
see if you can make it so your outbound
communications override any automatic
shunning. And, you know, again,
do not touch name servers.
But seriously,
don't do this stuff. There's just 80
million ways that automatic shunning,
you're giving,
they're giving you guys access to their firewall
table. What is wrong with these people?
So don't do that.
Go to the next slide.
But what about complaint
emails? You know,
funny thing, you know, often they get assigned complaint emails
and they negotiate and find out this stuff's going on.
Well, funny thing happens when you block someone's
name server. You can't send mail
to that domain anymore.
Oops.
Now, what would I know about complaints?
Well, when you send
4 billion IP packets,
people can tend to notice.
I've been
working with these guys called Prolexic.
And...
God damn it.
All right, look.
So, basically,
you know how you have these
third-party spam filters?
They get your mail and
they send you the good stuff?
These guys do that for IP.
They announce your route and
they take all the crap that you guys send
and be like, that's a very nice
10 gig UDP flood. I'm going to
filter that. These guys have just
ridiculous amounts of extra bandwidth
and they gave it to me.
I've never
actually been able to, like,
I can't send packets faster
than this network can route them.
I feel like less of a man.
I've been
working with all sorts of cool people
and, you know, I've been doing
all sorts of stuff to be all legitimate.
You know, don't do this
at home. Your colo will die.
I tried.
It was out in an hour.
You will get complaints
and very scary people
will be calling you personally and be like, what the
hell are you doing?
So seriously, I can't emphasize
this enough. I'm doing this because
there's a little problem with, you know,
large scale network attackers having better
intelligence on the network than I do.
That's not cool.
But yeah, don't do this at home.
I've set up, you know, reverse
lookups. I'm in Aaron.
There's Dan Kaminski
security research. How rad is that?
Like
abuse mails. Someone has hacked
in your box. Dude, that's
me.
So yeah,
you know, oh, best email is like, you know,
thank you for your information.
We will see you in Vegas.
Like, oh, crap. Handcuffs.
So,
what do I
want to do? I wanted to go ahead and find, you know,
Google's taken out by some DNS poisoning attack.
You know, who is actually hit by this
thing? So, you know, we scan the world,
the entire world, and we find
somewhere between, we find actually
9 million name servers,
but after the scan, only about 2.5
million of them would actually talk to me.
Shit.
Um,
I needed
to find, because it turns out you had
to have a Microsoft server talking to
a Windows server.
No, excuse me, Microsoft server talking
God damn it.
Okay, the problem
with this plan is, like, the more I drink,
the more mistakes I'll make.
Okay, so,
I'm totally getting that ever clear.
So, look,
you have to have Windows servers who are linking
to bind date servers.
Fairly obscure situation, right?
Um, okay.
Well, how do we find that one server is
linking to another? By linking, I mean, instead
of going out and resolving it itself,
it asks its buddy.
How do we find these links?
And, um,
the way that I ended up using is basically
to just ask
everyone, hey, you know,
hey you, go ahead, you know, what's your name?
Your name's Bob? Go ahead and look up
bob.madness.net
and madness is a domain I own.
If some guy named Charlie walks up to me,
okay, I know Bob
asked Charlie to look something up.
So I know there's a link between those two domains
and those name servers. That's how I did it.
What were the end results?
Um, well, we got about
two and a half million verified name servers,
meaning, um, they would still talk to
me. And, uh, of
those two and a half million, we
used a tool called
fpDNS, fingerprint DNS,
and we fingerprinted every single
one of them.
Ooh, I got some emails out of that one.
Ooh, crap.
There are a lot of IDSs that are like,
you tried to check version.
How could you possibly do that?
You know,
your attack is detected by
100%.
You know it
without fail.
Like, seriously, people did not
like it. But you know what? We're dealing with
security and, um, you know, we found about
230,000 hosts that are
possibly broken,
13,000 that are definitely broken,
and you know what? I'm going to be sending
some emails. And we're going to get
this problem dealt with.
And incidentally, uh,
scan was done in under a day.
