start	end	text
10770	18250	So this was supposed to go on at 10, and I was totally supposed to get like another hour to sober up.
19810	20870	Dammit.
22430	29390	This is going to be a really interesting Black Ops. Not only is this the first Black Ops that I've done exploits,
29390	33670	this is the first Black Ops where I have been kind of sober.
36670	41070	Oh, no, no, no, there's lots of people here providing booze, let me tell you.
41790	45410	So, what are we here to do? We got an hour from now.
46330	49130	Who am I? You should know by now.
50470	55970	What are we here to do? So like last year, you know, I had like one topic, just DNS.
56030	59890	It was kind of fun and, you know, left the whole ADD thing alone.
60470	63110	Yeah, we're back to ADD. It's fun.
63110	66170	We're going to talk about a whole bunch of stuff. We're going to kick MD5.
66170	71590	We're going to play with some IP fragments. We are going to mess with intrusion protection systems,
71590	74490	which are being really, really abused.
75050	80590	We're going to do some DNS poisoning, which again is about the most black hat thing I've ever done.
81290	86690	And if that didn't help, we are going to send about 4 billion packets onto the Internet.
86750	92930	I have a new toy. It has 170 gigabits and permission to use it.
93450	98130	I've never actually cackled before. You know, giggled a little, laughed, but...
101270	104270	We're going to make some pretty pictures, because I like pretty pictures.
104270	107410	You know why I like pretty pictures? Because I can show them to non-geeks,
107410	111410	and they're like, holy crap, that is cool. I have no idea what it is, but it is cool.
111910	115990	Usually it's just I have no idea what it is. It just ends there.
116730	118730	And finally, you know, watch some TV.
120770	127950	Attacking MD5. Instead of going through all the background, here is the web page for Lockheed Martin.
128210	130550	Fun company. Some of you might have heard of it.
130670	135790	Here is the web page for Boeing. Another fun company. You might have heard of it.
135810	139170	Let's see what the hashes of these two pages...
145680	149200	Let's see what the hashes of those two pages happen to be.
151380	154600	C0F3AD. C0F3AD.
154960	159140	These two web pages have the exact same hash.
159520	161680	How could that have happened?
162700	166560	Oh, I know you like the hash.
170800	175060	I was wondering how you came up with that shit, man. Holy crap.
175060	179560	Okay, I have to actually turn off my email client this time.
179680	183920	I had people using their Blackberry on me the last time I did this talk.
184500	186320	That was really annoying.
187360	189280	So what is MD5 supposed to do?
189340	191980	MD5 is supposed to be basically a data fingerprint.
192020	195220	You know, you got some file, however big it happens to be.
195220	198640	The end result is supposed to come down to 128-bit signature.
198640	206780	The magic word is computationally infeasible to find two files with the same hash.
206800	212320	Now, we've known since about, what was it, 96, 97? Bullshit.
213380	218960	And, you know, about 2004, Zhang Yun Wang over in China said,
218960	222580	Hell yeah, that's bullshit. Here's two files with the same hash.
222580	225240	And you know what the response was from a lot of people?
225240	227780	Yeah, there you have two hashes.
227780	234180	But you could never use that for actual production data that had any kind of real-life meaning.
234400	236400	Absolutely not.
238340	242260	Okay, hype aside, I do actually try to have some technical data.
242260	244160	So here's what the story is.
244500	246300	MD5, it's pretty simple.
246640	248480	You start out with some initial state.
248480	252720	And they use magic numbers like pi and 6, 7, 8, 9, 1.
252720	254740	You know, numbers decreasing, whatever.
255020	259380	I'm too drunk to go 9, 8, 7, 6, 5, 4, 3, 2, 1.
259380	260880	I've got a problem.
261440	264820	More than that, I gotta drink.
271260	275820	Oh, the way this works at my talks, I like questions.
275840	278580	Ask a good one, and you get to drink.
278700	281300	And if I can't answer, I have to drink.
281300	285860	And, you know, if I'm not done drinking, well, that's the drinking game.
286820	289240	So, MD5 basically is really simple.
289240	290440	Start with some state.
290700	293500	You loop over all your data, 512 bits at a time.
293500	295040	And it shuffles that state.
295140	297240	And at the end, you end up with some value.
297240	300460	You mix in, like, the amount of data that you did, some metadata.
300460	303400	And you end up with what's called the MD5 hash.
303400	307500	Now, the idea is, anything's different in the input data.
307500	312740	A single bit should cause half the output bits in the hash to change.
313160	314900	Half. It's a big number.
315800	319800	What we have here is a visualization of the internals of MD5.
319800	323180	You know, we've got 64 sub-rounds and 3 rounds.
324060	326340	Half of those things are supposed to be flickering.
326340	328060	Now maybe you can't see the flicker.
328560	330360	You see those little dots?
330360	332460	There's supposed to be a hell of a lot more.
332780	336500	But, you know, we've got the Chinese girl, so, you know, guess what?
336500	338320	Almost none of them are different.
338320	340760	You know, first round, second round.
340760	343200	By the third round, nothing is different.
343200	347080	That's this big advance of this, you know, this new MD5 attack.
347280	352680	And what's interesting is, once you have two files with the same hash,
353040	356440	because it operates 512 bits at a time,
356440	360780	once you do end up at an alignment, you can add new stuff.
360780	363960	And it's not like you can go back in time, back to earlier in the file and say,
363960	366700	hey, wait, it was different earlier in the file.
366700	368800	Because you're never supposed to have a collision,
368800	371540	because that's what the whole point of a hash is.
371540	375440	So in mathematical terms, if MD5 of X equals MD5 of Y,
375440	379580	MD5 of X plus Q, that's going to equal MD5 of Y plus Q.
379600	382080	So that means if we have two files with the same hash,
382080	386200	we can append anything we want to it, including webpages.
386420	390140	Funny thing about web browsers, who here has written a crappy webpage?
391800	393100	Thank you!
393100	396580	All of you who haven't raised your hands are fucking liars.
397960	402520	Web browsers accept everything. That was one of the big advances.
402520	406980	You can put a turd in your fucking webpage that's going to render something.
407300	411680	And it turns out we can even put these two files that have the same hash.
411680	414260	But not only do they render anything,
414260	417980	oh, there's a programming environment, we got JavaScript.
418040	419860	Speaking of turds...
422260	425820	The browsers accept everything and they are programmable.
425820	427300	So this is what we're going to do.
427860	431060	By the way, GraphViz is the code to use all this. It's freaking cool.
431380	433800	So what we do is we take some file.
434440	437640	This is X, this is Y. These are our two files with the same hash.
437640	441120	We are going to prepend our file with one of these.
441200	443220	And we're going to put some extra crap on.
443220	445920	Remember, we can put anything on and it will have the same hash.
445920	449980	Where did my mouse go? Here we are.
449980	452480	Here's the first webpage, Lockheed Martin.
452480	456580	Here's the second page, Boeing. And now we have some JavaScript.
456840	462160	Now the idea is that MD5 is blind because all this crap is Q.
462160	464380	X, Y, all this crap is Q.
465260	469100	MD5 is blind but we can put a program in that isn't.
469340	471400	So the program goes back and goes,
471400	474040	Ah, fuck, I was put on X. Okay, Lockheed.
474040	477220	Hey, look, I was put on Y. Shows Boeing.
477380	478640	And that's your output.
479000	485920	And so that, in a nutshell, is how Lockheed Martin and Boeing can have the same MD5 hash.
492090	495850	That was a lot of stuff that had nothing to do with packets.
496070	498450	Okay, I better get back to this shit.
500450	504670	I need to have my little segue that's all smooth and elite and whatnot.
504670	507570	You know, we're talking about interpretation.
507590	510890	Speaking of other things that have to do with fucked up interpretation,
510890	513390	God damn, I really should not be doing this drunk.
514810	517550	You bastards, you moved my talk up.
518030	522170	Alright, yes, you put my talk at the same time it said in the schedule.
524490	526250	IP fragmentation, and I quote,
526250	533530	Fragmentation, an interesting early architectural error that shows how much experimentation was going on while IP was being designed.
533530	537910	Quote by Paul Vixie, someone who I truly expected to kick my ass when I first met him,
537910	540650	but it turns out he's about as fucked up as I am.
540650	541510	Sweet.
542510	544830	So, what is fragmentation all about?
544830	548950	Well, IP packets can be like 65 kilobytes long.
549330	553150	Okay, there is no physical network that can send a 65 kilobyte packet.
553150	556010	Well, okay, none that's actually used in common usage.
556010	563130	So, the idea behind IP fragmentation is we can take these ginormous packets and shrink them down into little chunks.
563210	565250	Fragments. It's fairly straightforward.
565670	566890	Why is this a problem?
567270	569890	The whole idea with IP is that it's supposed to be stateless.
569890	572010	You got a packet, you send it, you move the fuck on.
572550	576850	With fragments, hey, you know, you can send fragments and not have to worry about it,
576850	579830	but when you receive them, you have to store these things,
579830	584990	because you get one fragment and later on you might get another and another and maybe you will and maybe you won't,
584990	587910	but the point is you got to keep this stuff around in RAM.
587990	589150	That's annoying.
589730	592770	Not just as annoying, it's about 98.
592770	595110	Tim Newsham and Tom Pacek actually showed,
595510	601450	look, we can get around like every IDS out there by just doing strange games with our fragmentation.
601450	603110	We have overlapping fragments.
603110	605510	You know, this fragment says it has the same data as that one.
605510	608630	Which one is going to be, you know, what is the correct interpretation?
608630	610930	The RFCs are just like, fuck if I know.
610930	615250	And then FragRouter comes out and is just like, no, really, we can kick your ass.
615250	616090	Here, watch.
616990	619290	And so this is like 98, 99.
619290	621090	This is old shit, right?
621590	623830	Look, IP has been picked clean.
623830	625770	There's a reason I moved on to DNS.
625770	628410	Because, like, layer 3 and 4 are done.
629850	630970	So I thought.
632490	635410	In the crypto realm, you know, I did all this stuff with OpenSSH,
635410	637450	you know, we've been dealing with timing attacks lately.
637450	640690	All this crypto is all vulnerable to, like, how long things take.
640690	641790	And I'm thinking about this.
641790	644770	I'm going, I wonder if I can apply timing stuff to IP.
644770	647530	And it turns out, oh, yes.
647670	651770	It turns out there's an IP fragment reassembly timer.
651810	654250	It turns out that there's only a certain amount of time.
654250	655710	Are you pointing at me?
655990	657430	What are you pointing at me?
657430	658530	Oh, now you're the middle finger.
658530	659630	What is this shit?
660850	662650	Oh, I'll take this opportunity.
662810	665730	So speaking of pointing, there's all these shirts that have me pointing
665730	668450	that say scanran motherfucker.
669250	671770	And it's done by the TorCon sluts.
674030	675890	Hey, you've got a new title.
675890	677230	Would you rather be a goon?
677230	678750	Should have had a better t-shirt.
682670	684230	TorCon is absolutely rad.
684230	685930	I've loved that con for years.
685930	687470	And, you know, they have these shirts for me.
687470	691330	So speaking of good questions, good questions get a shirt.
692230	694050	And trashed off your ass.
694550	696270	What? I can't be the only one.
697030	698410	So, okay, look.
698410	700830	IP fragment reassembly timer.
700890	703710	Basically, these fragments come in.
703770	706450	And we can't reassemble the packet because we don't have all of them.
706610	708790	Eventually, the system gives up, right?
708850	712190	Well, how long is it going to wait before it gives up?
712190	715570	Well, it turns out we can fingerprint operating systems with that value.
715570	717230	You know, some things will wait 30 seconds.
717230	718790	Some things will wait two minutes.
718970	720850	You know, boom, OS fingerprint.
720870	721630	Ooh.
721810	722850	But that's easy.
722850	723410	That's cheap.
723410	725450	Let's go ahead and do some more hardcore stuff.
725450	726170	All right.
726530	728530	What if you have an IDS?
728690	733930	An IDS may very well have a different idea of how long a fragment can live
733930	736890	before it just gives up on trying to reassemble it.
736890	738470	In fact, this is actually true.
738470	741190	Linux and FreeBSD have a 30-second timer.
741190	744190	Snort's frag2 timer will wait 60 seconds.
744430	748770	Now, if the timer was less, if the IDS was going to keep fragments around for less time,
748770	753550	well, hell, you know, we just send fragments too slow for the IDS but fast enough for the host.
753550	755290	But what if it's the other way around?
755290	762230	What if the IDS, because it's all hardcore and, you know, it's going to keep things around for as long as it possibly can,
762230	765330	what if the IDS keeps fragments around longer?
765370	765950	Ooh.
765950	767230	We can do some stuff.
767550	770310	The problem is, it's keeping stuff around longer.
770310	774070	How are we supposed to make the host see one thing and the IDS see another?
774170	777850	Well, our problem is the IDS is keeping fragments around for too long.
777850	778910	Our solution?
778950	781390	Make the IDS drop our fragments.
781730	783010	Well, that sounds really easy.
783010	783830	How are we going to do that?
783830	789250	Well, there are two ways a fragment leaves the reassembly queue.
789250	793850	Either A, it times out, or B, it's reassembled against something.
794010	795050	Hmm.
795630	797170	I like that B.
797170	802590	I like the idea that it's just going to work, but not the way it plans to.
803770	805330	Watch this.
805590	806790	Here's what we're going to do, right?
806790	807390	Look.
807390	808370	Take our payload.
808370	810210	Up to 65 kilobytes.
810210	813690	We are going to split it into a whole bunch of fragments.
813690	815590	We're going to take the even-numbered fragments.
815590	816650	We're going to make a copy of them.
816650	819510	And we're going to fill those fragments' payload with noise.
820230	821430	Absolute crap.
822210	825370	And we're going to send this absolute crap.
825390	826250	And you know what we're going to do?
826250	827450	We're going to wait.
827830	829170	So we send the crap.
829490	831530	And the host has some crap.
831550	833770	And the IDS has some crap.
833810	835690	But you know what happens after 30 seconds?
835690	837850	The host drops the crap.
837850	841490	But the IDS, it likes the crap.
841570	843350	It keeps it around.
843350	845350	It thinks it might be useful.
845350	848110	Oh, and indeed, it is useful.
848110	852010	Because we go ahead and we send the odd-numbered fragments.
852010	856130	And the odd-numbered fragments go to the host, and the host has nothing.
856130	859490	So the host holds on to these odd-numbered fragments and says,
859490	862090	Well, you know, gotta wait for some stuff in the future.
862250	863610	IDS, no.
864150	866490	IDS has been holding on to some crap.
866490	871630	So the IDS has crappy even and good odd.
871630	872570	It reassembles.
872570	874510	It's like, what the hell is this?
874570	876850	And it drops it on the floor.
877650	882130	Ah, but now we send the legitimate even-numbered fragments.
882670	886290	And the IDS, well, it already dropped all that stuff from before on the floor,
886290	891810	so the IDS now has to keep it in its cache.
892310	893710	But the host?
893710	895550	Host has legitimate even.
895550	897330	Host has legitimate odd.
897410	899830	Host reassembles just fine.
900710	902070	And then you win.
909200	911360	And now my favorite line.
911460	913620	It gets worse.
915400	918160	Right now, we're giving the IDS crap.
918380	920440	Well, IDSs are meant to look for crap.
920440	921740	They might alarm.
921740	923220	They might be worried.
923280	926320	Is there a way we can, instead of giving it crap,
926320	929120	can we make the IDS see something completely different?
929120	931580	You know, like, the IDS sees a get slash,
931580	933920	and the host sees a SQL injection attack?
934680	935500	Ooh.
937280	938900	Here's what we're going to do.
939360	942140	Now, get slash has some headers,
942140	944520	and the SQL injection attack has some headers,
944520	949000	and it turns out a fair amount of these headers can be exactly the same.
949000	953620	So what we're going to do is we're going to split our stuff into three packets.
953660	957960	A common header, good stuff, and you're going to die.
957960	964000	And what we do is the first thing we send is, you're going to die.
964720	965440	No, no, excuse me. No, no.
965880	966820	That's later.
966820	968440	We're going to send the good stuff first.
969180	971040	Good stuff goes first.
971180	974020	You know why? Because I want the IDS to see some good stuff.
974040	976900	I want to give it some happy, nice feelings.
977560	980660	No problem. I would never attack you.
981920	983200	So here's what we're going to do.
983200	985660	So we send the good stuff, and we wait.
985660	988480	And we wait long enough so the host goes, fuck this good stuff.
988480	989600	It drops it.
989940	993620	But the IDS still has it around, and we send the shared common header,
993620	996000	and the IDS goes, I got the header, and it's nice,
996000	998160	and I got the good stuff, and it's nice.
998260	1003040	So it assembles and says, hey, this guy just asked for a git slash.
1003040	1004040	He's cool.
1004880	1009140	But the host still has, at this point in time, where's the host at?
1009140	1010440	The stuff in its header.
1011080	1014800	Just the header packet, because it already dropped the good stuff.
1014800	1018700	But it has the header, and now we give it the evil packet.
1019040	1021980	And what happens when the header meets the evil packet?
1023240	1025540	Reassembles a SQL injection exploit.
1025540	1026680	You win.
1029930	1030910	What's up?
1034310	1035510	Quite a few.
1036750	1038970	So, what about checksums?
1040390	1041970	There's a problem.
1041970	1046650	Our hosts may actually go ahead and, you know,
1046650	1050510	SQL injections should not have the same checksum as git slash, right?
1050510	1052290	I mean, there's 65,000 possibilities.
1052290	1054550	Why would the things match up?
1054550	1056750	Well, it turns out, there's this great book.
1056750	1060370	It's called TCPIP Lean, by this guy, Jeremy Bentham.
1060470	1061550	It's hardcore.
1061750	1063150	I ain't saying it's hardcore.
1063150	1066630	Like, the guy debugs Ethernet with an oscilloscope.