It's good to be the author of
scanrand. I send packets fast.
Fuck yeah. Oh, oh,
who said that?
Who said that? Oh.
Hell yeah. Well, maybe
not. Hey, someone get him
that shirt.
Um,
I'm not replying.
So look,
kind of, uh, reversing the thing.
Normally with an exploit, you're like,
I've got this box. I wonder what it's
vulnerable to. Reverse.
Um, I wonder if someone
fucked this up. Let's ask everyone.
So I'm like,
you know, I wonder,
you know, there's these transaction IDs
and if there's a known transaction ID,
you can DNS spoof on demand.
I wonder, is anyone
using the same transaction ID
when I make a request,
when they go out to the outside world,
does anyone use the same thing?
Because that'd be really insecure. That'd be dumb.
You'd have to be like, you know,
one in a hundred thousand to be this
dumb. But there's a funny thing
that happens when you ask two and a half million
people a question. You find
the dumb ones.
So there's like, uh, so we asked
everyone with a fixed, you know, transaction ID.
I had the data anyway.
And we found about
110 hosts that are
dumb. And of these 110
hosts, it's
major vendors
ADSL modem, so
wow, look at all these networks I can completely own
on demand.
And the name server
that I was using to host
my own data.
God dammit.
In my defense, it was an old
version, but oh yeah.
So...
Oh, fuck that.
God dammit.
Speaking of...
You fucking
assholes, I need to do the
drinking game.
Alright. I'm liking this.
I may do all my talks smashed.
Hello, sir.
I'm drunk.
I don't know
how we never noticed this before.
You know
on TCP you can scan for servers?
Well, UDP is a little
different. There really is no difference between
a client and a server.
How did we not realize until 2005
that you can scan for client
ports as well?
Name servers very often have
fixed ports that they send all their requests
from. They use a single socket.
And it turns out, you can
scan for this client socket.
You can find out who they're sending requests
out to. And I'm like, well, what
are these ports? I bet there's lots of servers
that send out questions from a
source port of 53.
But you see, that's, I think, the nice
thing about having ASLO to data
is you can know.
Let's look at the data.
Oh, look at that.
823,000 times
the source port was 32,768
on an outgoing request.
And 195,000
times it was 32,769.
And 54,000
times, oh, you're telling me
on a large portion of the internet infrastructure
I can monitor load levels
on remote name servers?
Sweet.
So, um,
yeah, you should be running
a name server that actually buries its
local port.
Other stuff, there's like a 15 minute chunk
of DNS poisoning things I can't tell you about.
But holy crap, someone's up
to some nasty shit.
Wow.
And I wasn't even looking for it.
It just accidentally came back.
Hey, by the way, we're spoofing these guys.
You're what?
And it turns out
there's all these systems that automatically
investigate what the hell you're doing
when you are sending 4 billion
packets, but when they investigate
they have no idea that the investigation
comes back to you.
So I've got traffic from really, really
dark networks where it's just like,
hi, there's no one within
the rest of my class A,
but who are you?
No, no, no, no, no.
Who are you?
So, um,
as long as we're sending
assloads of traffic,
can we make some pretty pictures?
Because, you know, people like that.
And so I've actually generated
a methodology that goes ahead
and create maps
all internet routes in about
a couple hours.
It's really, really fast.
And, um, you know, rather than
just like hype, I'll show you
the raw data as it's collected.
And before anyone from
DEF CON has a heart attack, this scan is happening
from the 170 gigabit pipe.
So we go ahead,
we go into it.
Boom!
Hi, internet, how are you doing?
We're sending out about 20,000
packets a second right now.
And, um, we're tracerouting in this
massive, uncontrolled manner.
And lots and lots and lots and lots
and lots of hosts are talking to us.
That's a mess, right?
How are we going to filter it?
Well, welcome to SQL.
Fun little language, lets us organize
things. Once we run this stupid
little query, you know,
show me what, you know, reorder this until it makes sense.
Oh, look!
On the way to 12.10.41.178,
here's all of our
hops. And here's hop
one, hop two, hop three, hop four.
What you were seeing before was wildly
disordered, and now we have it in
order. And how do we define
that two things are linked? Well, if
that number's three and that number's
four, then 67,
you know, this host is probably
connected to this host. Mind you,
we're scanning the internet over a range of like
two hours, so this is actually kind of
cool to see it in some degree of order.
And, um, what does
this crap look, well, hang on, what does this look
like when we actually get
it said and done?
Finally, I get to show some pretty pictures.
I know.
I'm well
aware.
So this data's been around for a while,
but, uh, being able to zoom
in on it is kind of new.
And, uh,
being able to, like, tilt it down
and, you know, raise
it up and, like, fly around.
Everyone, you know, Hollywood really
wants someone to do this, so fine,
here, I'm flying around the internet, ain't that
rad?
Now the eventual goal,
and this will happen sometime in the next
couple of months, yeah, I really
broke my arm, um,
but the goal is that we can go ahead and we can take live
data and we can go ahead and plot
it so this is all black and white and as
you actually use the net, it goes, you're going over
this path, you're going over this path, here's all
the constraints and all that kind of stuff.
And that's the kind of data I want to be able
to, you know, collect. It turns
out when you do this kind of large mapping,
there's a couple things you can do extra,
um, whenever, you know,
we have to scan up to a certain range, if we
actually find someone, you know, at the,
you know, the farthest away possible,
we can go back, fill in the gaps,
um, we can actually go ahead and,
you know, put out senders all over the
internet and have all the reception
happen at the same point,
so we can say, here's how the net looks from China,
here's how the net looks from Japan, here's how the net
looks from Abu Dhabi, and
all of it will come back to the same collector,
and we can go ahead and we can integrate the data.
Um, and
the results look pretty cool, but
there is, there is a weakness.
Yeah, how are we going to make this
useful? And beyond that,
I don't want to have to do this big preprocessing
phase, I would like to graph live
data. How could I do that?
Well, there's these
guys, they wrote some
code in C++, it makes
my nose bleed, but it's
really, really cool. It's really, really
cool to the level of, like, it will
handle, like, 2 million node networks
and be like, huh, sweet, got more?
It's really cool.
It's called the Boost Graph Library.
It's rad. And not only is it rad,
but their developers are like, okay,
we're going to support Dan.
Like, sweet.
They're getting, like, updates, like, here is
your code, here are the answers to the
test. Like, struggle with this stuff
for, like, four days, send them a mail, here you go.
Rad.
So,
what kind of stuff can we do now that
we have, like, you know, real graph
logical stuff?
Let's see here.
This is
a router trace on a small
network.
That's a little
dark, isn't it?
We'll set the next one to be a little lighter.
This is a fairly large-scale network.
And, actually, this is a router
trace. We're watching traffic.
And it's actually
animating out in front of us in real time.
And we're watching, basically,
nodes that aren't talking to anyone else.
Here's a cluster right here that's just one server
talking to lots of hosts.
Here are servers that have a multi-tier relationship.
This is all very early code
written in the last week or two.
But, ooh, it's pretty.
And, um,
the idea is you can actually, like, stream
random data in. If I had any faith
in the networks of these things, I could actually
do live TCP dump with all
interrelationships shown
on that kind of map.
And is this useful? Well, I haven't made a discovery
on it. I took all my DNS
interrelationship data and put it into
that graph. And what did we find?
Interestingly enough,
oh, crap, there's a whole bunch of hosts
that are all coming back to one
that I expected.
What I did not expect, and it'll take, actually,
a few seconds for it to show up on this,
but you'll just have to believe me.
My expectation was that you would
have, you know, lots and lots of hosts
that actually went to one backend that talked
to me. What you actually see is a
pretty complex multi-tier relationship.
One name server will talk to another name server,
will talk to another name server, and will talk to another name server.
This was something that I
would not have expected.
I actually don't know the layouts that create
this, but
having seen the
data, having seen it visually, I could
now build my systems
around that assumption.