1066630	1068350	That kind of hardcore.
1069270	1070130	So, look.
1070130	1071030	He's got this thing.
1071070	1073510	He's dealing with hardware that doesn't have enough RAM
1073510	1077770	to have an entire packet in RAM at the same time.
1077930	1079530	Holy crap!
1080590	1082850	So, he talks about how you do this stuff.
1082850	1084890	He says, well, you know, your checksum.
1084890	1087690	You don't want to have to go and go over all your data.
1088130	1090530	How do we go ahead and stream out a packet
1090530	1092670	and not have to worry about the checksums?
1092670	1095370	Well, the idea is you put in the wrong checksum.
1095690	1097750	But there's a funny thing about IP checksums.
1097750	1098610	They're crap.
1099430	1100130	They are.
1100130	1100850	They really suck.
1100850	1101950	They're just a one's compliment.
1101950	1103810	They're just like adding numbers, right?
1103950	1105770	So, there's a really funny thing you can do.
1106050	1108070	At the end of your payload,
1108070	1111210	you can be like, wow, I'm like 32,000 off
1111210	1112910	from what my checksum should be.
1112990	1115690	And so, you like, you know, add a little bit of a comment.
1115810	1117730	Fix by 32,000.
1118130	1119430	And it works.
1120150	1121310	So, you just do that,
1121310	1124150	and now you're going to have a constant checksum
1124150	1126710	for different payloads.
1127550	1130490	We can actually backport this attack
1130490	1132550	to all the original mechanisms
1132550	1135110	used by PatchEck and Nooshum and Song.
1135110	1136630	And it turns out what we can do,
1136630	1138010	and I haven't built this one yet
1138010	1140630	because I really fucked up my arm.
1140630	1142230	Be happy I'm here at all.
1143350	1145510	But it turns out you could actually send
1145690	1147150	a series of packets such that
1147150	1150690	on Linux, they assemble into a Linux exploit.
1150690	1153430	And on Windows, they assemble into a Windows exploit.
1153430	1156190	And all because there's a whole bunch of different ways
1156190	1159430	that IP stacks can reorganize data.
1159450	1161670	And you could actually, and I haven't built this yet,
1161670	1162810	and I'm fully honest,
1162810	1165210	you could actually create a sequence of packets
1165210	1167890	such that when they arrive on the host,
1167890	1169970	the particular host being used
1169970	1171650	will reassemble it into a way
1171650	1174270	that is relevant for that host.
1174270	1176750	And you don't even need to get any kind of feedback back.
1176750	1177710	It's kind of cool.
1178510	1180330	Now, hitting the brakes.
1180330	1182050	There's a couple IPS vendors out there
1182050	1183950	who are like, dude, you're full of crap.
1183950	1186130	Because our stuff is going to see you,
1186130	1188230	it's going to see these overlapping fragments,
1188230	1189350	we're going to deal with you,
1189350	1191730	and we're going to shut your session down.
1191950	1194130	Shut my session down, that's not nice.
1194430	1196110	And not only is it not nice,
1196110	1197050	there's not a lot of people
1197050	1198610	who are going to be able to do that.
1198610	1200030	That's really unique.
1200850	1201290	And...
1203690	1205670	Some jackasses, actually.
1205850	1208710	Complete and utter fucking jackasses.
1211230	1213050	Alright, no, I'm kidding.
1214530	1215650	Anyway.
1217310	1219870	Look, there's a funny little thing
1219870	1222170	that happens when you block a session.
1222930	1225250	You send a bit of information.
1225310	1227490	I blocked you, I stopped you,
1227490	1228710	I got in your way,
1228710	1229830	I'm telling you I'm here
1229830	1231450	and I'm getting in your way.
1231570	1234450	Yo, that's a fingerprint.
1235390	1237670	It turns out that anytime
1237670	1239110	an intrusion detection system
1239110	1240850	or a firewall gets in your way,
1240850	1243030	it has actually identified itself.
1243030	1244810	Because there's about a million different ways
1244810	1247010	that these things can go ahead.
1247070	1248430	Do they block invalid checksums?
1248430	1249670	Do they block invalid options?
1249670	1251270	Do they block invalid ICMP types?
1251270	1252290	How about HTTP?
1252290	1253330	How about SQL injection?
1253330	1254810	How about SQL injection of this type?
1254810	1256530	How about invalid DNS packets?
1256530	1258230	How about tipping point?
1258230	1260710	Oh, you sent a TCP fragment out of order.
1260710	1262150	We're going to drop you on the floor
1262150	1264210	because we don't like RFCs.
1264210	1265770	They're overrated.
1266950	1268110	Or checkpoint.
1268110	1269870	Oh, you're using DNSSEC.
1269870	1271690	That's never going to be feasible.
1271690	1274030	Point is, you can go ahead and identify
1274030	1275630	pretty much every firewall
1275630	1277230	and every intrusion protection system
1277230	1279850	based on whether, in a given session,
1279850	1281590	if you do something it doesn't like,
1281590	1283210	if it kills your session.
1283290	1285990	And it turns out you can find out the precise hop
1285990	1288250	that the IDS and IPS is at
1288250	1291190	by using Mike Schiffman's firewalk method.
1291190	1293370	Which is basically, you go ahead
1293370	1294730	and you send your nastiest off
1294730	1296390	one hop before the firewall
1296390	1298730	and then you send it one hop after.
1298730	1300790	If your session dies one hop after,
1300790	1303430	you know the hop where the firewall lives at.
1303770	1305790	Hi, how you doing?
1305830	1307670	Not that this is anything wildly new.
1307670	1309790	This is a slide from like 2003.
1310250	1312170	And it basically shows you
1312170	1314330	how you detect a PIX firewall.
1314690	1317350	And I'm not giving any details,
1317350	1318630	but if anyone ever tells you
1318630	1321670	it's ever impossible to remotely detect a firewall,
1321670	1324070	dude, I've been doing it for like two years.
1324910	1327550	So I can't say what that's in reference to,
1327550	1329610	but you can always detect
1329850	1331270	a firewall remotely.
1331270	1332970	There's just too many different variations
1332970	1335250	on how the protocol can be broken.
1336390	1336910	So...
1337710	1339270	IP shunning.
1339410	1341770	Turns out, a bunch of intrusion protection systems,
1341770	1343970	they are, they're acting all hardcore.
1343970	1345730	You mess with them a little too much,
1345730	1347610	they're going to block your IP entirely
1348130	1348770	because they're like,
1348770	1351110	well obviously your IP is evil.
1351310	1353510	And, you know, it's not like anyone
1353510	1356210	ever spoofs IP addresses.
1356470	1357970	Lies about who they are.
1357970	1360270	Oh, nobody ever does that.
1360450	1361850	Let me tell you why it's a really
1361850	1364110	bad idea to block traffic
1364110	1365850	that comes from random IP addresses
1365850	1367650	on the internet. Anyone ever type
1367650	1369530	dig? You know, that whole like
1369530	1372330	domain internet grouper DNS thing?
1372330	1374010	Here's a couple hosts, you might have heard
1374010	1375910	of them, they're called the root servers.
1376030	1378430	If you can't talk to them, you're fucked.
1385810	1387490	So like anyone who's running
1387490	1389370	these IPS's is like, hello
1389370	1391410	internet, here is my
1391410	1393330	firewall rule set, would you like
1393330	1395510	to submit new rules?
1396010	1397370	By any chance, would you
1397370	1399330	like to knock my stuff down?
1399330	1400310	We'll talk after.
1400950	1402710	It's like, seriously?
1403190	1405310	Now, you know, I'm showing this stuff
1405310	1407430	and yeah, you can knock out any of these networks by just
1407430	1409150	like, you know, hi, I'm 128
1409150	1410690	810 90.
1411110	1413490	I'm trying to slammer you.
1416150	1417450	But oh,
1418050	1420030	I can't stop here.
1420390	1421950	I can't stop here, because it is
1421950	1424290	too large scale, and more importantly,
1424290	1426050	I thought it was all cool, but it's
1426050	1428090	been whispered about for years.
1428650	1430070	And you know, I can't go ahead and take
1430070	1431490	full credit for something people have been
1431490	1433530	talking about, so let's do a little bit
1433530	1435890	more elegant attack.
1435930	1438110	Again, it gets worse.
1439370	1441630	I've been investigating DNS poisoning.
1441630	1442750	I've been investigating a lot.
1442750	1444710	Does anyone here know,
1444710	1446750	oh, hang on, we'll deal with that later.
1446790	1449410	But I've been investigating DNS poisoning quite a bit.
1449670	1451370	Four billion packets, quite a bit.
1452410	1454890	Is it possible, given these networks
1454890	1456550	that implement automatic network
1456550	1458850	shunning, to not just like, knock them
1458850	1460730	off the network, but to poison
1460730	1462710	their name servers, to go ahead and
1462710	1465610	redirect traffic from their network arbitrarily?
1465790	1467210	Oh, yeah.
1467850	1468590	Well,
1468590	1469930	there's a funny thing.
1469930	1471850	I showed you before, we will block you
1471850	1474330	from the name servers. And that's nice.
1474330	1475730	But let's do worse.
1475730	1477970	Let's block them from individual name
1477970	1479870	servers. Not the root, but
1479870	1482710	say, hey, large ISP,
1482710	1483990	see that big bank all your
1483990	1486430	customers go to? Yeah,
1486430	1488310	we don't want them to do that.
1488450	1489690	And how can you do that? Well,
1489690	1492050	block the communication between
1492050	1493890	the name server at the
1493890	1495870	ISP and the name server
1495870	1497990	at the bank. And there are
1497990	1499790	two sides you can do the blocking.
1499790	1500370	You can cause the
1504590	1505010	ISP...
1505010	1506070	God damn!
1519610	1520110	Humberdink,
1520110	1521570	I believe I am out.
1523050	1524070	Hey, I drank
1524070	1525610	everything that was there. I think you need
1525730	1526410	a drink.
1527930	1529590	So, there are, you can
1529590	1531510	block at the ISP side, you can block
1531510	1533750	at the bank side. Both ways.
1533750	1533850	Humberdink,
1538930	1539810	no.
1543570	1544110	So,
1544110	1546550	only if I really screw up.
1547550	1548370	In which case,
1548370	1550430	you are having a shot with me up here.
1551190	1551690	So,
1552290	1554290	general theme is to block communication between
1554290	1556170	any two name servers. You can block at either the server
1556170	1557450	or the client side.
1558510	1560250	All right, let's say you spoof
1560250	1562170	malicious traffic from the client network
1562170	1564150	to the server network. So, say, the big
1564150	1565950	bank no longer likes podunk
1565950	1568050	ISP. All right?
1568050	1569930	That means podunk ISP
1569930	1571970	sending out requests and
1571970	1574370	nothing's coming back.
1574430	1576050	All right? You know, let's think
1576050	1577750	about that for a second. We got about,
1578350	1580030	assuming a fixed port, we'll talk about
1580030	1581490	that in a second. We got about
1581490	1584030	65,000 possibilities for what the
1584030	1585870	transaction ID is going to be. The
1585870	1588090	transaction ID, of course, controls whether
1588090	1590330	or not when I spoof a packet,
1590330	1591970	it actually is going to get blindly
1591970	1594210	accepted. Well, kind of
1594210	1596390	funny, is usually it's called a
1596390	1598190	race condition. I would have to
1598190	1600630	get my fake
1600630	1602470	reply back before the real reply
1602470	1604170	comes back. But you know what happens
1604170	1606710	when the intrusion protection systems are in place?
1606710	1609190	Well, it's a race, but I
1609450	1610430	took a bat and knocked
1610430	1612330	out the other guy's kneecap, so he's
1612330	1615290	not running anymore.
1615290	1616370	So, I got about an average
1616370	1618150	of 32,000 packets to do
1618150	1620270	and instead of about 100 milliseconds,
1620270	1622410	I can do it, like, about
1622410	1624370	as long as I freaking want.
1625470	1626990	Moral of the story,
1626990	1628370	do not automatically
1628370	1630010	shun IPs.
1630010	1632630	But, you know, I can do the other side.
1632650	1634170	I can also spoof malicious traffic
1634170	1636510	from the server network to the client network.
1636510	1638450	So, you know, use some podunk ISP and it's like,
1638450	1640250	holy crap, the bank is trying to
1640250	1641250	kill me!
1641650	1643950	I paid my loan, man!
1644670	1646450	Well, so, there's a
1646450	1648210	little difference here, because you'd think
1648210	1650270	if the ISP is no longer talking to
1650270	1652150	the bank, well, you know, the ISP sends out
1652150	1654170	the request and the reply comes back and the reply
1654170	1655810	is blocked. But,
1655810	1658290	if the reply, you know, you think, well,
1658290	1659930	when I spoof stuff,
1659930	1662070	it also has to be blocked, right?
1663070	1664250	Funny thing about
1664250	1666570	IP, there's no affinity.
1666750	1668050	And by that I mean,
1668050	1670010	IP addresses, you know, you can actually
1670010	1672250	return a DNS, when you send out a
1672250	1674350	DNS request, about 15%
1674350	1676490	of the time some other guy replies.
1676490	1678150	And it works.
1678710	1680310	So that means, the legitimate
1680310	1682410	host can't send you back replies, but
1682410	1684530	the entire internet can be spoofing
1684530	1686150	replies back.
1686150	1688670	And they'll all work if their transaction
1688670	1690390	ID is correct.
1690770	1692450	Oops. Again,
1692450	1694590	do not implement automated network
1694590	1695570	shunning.
1696070	1698410	But there are people who like it, and I'll go
1698410	1700490	ahead and I'll say, okay, make sure
1700490	1702530	you can talk to name servers,
1702530	1704330	see if you can make it so your outbound
1704330	1706570	communications override any automatic
1706570	1708470	shunning. And, you know, again,
1708470	1710670	do not touch name servers.
1711130	1712330	But seriously,
1712330	1714390	don't do this stuff. There's just 80
1714390	1716750	million ways that automatic shunning,
1716750	1718050	you're giving,
1718050	1720350	they're giving you guys access to their firewall
1720350	1722950	table. What is wrong with these people?
1723570	1724950	So don't do that.
1726130	1727510	Go to the next slide.
1727590	1728490	But what about complaint
1728490	1730290	emails? You know,
1730290	1732550	funny thing, you know, often they get assigned complaint emails
1732550	1734710	and they negotiate and find out this stuff's going on.
1734710	1736850	Well, funny thing happens when you block someone's
1736850	1738550	name server. You can't send mail
1738550	1740170	to that domain anymore.
1740690	1741730	Oops.
1742250	1745410	Now, what would I know about complaints?
1745410	1746670	Well, when you send
1746670	1748730	4 billion IP packets,
1748730	1750870	people can tend to notice.
1751970	1752570	I've been
1752570	1755090	working with these guys called Prolexic.
1755250	1755710	And...
1757790	1759430	God damn it.
1767020	1768460	All right, look.
1768640	1770660	So, basically,
1770660	1771080	you know how you have these
1771080	1773740	third-party spam filters?
1773740	1774920	They get your mail and
1775480	1777280	they send you the good stuff?
1777300	1779020	These guys do that for IP.
1779300	1780780	They announce your route and
1780780	1782600	they take all the crap that you guys send
1782600	1784700	and be like, that's a very nice
1784700	1786960	10 gig UDP flood. I'm going to
1786960	1788780	filter that. These guys have just
1788780	1790600	ridiculous amounts of extra bandwidth
1790600	1792240	and they gave it to me.
1793780	1794460	I've never
1794460	1796480	actually been able to, like,
1796480	1798760	I can't send packets faster
1798760	1800820	than this network can route them.
1800820	1802880	I feel like less of a man.
1804440	1804980	I've been
1804980	1806500	working with all sorts of cool people
1806500	1808560	and, you know, I've been doing
1808560	1810840	all sorts of stuff to be all legitimate.
1810840	1812660	You know, don't do this
1812660	1815200	at home. Your colo will die.
1815720	1816780	I tried.
1816780	1818520	It was out in an hour.
1818520	1820040	You will get complaints
1820040	1822440	and very scary people
1822440	1824500	will be calling you personally and be like, what the
1824500	1826020	hell are you doing?
1826180	1828220	So seriously, I can't emphasize
1828220	1830280	this enough. I'm doing this because
1830280	1832340	there's a little problem with, you know,
1832340	1834140	large scale network attackers having better
1834140	1836720	intelligence on the network than I do.
1836760	1837900	That's not cool.
1838740	1840480	But yeah, don't do this at home.
1840920	1842160	I've set up, you know, reverse
1842160	1844640	lookups. I'm in Aaron.
1845500	1846500	There's Dan Kaminski
1846500	1849220	security research. How rad is that?
1850300	1850580	Like
1850580	1852420	abuse mails. Someone has hacked
1852420	1854580	in your box. Dude, that's
1854580	1855320	me.
1857780	1858600	So yeah,
1858600	1860420	you know, oh, best email is like, you know,
1860420	1862320	thank you for your information.
1862480	1864100	We will see you in Vegas.
1864100	1866820	Like, oh, crap. Handcuffs.
1869380	1869960	So,
1869960	1870600	what do I
1870600	1872260	want to do? I wanted to go ahead and find, you know,
1872260	1874680	Google's taken out by some DNS poisoning attack.
1874680	1876760	You know, who is actually hit by this
1876760	1879000	thing? So, you know, we scan the world,
1879000	1880900	the entire world, and we find
1880900	1882800	somewhere between, we find actually
1882800	1885060	9 million name servers,
1885060	1886980	but after the scan, only about 2.5
1886980	1889320	million of them would actually talk to me.
1891440	1892560	Shit.
1893360	1894680	Um,
1895880	1897000	I needed
1897000	1898780	to find, because it turns out you had
1898780	1900620	to have a Microsoft server talking to
1900920	1902560	a Windows server.