The goal of all of this
is that when I do
mass internet scale scans,
every time I send a packet,
I can know the route that packet
is going to probably take.
I can know the routers it's probably going to go over.
I can know what the bandwidth implications are.
I can look at my pipe
as a water hose.
Not a hose, as a pipe
of just high pressure water.
And I can go ahead and build taps on that
based on what the implications are
on the underlying network.
So I can say, here's a T1.
Packets through there can only go at this rate.
Here's an OC48. Packets on here can only go
on this rate. And most interestingly,
I can put monitors on
every single router that I'm sending
traffic through. And the moment
those monitors, I call it canaries,
you send five or ten packets a second
to each router you expect to go through,
as soon as these canaries stop responding,
you know you killed them.
So...
I'm going to start killing canaries. Ain't that fun?
And now the last thing. I have no idea
if I've gone over, but I hope you guys have had fun.
Who here was at my ATalk here last year?
Hey,
I haven't screwed up yet.
So...
You're wearing a power glove!
How can I resist?
Anyone got shot glasses?
Can I get some shot glasses up here?
What's your name? Patrick!
Patrick, this is why I
fucking come to DEF CON.
Because people will get me really fucked up.
Mind you, I've never had Everclear
before.
Hey, am I
shying away from this? No, because I'm
trashed.
I am so fucked.
Hey, I am drinking.
Alright, we're here. You know what we're drinking
to? We're drinking to TourCon.
Probably my favorite small con
in the world. It is just the shit.
DEF CON is rad.
TourCon is just...
Hikari is awesome. Is Hikari
even here? Dude!
Fucking
Hikari. Dude!
Hey, wait, wait, wait. Do we have a
third shot glass by any chance?
Hikari, get the fuck
up here.
Here, you're drinking this shit.
I'm drinking Everclear. You can
drink the fucking Morgans.
Just drink.
Alright. To a
great fucking con. You guys all rule.
Thank you so much for coming here.
It's actually
working. Holy hell, I didn't
think it would actually work.
Alright, I'm putting audio out through
the PC interface. This better work, guys.
I'm warning you.
Audio's coming any minute now. Oh,
so I had to put on a huge cache on this
thing because the Black Hat network was
broken beyond all description.
It was like wireless
from like 20 feet away.
Michael
Flackley is
the Lord of the Dance.
Darth
Vader is the Lord
of the Sith.
Okay,
Robot Chicken is the best fucking
show in the world.
Robot Chicken rocks. And that's all
about all I have for you
fucking guys.
Wow.
So,
just fucking come up here.
I want people to hear your shit.
Seriously, I really want people to come up
and ask questions. Can I fucking
have your babies?
Dude, you're
a guy.
Seriously,
someone came up with some auto-shunning question?
Come on, come here. Alright, what
you got, man?
Do the IPSs that you're aware
of, will they auto-shun their loopback
interface?
I had totally not
thought of that.
That would...
I seem to have nothing
to drink. You guys are
falling down on the
job. I bring you here for...
What, you want me to drink? Okay.
That's a
really interesting question.
Okay, so here's
the idea, and this is fucked.
This is really, really impressively
fucked up. The idea is
that you spoof a whole bunch of traffic to some
network from the address 127.0.0.1,
which is, of course,
the loopback address on a host.
Will the IPS actually
block local host? Because if
it does, all sorts of shit's
going down.
IPS vendors in
this room, test.
Like, now. Because there's, like, a thousand
people who have the idea of testing it.
Hey, you have your hand up.
Get the fuck up here.
No, no, come up.
Come up.
Seriously, come on up. There's, like,
booze and books and, like, good shit and, like...
God damn it.
No, it's just a rebuttal to the earlier question
is if you've got your router set up right, your
edge router 127 shouldn't get in?
If your edge router's
automatic, already blocking
127.0.0.1, then, uh,
of course, yeah, you're not going to go ahead and get nasty
traffic. But, um,
a lot of people have the attitude, well, I got an IPS.
What do I need to put custom firewalls
rules in for? The internet
will be giving me firewall
rules!
Actually, honestly, probably
a lot of IPSs already have
blocks against 127 and
have blocks against RFC 1918
space, but I'm sure
there's one that doesn't because there's
some really crappy IPSs
out there.
What's up? Hang on, hang on, hang on.
You're trying to kick my ass, and so, of course,
I have to give you the mic.
What happens to overlapping segments, Dan?
What do you mean, what happens to overlapping
segments? What happens to
the segments, uh, the timeout values
if the segments are overlapping, Dan?
Ah, yes, yes, yes, that's one of the things I pointed
out. There are some very good...
Okay. There are
some relatively good IPSs
because they're all shit, but there are some relatively
good IPSs that will notice
hey, look, this...
They basically will go ahead and have
their timing value for how long the fragment
can live, but fragments
have a particular IP
ID associated with them, and there
will be a separate timer, a much
longer timer that notes, hey,
I may have flushed this from my queue,
but
this is a fragment on a
session from an old...
This is an old... This is a fragment
that could be applied to an old session.
In other words, someone could be trying to mess with
me. Hmm. Why would I try
to be messing with anyone? Yeah, I guess they can
bust me. Um, those...
Those IPSs
are really easy to fingerprint,
and there is a problem in this industry.
There are vulnerabilities in security
code itself. I don't
want to share that. I just want you to take a drink.
Get ready
to drink.
Really, I am so screwed in
TC Baby Drinking Game. Hey,
come up here.
Can I have your baby?
Well, you definitely are a girl.
New comment.
Later.
Come here.
All the fragmenting
stuff, does that work if they're filtering
fragmented packets?
No, it doesn't. But that's
a problem because fragments are a legitimate
part of the IP
spec. They're actually...
No, there's quite a few networks that are
tunneled inside of tunnels, and
they end up with much smaller...
You know, in the multi-tunneling,
end up with packets larger than the MTU
because there's a lot of packets that will be
sent with an MTU of 1500.
So, fragmentation happens.
It's supposed to be limited by
TCP's MSS value,
but sometimes it really does happen,
and it does happen entirely legitimately.
Now, small fragments, and this is
very obscure, but small fragments at the
beginning of a packet should not happen.
And those things are legitimately dropped,
and that's good.
Go ahead. Because I've seen
networks that do that. They filter out the fragmented
packets. What are they missing out on?
Is there anything interesting about them?
Well, there's an interesting thing. A lot of
people say, hey, I can drop 1% of
traffic. No problem. It's just, you know, 1%.
But you get, you know, this 1%,
and this 1%, and this 1%,
and suddenly, the internet doesn't work
very well anymore. And that happens.
And that's ultimately, you know,
we have this thing called, like, congestion
collapse, when there are too much,
there's too much traffic that doesn't back off.
There's another kind of collapse. It's firewall
collapse, when there's too many overlapping
rules from people who think, well, our one
little variation on the IP spec is
okay, and, you know, we're just going to do it,
and, you know, who cares if we drop 1% of traffic,
and then the internet no longer works.
And, tipping
point, I'm talking to you.
I can't
remember what the denial of service attack is.
It's either New Dawn or Teardrop,
where it's based on fragmented
TCP packets. How would that work
against an IPS?
The fragmented
packet, I dream about Ping
of Death, maybe, where you have a packet
that reassembles
larger than the maximum IP size?
Where the
TCP packet reassembles
and it's broken, and it causes
various problems.
At this point, you know, it's really
sad. It's 2005,
right? When the hell did Teardrop
come out? Wasn't it, like, 97 or 98?
Okay, so
very well-known vendor,
Netscreen, actually goes ahead
and has, like, on their thing,
we blocked this many Teardrop
attacks. Dude, it's
the 21st century. We
aren't worried about that shit anymore.
It doesn't work, even if
it's unblocked. We're not running
Windows 95.
So, I don't know. I mean,
Teardrop, I mean, it's a great brand.