1902560	1904500	No, excuse me, Microsoft server talking
1904500	1906120	God damn it.
1910740	1911740	Okay, the problem
1911740	1914240	with this plan is, like, the more I drink,
1914240	1915980	the more mistakes I'll make.
1917060	1917980	Okay, so,
1917980	1920260	I'm totally getting that ever clear.
1920980	1921980	So, look,
1921980	1923660	you have to have Windows servers who are linking
1923660	1926000	to bind date servers.
1926000	1928160	Fairly obscure situation, right?
1928360	1930120	Um, okay.
1930120	1931800	Well, how do we find that one server is
1931800	1933840	linking to another? By linking, I mean, instead
1933840	1935680	of going out and resolving it itself,
1935680	1937420	it asks its buddy.
1937720	1939480	How do we find these links?
1939840	1941260	And, um,
1941260	1943960	the way that I ended up using is basically
1943960	1945380	to just ask
1945860	1947880	everyone, hey, you know,
1947880	1949900	hey you, go ahead, you know, what's your name?
1949900	1951740	Your name's Bob? Go ahead and look up
1951740	1953740	bob.madness.net
1953740	1955780	and madness is a domain I own.
1955860	1958340	If some guy named Charlie walks up to me,
1958340	1959700	okay, I know Bob
1959700	1961500	asked Charlie to look something up.
1961500	1963640	So I know there's a link between those two domains
1963640	1966180	and those name servers. That's how I did it.
1966640	1968280	What were the end results?
1968760	1969460	Um, well, we got about
1969460	1971740	two and a half million verified name servers,
1971740	1973600	meaning, um, they would still talk to
1973600	1975580	me. And, uh, of
1975580	1977540	those two and a half million, we
1978220	1979180	used a tool called
1979180	1981180	fpDNS, fingerprint DNS,
1981180	1983500	and we fingerprinted every single
1983500	1984560	one of them.
1985320	1988020	Ooh, I got some emails out of that one.
1988560	1989840	Ooh, crap.
1989840	1992000	There are a lot of IDSs that are like,
1992000	1994020	you tried to check version.
1994020	1996660	How could you possibly do that?
1996660	1997180	You know,
1997690	1999620	your attack is detected by
2000880	2001380	100%.
2002660	2003700	You know it
2003700	2005100	without fail.
2006120	2007820	Like, seriously, people did not
2007820	2009680	like it. But you know what? We're dealing with
2009680	2011580	security and, um, you know, we found about
2011580	2013920	230,000 hosts that are
2013920	2015400	possibly broken,
2015400	2017660	13,000 that are definitely broken,
2017660	2019620	and you know what? I'm going to be sending
2019620	2021740	some emails. And we're going to get
2021740	2024020	this problem dealt with.
2024240	2025740	And incidentally, uh,
2025740	2028200	scan was done in under a day.
2028480	2029660	It's good to be the author of
2029660	2031560	scanrand. I send packets fast.
2031680	2033400	Fuck yeah. Oh, oh,
2033400	2035140	who said that?
2035920	2037100	Who said that? Oh.
2037900	2039640	Hell yeah. Well, maybe
2039640	2041660	not. Hey, someone get him
2041660	2042600	that shirt.
2044700	2045420	Um,
2045920	2047560	I'm not replying.
2048540	2049780	So look,
2049780	2052140	kind of, uh, reversing the thing.
2052160	2053420	Normally with an exploit, you're like,
2053420	2055560	I've got this box. I wonder what it's
2055560	2057440	vulnerable to. Reverse.
2057440	2059200	Um, I wonder if someone
2059200	2062140	fucked this up. Let's ask everyone.
2063140	2064060	So I'm like,
2064060	2065100	you know, I wonder,
2065100	2067540	you know, there's these transaction IDs
2067540	2069460	and if there's a known transaction ID,
2069460	2071220	you can DNS spoof on demand.
2071220	2073500	I wonder, is anyone
2073500	2075380	using the same transaction ID
2075380	2077000	when I make a request,
2077000	2078960	when they go out to the outside world,
2078960	2080860	does anyone use the same thing?
2080860	2083980	Because that'd be really insecure. That'd be dumb.
2083980	2085720	You'd have to be like, you know,
2085720	2087640	one in a hundred thousand to be this
2087640	2089520	dumb. But there's a funny thing
2089520	2091620	that happens when you ask two and a half million
2091620	2093540	people a question. You find
2093540	2095360	the dumb ones.
2095820	2097620	So there's like, uh, so we asked
2097620	2099780	everyone with a fixed, you know, transaction ID.
2099780	2101140	I had the data anyway.
2101140	2102740	And we found about
2102740	2105040	110 hosts that are
2105040	2107360	dumb. And of these 110
2107360	2108680	hosts, it's
2108680	2110920	major vendors
2110920	2112520	ADSL modem, so
2112520	2115240	wow, look at all these networks I can completely own
2115240	2116500	on demand.
2116700	2118920	And the name server
2118920	2120880	that I was using to host
2120880	2122320	my own data.
2124830	2126750	God dammit.
2126750	2128670	In my defense, it was an old
2128670	2131230	version, but oh yeah.
2134200	2134760	So...
2134760	2136220	Oh, fuck that.
2138770	2140190	God dammit.
2142670	2143790	Speaking of...
2143790	2144910	You fucking
2144910	2146250	assholes, I need to do the
2146250	2147590	drinking game.
2148150	2150210	Alright. I'm liking this.
2150210	2152090	I may do all my talks smashed.
2153950	2155150	Hello, sir.
2155150	2156590	I'm drunk.
2157430	2158270	I don't know
2158270	2160550	how we never noticed this before.
2162010	2162690	You know
2162690	2165050	on TCP you can scan for servers?
2165470	2166570	Well, UDP is a little
2166570	2168650	different. There really is no difference between
2168810	2170270	a client and a server.
2170790	2172870	How did we not realize until 2005
2172870	2174570	that you can scan for client
2174570	2176270	ports as well?
2176470	2178750	Name servers very often have
2178750	2180770	fixed ports that they send all their requests
2180770	2182550	from. They use a single socket.
2182810	2184770	And it turns out, you can
2184770	2186930	scan for this client socket.
2186930	2188670	You can find out who they're sending requests
2188670	2190610	out to. And I'm like, well, what
2190610	2192670	are these ports? I bet there's lots of servers
2192670	2194930	that send out questions from a
2194930	2196730	source port of 53.
2196730	2198990	But you see, that's, I think, the nice
2198990	2201410	thing about having ASLO to data
2201410	2203210	is you can know.
2203210	2205090	Let's look at the data.
2205090	2207470	Oh, look at that.
2207470	2209050	823,000 times
2209050	2211750	the source port was 32,768
2211750	2214730	on an outgoing request.
2214730	2215830	And 195,000
2215830	2218730	times it was 32,769.
2218730	2219090	And 54,000
2219090	2221130	times, oh, you're telling me
2221130	2223150	on a large portion of the internet infrastructure
2223150	2225410	I can monitor load levels
2225410	2227530	on remote name servers?
2227810	2228930	Sweet.
2230350	2231090	So, um,
2231090	2233110	yeah, you should be running
2233250	2235070	a name server that actually buries its
2235070	2236270	local port.
2236810	2239110	Other stuff, there's like a 15 minute chunk
2239110	2241590	of DNS poisoning things I can't tell you about.
2241590	2243190	But holy crap, someone's up
2243190	2244630	to some nasty shit.
2244950	2246070	Wow.
2246070	2248250	And I wasn't even looking for it.
2248250	2249890	It just accidentally came back.
2249890	2252350	Hey, by the way, we're spoofing these guys.
2252650	2254150	You're what?
2255110	2256250	And it turns out
2256250	2258310	there's all these systems that automatically
2258310	2260110	investigate what the hell you're doing
2260110	2262070	when you are sending 4 billion
2262070	2264030	packets, but when they investigate
2264030	2265750	they have no idea that the investigation
2265750	2267470	comes back to you.
2267630	2270070	So I've got traffic from really, really
2270070	2272730	dark networks where it's just like,
2272730	2274310	hi, there's no one within
2274310	2276530	the rest of my class A,
2276530	2278310	but who are you?
2279830	2280970	No, no, no, no, no.
2280970	2282450	Who are you?
2285470	2287090	So, um,
2287090	2288930	as long as we're sending
2288930	2290470	assloads of traffic,
2290470	2292370	can we make some pretty pictures?
2292370	2294210	Because, you know, people like that.
2294290	2296070	And so I've actually generated
2296250	2297670	a methodology that goes ahead
2297670	2300090	and create maps
2300090	2302150	all internet routes in about
2302490	2303650	a couple hours.
2303650	2305990	It's really, really fast.
2306550	2307650	And, um, you know, rather than
2307650	2309590	just like hype, I'll show you
2309590	2311870	the raw data as it's collected.
2312470	2313590	And before anyone from
2313590	2315730	DEF CON has a heart attack, this scan is happening
2315730	2318050	from the 170 gigabit pipe.
2318650	2320170	So we go ahead,
2320170	2321590	we go into it.
2325880	2326920	Boom!
2327700	2329800	Hi, internet, how are you doing?
2329800	2331560	We're sending out about 20,000
2331560	2333440	packets a second right now.
2333440	2335280	And, um, we're tracerouting in this
2335280	2337960	massive, uncontrolled manner.
2337960	2339440	And lots and lots and lots and lots
2339440	2341820	and lots of hosts are talking to us.
2341820	2343340	That's a mess, right?
2343340	2345340	How are we going to filter it?
2345340	2347480	Well, welcome to SQL.
2347480	2349460	Fun little language, lets us organize
2349460	2351400	things. Once we run this stupid
2351400	2353020	little query, you know,
2353020	2356260	show me what, you know, reorder this until it makes sense.
2356400	2357180	Oh, look!
2357200	2360980	On the way to 12.10.41.178,
2360980	2362100	here's all of our
2362100	2364080	hops. And here's hop
2364080	2366020	one, hop two, hop three, hop four.
2366020	2368180	What you were seeing before was wildly
2368760	2370080	disordered, and now we have it in
2370080	2372020	order. And how do we define
2372020	2374120	that two things are linked? Well, if
2374120	2376220	that number's three and that number's
2376220	2378340	four, then 67,
2378340	2379800	you know, this host is probably
2379800	2382080	connected to this host. Mind you,
2382080	2383860	we're scanning the internet over a range of like
2383860	2385980	two hours, so this is actually kind of
2385980	2387760	cool to see it in some degree of order.
2388320	2390060	And, um, what does
2390060	2392100	this crap look, well, hang on, what does this look
2392100	2394100	like when we actually get
2394100	2395180	it said and done?
2396060	2397860	Finally, I get to show some pretty pictures.
2406170	2407210	I know.
2408450	2409050	I'm well
2409050	2409710	aware.
2416180	2418700	So this data's been around for a while,
2418700	2420360	but, uh, being able to zoom
2420360	2422540	in on it is kind of new.
2423820	2424520	And, uh,
2424520	2426400	being able to, like, tilt it down
2426400	2428200	and, you know, raise
2428200	2430300	it up and, like, fly around.
2430300	2432160	Everyone, you know, Hollywood really
2432160	2434480	wants someone to do this, so fine,
2434480	2436340	here, I'm flying around the internet, ain't that
2436340	2436920	rad?
2446360	2448300	Now the eventual goal,
2448300	2450160	and this will happen sometime in the next
2450160	2452180	couple of months, yeah, I really
2452180	2453800	broke my arm, um,
2453800	2456320	but the goal is that we can go ahead and we can take live
2456320	2458300	data and we can go ahead and plot
2458300	2460140	it so this is all black and white and as
2460140	2462180	you actually use the net, it goes, you're going over
2462180	2464140	this path, you're going over this path, here's all
2464140	2466120	the constraints and all that kind of stuff.
2466120	2468280	And that's the kind of data I want to be able
2468280	2470260	to, you know, collect. It turns
2470260	2472260	out when you do this kind of large mapping,
2472260	2474440	there's a couple things you can do extra,
2474440	2476140	um, whenever, you know,
2476140	2478220	we have to scan up to a certain range, if we
2478220	2480300	actually find someone, you know, at the,
2480300	2482100	you know, the farthest away possible,
2482100	2484540	we can go back, fill in the gaps,
2484540	2486200	um, we can actually go ahead and,
2486200	2488140	you know, put out senders all over the
2488140	2490220	internet and have all the reception
2491020	2492420	happen at the same point,
2492420	2494520	so we can say, here's how the net looks from China,
2494520	2496480	here's how the net looks from Japan, here's how the net
2496480	2498440	looks from Abu Dhabi, and
2498440	2500880	all of it will come back to the same collector,
2500880	2503020	and we can go ahead and we can integrate the data.
2503400	2504540	Um, and
2504540	2506560	the results look pretty cool, but
2506560	2508800	there is, there is a weakness.
2509300	2510520	Yeah, how are we going to make this
2510520	2512320	useful? And beyond that,
2512320	2514680	I don't want to have to do this big preprocessing
2514680	2516760	phase, I would like to graph live
2516760	2518860	data. How could I do that?
2519140	2520560	Well, there's these
2520560	2522580	guys, they wrote some
2522580	2524800	code in C++, it makes
2524800	2526500	my nose bleed, but it's
2526500	2528480	really, really cool. It's really, really
2528480	2530560	cool to the level of, like, it will
2530560	2532760	handle, like, 2 million node networks
2532760	2534780	and be like, huh, sweet, got more?
2535560	2536760	It's really cool.
2536760	2538880	It's called the Boost Graph Library.
2538880	2541100	It's rad. And not only is it rad,
2541100	2542780	but their developers are like, okay,
2542780	2544580	we're going to support Dan.
2544800	2546180	Like, sweet.
2546420	2548600	They're getting, like, updates, like, here is
2548600	2550660	your code, here are the answers to the
2550660	2552520	test. Like, struggle with this stuff
2552520	2555200	for, like, four days, send them a mail, here you go.
2555680	2556340	Rad.
2557440	2558320	So,
2558920	2560640	what kind of stuff can we do now that
2560640	2562600	we have, like, you know, real graph
2562600	2564020	logical stuff?
2565640	2567100	Let's see here.
2571780	2572660	This is
2572920	2574520	a router trace on a small
2574520	2575420	network.
2577800	2578460	That's a little
2578460	2579940	dark, isn't it?
2580400	2583080	We'll set the next one to be a little lighter.
2609680	2612100	This is a fairly large-scale network.
2613060	2614160	And, actually, this is a router
2614160	2616400	trace. We're watching traffic.
2616780	2617880	And it's actually
2617880	2620140	animating out in front of us in real time.
2620300	2622140	And we're watching, basically,
2622140	2623980	nodes that aren't talking to anyone else.
2623980	2625980	Here's a cluster right here that's just one server
2625980	2627460	talking to lots of hosts.
2627480	2630460	Here are servers that have a multi-tier relationship.
2630460	2632420	This is all very early code
2632420	2634080	written in the last week or two.
2634120	2635660	But, ooh, it's pretty.
2636820	2638260	And, um,
2638260	2640480	the idea is you can actually, like, stream
2640480	2642400	random data in. If I had any faith
2642400	2644380	in the networks of these things, I could actually
2644380	2646560	do live TCP dump with all
2647160	2648040	interrelationships shown
2648040	2650160	on that kind of map.
2650160	2652640	And is this useful? Well, I haven't made a discovery
2652640	2654280	on it. I took all my DNS
2654860	2656380	interrelationship data and put it into
2656380	2658760	that graph. And what did we find?
2659380	2660580	Interestingly enough,
2660580	2662980	oh, crap, there's a whole bunch of hosts
2662980	2664540	that are all coming back to one
2665280	2666680	that I expected.
2666680	2668580	What I did not expect, and it'll take, actually,
2668660	2670640	a few seconds for it to show up on this,
2670640	2672240	but you'll just have to believe me.
2672260	2674680	My expectation was that you would
2674680	2676740	have, you know, lots and lots of hosts
2676740	2678700	that actually went to one backend that talked
2678700	2680900	to me. What you actually see is a
2680900	2683120	pretty complex multi-tier relationship.
2683120	2684920	One name server will talk to another name server,
2684920	2687360	will talk to another name server, and will talk to another name server.
2687360	2689020	This was something that I
2689020	2691420	would not have expected.
2691420	2693360	I actually don't know the layouts that create
2693360	2694360	this, but
2696380	2697520	having seen the
2697520	2699440	data, having seen it visually, I could
2699440	2701420	now build my systems
2701420	2702960	around that assumption.
2703180	2705580	The goal of all of this
2705580	2707060	is that when I do
2707060	2709700	mass internet scale scans,
2709700	2711580	every time I send a packet,
2711580	2713240	I can know the route that packet
2713240	2715080	is going to probably take.
2715080	2717720	I can know the routers it's probably going to go over.
2717720	2720180	I can know what the bandwidth implications are.
2720180	2721400	I can look at my pipe
2721400	2723360	as a water hose.
2723420	2725100	Not a hose, as a pipe
2725100	2726960	of just high pressure water.
2726960	2729040	And I can go ahead and build taps on that
2729040	2731240	based on what the implications are
2731240	2733020	on the underlying network.
2733020	2735120	So I can say, here's a T1.
2735120	2736880	Packets through there can only go at this rate.
2736880	2739160	Here's an OC48. Packets on here can only go
2739160	2741420	on this rate. And most interestingly,
2741420	2742960	I can put monitors on
2742960	2744920	every single router that I'm sending
2744920	2746820	traffic through. And the moment
2746820	2749220	those monitors, I call it canaries,
2749220	2750980	you send five or ten packets a second
2750980	2753180	to each router you expect to go through,
2753180	2755520	as soon as these canaries stop responding,
2755520	2756980	you know you killed them.
2758100	2758500	So...
2758500	2761400	I'm going to start killing canaries. Ain't that fun?
2764860	2766800	And now the last thing. I have no idea
2766800	2769340	if I've gone over, but I hope you guys have had fun.