Oh, incidentally, you guys know
how names are done in the virus industry?
It's like, you know, they're all, like,
named by the guys who find them.
So, just like, you know, we're gonna call this attack
Teardrop. We're gonna call this attack
CodeRed, because, you know, hey, you know,
they didn't, like, put a big brand copyright
on it when they attacked our network,
so we're gonna name it whatever gets us
the most attention possible.
And that's why they all have sexy names.
Of course, there was a real problem
when one of them named their thing
Doxpar,
because I do Doxpar
research, and
Doxpar caused me all sorts
of problems, especially when the variant
happened, Doxpar.A.
You
bastards.
All right, other questions?
What, hey, uh-oh.
What do you think of the recent
ICMP-based attacks?
There's so
much overh... So, it's really
funny. Yes, you
can kill ICMP sessions if you
can figure out the four tuple of
source IP, desk IP, source port,
you totally can.
But I went on Deja News, and
I found a post from 1993
calling this shit old.
Dear God.
No, I mean,
okay, the actual attacks
are real, but old.
To his credit, he's right, they still
work, and they shouldn't.
His stuff about slow... There's this guy,
he has this stuff about slowing down networks.
Why am I drinking? I was right.
Okay, his stuff...
Fuck.
Funny guy. He should
test his shit.
He has this whole thing, well, I can slow down
communication of BGP sessions.
I can reduce a session down
to one packet sent per round
trip time. So,
BGP sessions, I don't know if you guys know,
they're about three kilobytes a second.
Three kilobytes a second, okay.
So, you reduce a session down to
one packet per round trip
time on a session that has somewhere
between one millisecond and a tenth
of a millisecond latency.
Oh, no! I can
only send a thousand to
ten thousand packets a second
on my three kilobyte
a second link.
No!
It's ridiculous.
Any other questions? Seriously,
you don't even have to come up if I can somehow
hear you.
Says
the guy from Prolexic.
That took some balls. Here, have a book.
Prolexic's been rad, by the
way. I mean, seriously. They've been
giving me shit tons of bandwidth and taking
calls from DoD. Rad.
Oh, shit, it's George.
It's ScanRan
motherfucker George.
I hate you.
So, I'm going
to the T2 con out in Finland.
Who here is from Europe?
Dude,
Euro guys, I'm coming out to you guys
mostly. That's the plan.
So, T2,
I didn't intend to give them props, because
TorCon is the shit, but
yeah, T2 should be good.
What?
I didn't screw up! You drink!
Hey, someone get these fuckers
drinks. They need to be drunk so they'll
shut up.
I'm not drinking.
No, stop.
All right, do we have anything else?
Because I should probably give this shit up to Hacker Jeopardy.
OK, go ahead. You have a good question?
No dude, hang on. I want this guy to ask a question.
You said that one of your attacks
is based on a difference between IDS timing
and host timing. Well, in Linux
and FreeBSD, isn't it possible, even
in extreme situations, just to rebuild the stack
so if you know your vendor in advance just to match
Man gets a book. Man gets both books. That is an excellent point. Those of you who are
very smart admins can go ahead, adapt your host to your shit ass IDS and make things
align perfectly. Absolutely correct. Fantastic point. Are you advocating we break our host
and match our IDS? Hey, I'm advocating we adapt our host to agree with our IDS's fucked
up view of the universe. Thank you very much. Absolutely. What's up? And I think, unless
there's any more questions, I think I am done here. You guys are fantastic! I love you guys!
As a note, I talk at Black Hat as practice for you guys. You guys are awesome. I cannot
even say thank you so much for all. Oh, there's one last thing that is really important that
you all know. I have an insane network pipe and I'm taking proposals for how to use it.
If you have an idea for what will help secure the internet, I will take the shit of spreading
it everywhere. Talk to me! Don't do it yourself! No, not porn! You sick fuck! Especially for
the kind of porn you want! Alright, I'm off to the drinking game where I will puke my
guts out. Thank you.