2770880	2773120	Who here was at my ATalk here last year?
2776950	2777590	Hey,
2777590	2779090	I haven't screwed up yet.
2779610	2779930	So...
2783740	2785780	You're wearing a power glove!
2785780	2787040	How can I resist?
2788400	2790180	Anyone got shot glasses?
2790180	2792160	Can I get some shot glasses up here?
2792380	2794380	What's your name? Patrick!
2794420	2795780	Patrick, this is why I
2795780	2797280	fucking come to DEF CON.
2797320	2800100	Because people will get me really fucked up.
2800500	2801600	Mind you, I've never had Everclear
2801600	2802500	before.
2807340	2809080	Hey, am I
2809080	2811060	shying away from this? No, because I'm
2811060	2812540	trashed.
2813880	2815920	I am so fucked.
2820900	2822640	Hey, I am drinking.
2830580	2833020	Alright, we're here. You know what we're drinking
2833020	2835040	to? We're drinking to TourCon.
2835040	2836920	Probably my favorite small con
2836920	2839640	in the world. It is just the shit.
2839820	2841160	DEF CON is rad.
2841200	2843020	TourCon is just...
2843700	2845160	Hikari is awesome. Is Hikari
2845160	2846800	even here? Dude!
2848360	2848800	Fucking
2848800	2850640	Hikari. Dude!
2851380	2853020	Hey, wait, wait, wait. Do we have a
2853020	2856360	third shot glass by any chance?
2856360	2857540	Hikari, get the fuck
2859620	2860220	up here.
2860220	2862420	Here, you're drinking this shit.
2862420	2863880	I'm drinking Everclear. You can
2863880	2868580	drink the fucking Morgans.
2868720	2869320	Just drink.
2869320	2870300	Alright. To a
2870300	2871960	great fucking con. You guys all rule.
2871960	2872680	Thank you so much for coming here.
2930200	2931160	It's actually
2931160	2932820	working. Holy hell, I didn't
2932820	2934380	think it would actually work.
2935200	2936760	Alright, I'm putting audio out through
2936760	2939040	the PC interface. This better work, guys.
2939660	2941040	I'm warning you.
2941040	2942780	Audio's coming any minute now. Oh,
2942780	2944760	so I had to put on a huge cache on this
2944760	2946780	thing because the Black Hat network was
2946780	2949600	broken beyond all description.
2950120	2951000	It was like wireless
2951000	2953040	from like 20 feet away.
2953700	2954180	Michael
2955560	2956520	Flackley is
2956520	2959000	the Lord of the Dance.
2960040	2960540	Darth
2960540	2962540	Vader is the Lord
2962540	2964120	of the Sith.
2966220	2966620	Okay,
2966620	2968640	Robot Chicken is the best fucking
2968640	2970160	show in the world.
2970580	2984540	Robot Chicken rocks. And that's all
2984540	2986300	about all I have for you
2986300	2987520	fucking guys.
2998160	2999040	Wow.
3013620	3014500	So,
3017340	3018540	just fucking come up here.
3018540	3020040	I want people to hear your shit.
3020740	3022520	Seriously, I really want people to come up
3022520	3024560	and ask questions. Can I fucking
3024560	3025760	have your babies?
3027840	3028560	Dude, you're
3028780	3029740	a guy.
3031800	3032540	Seriously,
3032540	3034880	someone came up with some auto-shunning question?
3034880	3036620	Come on, come here. Alright, what
3036620	3037520	you got, man?
3037980	3040660	Do the IPSs that you're aware
3040660	3042760	of, will they auto-shun their loopback
3042760	3043740	interface?
3044960	3046640	I had totally not
3046640	3047600	thought of that.
3048620	3049740	That would...
3050980	3052620	I seem to have nothing
3052620	3054520	to drink. You guys are
3054520	3056560	falling down on the
3056560	3058940	job. I bring you here for...
3058940	3060760	What, you want me to drink? Okay.
3068920	3069720	That's a
3069720	3071020	really interesting question.
3071020	3072980	Okay, so here's
3072980	3075040	the idea, and this is fucked.
3075200	3076800	This is really, really impressively
3076800	3078580	fucked up. The idea is
3078580	3080920	that you spoof a whole bunch of traffic to some
3080920	3084040	network from the address 127.0.0.1,
3084040	3084820	which is, of course,
3084820	3086760	the loopback address on a host.
3086760	3088780	Will the IPS actually
3088780	3090800	block local host? Because if
3090800	3092740	it does, all sorts of shit's
3092740	3094060	going down.
3097640	3098720	IPS vendors in
3098720	3100460	this room, test.
3100460	3102500	Like, now. Because there's, like, a thousand
3102500	3104760	people who have the idea of testing it.
3105400	3106560	Hey, you have your hand up.
3106560	3107560	Get the fuck up here.
3109680	3110820	No, no, come up.
3110820	3111680	Come up.
3112820	3114460	Seriously, come on up. There's, like,
3114460	3117140	booze and books and, like, good shit and, like...
3117140	3118260	God damn it.
3120440	3122640	No, it's just a rebuttal to the earlier question
3122640	3124320	is if you've got your router set up right, your
3124320	3126620	edge router 127 shouldn't get in?
3127320	3128580	If your edge router's
3128580	3130280	automatic, already blocking
3130280	3132620	127.0.0.1, then, uh,
3132620	3134460	of course, yeah, you're not going to go ahead and get nasty
3134460	3136440	traffic. But, um,
3136640	3139020	a lot of people have the attitude, well, I got an IPS.
3139020	3141000	What do I need to put custom firewalls
3141000	3142760	rules in for? The internet
3142760	3144540	will be giving me firewall
3144540	3145980	rules!
3147080	3148560	Actually, honestly, probably
3148820	3150580	a lot of IPSs already have
3150580	3152280	blocks against 127 and
3152280	3154240	have blocks against RFC 1918
3154240	3156360	space, but I'm sure
3156360	3158180	there's one that doesn't because there's
3158180	3160280	some really crappy IPSs
3160280	3161240	out there.
3162040	3163780	What's up? Hang on, hang on, hang on.
3164140	3166660	You're trying to kick my ass, and so, of course,
3166660	3168060	I have to give you the mic.
3168980	3170780	What happens to overlapping segments, Dan?
3170940	3172400	What do you mean, what happens to overlapping
3172400	3174720	segments? What happens to
3174720	3176300	the segments, uh, the timeout values
3176300	3177980	if the segments are overlapping, Dan?
3178020	3180200	Ah, yes, yes, yes, that's one of the things I pointed
3180200	3182280	out. There are some very good...
3182280	3184240	Okay. There are
3184240	3186240	some relatively good IPSs
3186240	3188520	because they're all shit, but there are some relatively
3188520	3190280	good IPSs that will notice
3190280	3192220	hey, look, this...
3192220	3194220	They basically will go ahead and have
3194220	3196400	their timing value for how long the fragment
3196400	3198380	can live, but fragments
3198380	3200340	have a particular IP
3200340	3202220	ID associated with them, and there
3202220	3204300	will be a separate timer, a much
3204300	3206200	longer timer that notes, hey,
3206200	3208720	I may have flushed this from my queue,
3208720	3209140	but
3210100	3212300	this is a fragment on a
3212300	3214600	session from an old...
3214600	3216400	This is an old... This is a fragment
3216400	3218300	that could be applied to an old session.
3218300	3220300	In other words, someone could be trying to mess with
3220300	3222280	me. Hmm. Why would I try
3222280	3224180	to be messing with anyone? Yeah, I guess they can
3224180	3226400	bust me. Um, those...
3227300	3228100	Those IPSs
3228100	3230180	are really easy to fingerprint,
3230180	3232320	and there is a problem in this industry.
3232320	3234240	There are vulnerabilities in security
3234240	3236240	code itself. I don't
3236240	3238300	want to share that. I just want you to take a drink.
3241140	3241880	Get ready
3241880	3242660	to drink.
3243780	3245880	Really, I am so screwed in
3245880	3247900	TC Baby Drinking Game. Hey,
3247900	3248880	come up here.
3252740	3254720	Can I have your baby?
3254860	3257360	Well, you definitely are a girl.
3259380	3260860	New comment.
3263820	3265020	Later.
3266960	3268340	Come here.
3269920	3271260	All the fragmenting
3271260	3273100	stuff, does that work if they're filtering
3273100	3274620	fragmented packets?
3275200	3277220	No, it doesn't. But that's
3277340	3279540	a problem because fragments are a legitimate
3279540	3281020	part of the IP
3281020	3283100	spec. They're actually...
3283100	3285160	No, there's quite a few networks that are
3285160	3287140	tunneled inside of tunnels, and
3287140	3289060	they end up with much smaller...
3289060	3291120	You know, in the multi-tunneling,
3291120	3293460	end up with packets larger than the MTU
3293460	3295200	because there's a lot of packets that will be
3295200	3297340	sent with an MTU of 1500.
3297640	3299420	So, fragmentation happens.
3299420	3301120	It's supposed to be limited by
3301120	3303300	TCP's MSS value,
3303300	3305120	but sometimes it really does happen,
3305120	3307360	and it does happen entirely legitimately.
3307460	3309160	Now, small fragments, and this is
3309160	3311120	very obscure, but small fragments at the
3311120	3313480	beginning of a packet should not happen.
3313480	3315360	And those things are legitimately dropped,
3315360	3316380	and that's good.
3317560	3318980	Go ahead. Because I've seen
3318980	3321180	networks that do that. They filter out the fragmented
3321180	3322940	packets. What are they missing out on?
3323580	3325540	Is there anything interesting about them?
3325540	3327180	Well, there's an interesting thing. A lot of
3327180	3329100	people say, hey, I can drop 1% of
3329100	3331100	traffic. No problem. It's just, you know, 1%.
3331680	3333440	But you get, you know, this 1%,
3333440	3334980	and this 1%, and this 1%,
3334980	3337000	and suddenly, the internet doesn't work
3337000	3339400	very well anymore. And that happens.
3339400	3341100	And that's ultimately, you know,
3341100	3343000	we have this thing called, like, congestion
3343000	3345000	collapse, when there are too much,
3345000	3347340	there's too much traffic that doesn't back off.
3347340	3349100	There's another kind of collapse. It's firewall
3349100	3351060	collapse, when there's too many overlapping
3351060	3353040	rules from people who think, well, our one
3353040	3355020	little variation on the IP spec is
3355020	3357180	okay, and, you know, we're just going to do it,
3357180	3359420	and, you know, who cares if we drop 1% of traffic,
3359420	3361800	and then the internet no longer works.
3362640	3363200	And, tipping
3363200	3365360	point, I'm talking to you.
3367100	3367760	I can't
3367760	3369300	remember what the denial of service attack is.
3369300	3371060	It's either New Dawn or Teardrop,
3371060	3373160	where it's based on fragmented
3373160	3375240	TCP packets. How would that work
3375240	3376900	against an IPS?
3378120	3379000	The fragmented
3379000	3381120	packet, I dream about Ping
3381120	3383380	of Death, maybe, where you have a packet
3383380	3385360	that reassembles
3385360	3387760	larger than the maximum IP size?
3388460	3389500	Where the
3389500	3391280	TCP packet reassembles
3391280	3392640	and it's broken, and it causes
3394360	3395900	various problems.
3395900	3397440	At this point, you know, it's really
3397440	3399500	sad. It's 2005,
3399500	3401280	right? When the hell did Teardrop
3401280	3404280	come out? Wasn't it, like, 97 or 98?
3404380	3405540	Okay, so
3405540	3407580	very well-known vendor,
3407580	3409500	Netscreen, actually goes ahead
3409500	3411820	and has, like, on their thing,
3411820	3413700	we blocked this many Teardrop
3413700	3415720	attacks. Dude, it's
3415720	3417620	the 21st century. We
3417620	3419760	aren't worried about that shit anymore.
3419760	3421780	It doesn't work, even if
3421780	3423760	it's unblocked. We're not running
3423760	3425480	Windows 95.
3428040	3429580	So, I don't know. I mean,
3429580	3432280	Teardrop, I mean, it's a great brand.
3432500	3433720	Oh, incidentally, you guys know
3433720	3435940	how names are done in the virus industry?
3435940	3437800	It's like, you know, they're all, like,
3437800	3439760	named by the guys who find them.
3439760	3441760	So, just like, you know, we're gonna call this attack
3441760	3443620	Teardrop. We're gonna call this attack
3443620	3445680	CodeRed, because, you know, hey, you know,
3445680	3447720	they didn't, like, put a big brand copyright
3447720	3449680	on it when they attacked our network,
3449680	3451800	so we're gonna name it whatever gets us
3451800	3453500	the most attention possible.
3453520	3456160	And that's why they all have sexy names.
3456420	3457780	Of course, there was a real problem
3457780	3459540	when one of them named their thing
3460780	3461660	Doxpar,
3461660	3463320	because I do Doxpar
3464420	3465300	research, and
3465800	3467700	Doxpar caused me all sorts
3467700	3469800	of problems, especially when the variant
3469800	3472660	happened, Doxpar.A.
3473760	3474080	You
3474560	3475520	bastards.
3477100	3478600	All right, other questions?
3479180	3480520	What, hey, uh-oh.
3480860	3481940	What do you think of the recent
3481940	3483720	ICMP-based attacks?
3487020	3487900	There's so
3487900	3489740	much overh... So, it's really
3489740	3491860	funny. Yes, you
3491860	3493840	can kill ICMP sessions if you
3493840	3495380	can figure out the four tuple of
3495380	3497700	source IP, desk IP, source port,
3497700	3499740	you totally can.
3499740	3501720	But I went on Deja News, and
3501720	3504060	I found a post from 1993
3504060	3506260	calling this shit old.
3508400	3509840	Dear God.
3510760	3511860	No, I mean,
3511860	3513580	okay, the actual attacks
3513580	3516060	are real, but old.
3516120	3517800	To his credit, he's right, they still
3517800	3519840	work, and they shouldn't.
3520020	3521840	His stuff about slow... There's this guy,
3521840	3523840	he has this stuff about slowing down networks.
3523840	3525680	Why am I drinking? I was right.
3526440	3527540	Okay, his stuff...
3527540	3528580	Fuck.
3534080	3535660	Funny guy. He should
3535660	3536720	test his shit.
3537320	3539800	He has this whole thing, well, I can slow down
3539800	3542000	communication of BGP sessions.
3542140	3543640	I can reduce a session down
3543640	3545860	to one packet sent per round
3545860	3547820	trip time. So,
3547820	3549800	BGP sessions, I don't know if you guys know,
3549800	3551700	they're about three kilobytes a second.
3551780	3553560	Three kilobytes a second, okay.
3553660	3555560	So, you reduce a session down to
3555560	3557760	one packet per round trip
3557760	3559740	time on a session that has somewhere
3559740	3561700	between one millisecond and a tenth
3561700	3564200	of a millisecond latency.
3564220	3565920	Oh, no! I can
3565920	3567800	only send a thousand to
3567800	3569920	ten thousand packets a second
3569920	3571960	on my three kilobyte
3572140	3573480	a second link.
3573480	3574540	No!
3575860	3577560	It's ridiculous.
3578180	3580080	Any other questions? Seriously,
3580080	3581700	you don't even have to come up if I can somehow
3581700	3582840	hear you.
3586640	3587240	Says
3587240	3589360	the guy from Prolexic.
3589360	3591900	That took some balls. Here, have a book.
3593820	3595320	Prolexic's been rad, by the
3595320	3597160	way. I mean, seriously. They've been
3597160	3599340	giving me shit tons of bandwidth and taking
3599340	3601920	calls from DoD. Rad.
3603800	3605800	Oh, shit, it's George.
3606380	3607160	It's ScanRan
3607160	3608840	motherfucker George.
3615430	3617310	I hate you.
3618350	3619070	So, I'm going
3619070	3621050	to the T2 con out in Finland.
3621070	3622850	Who here is from Europe?
3624550	3624990	Dude,
3624990	3627090	Euro guys, I'm coming out to you guys
3627090	3628770	mostly. That's the plan.
3629370	3630910	So, T2,
3630910	3632850	I didn't intend to give them props, because
3632850	3634690	TorCon is the shit, but
3635390	3637290	yeah, T2 should be good.
3638270	3638890	What?
3639010	3641630	I didn't screw up! You drink!
3641630	3643150	Hey, someone get these fuckers
3643150	3645010	drinks. They need to be drunk so they'll
3645010	3645970	shut up.
3645970	3648470	I'm not drinking.
3648870	3650150	No, stop.
3655340	3656880	All right, do we have anything else?
3656880	3659060	Because I should probably give this shit up to Hacker Jeopardy.
3659060	3660580	OK, go ahead. You have a good question?
3661000	3663440	No dude, hang on. I want this guy to ask a question.
3664800	3667320	You said that one of your attacks
3667320	3669360	is based on a difference between IDS timing
3669360	3671200	and host timing. Well, in Linux
3671200	3673140	and FreeBSD, isn't it possible, even
3673140	3675120	in extreme situations, just to rebuild the stack
3675120	3677040	so if you know your vendor in advance just to match
3679600	3688580	Man gets a book. Man gets both books. That is an excellent point. Those of you who are
3688580	3696060	very smart admins can go ahead, adapt your host to your shit ass IDS and make things
3696060	3704880	align perfectly. Absolutely correct. Fantastic point. Are you advocating we break our host
3704880	3710320	and match our IDS? Hey, I'm advocating we adapt our host to agree with our IDS's fucked
3710320	3719490	up view of the universe. Thank you very much. Absolutely. What's up? And I think, unless
3719490	3726030	there's any more questions, I think I am done here. You guys are fantastic! I love you guys!
3731130	3737970	As a note, I talk at Black Hat as practice for you guys. You guys are awesome. I cannot
3737970	3743990	even say thank you so much for all. Oh, there's one last thing that is really important that
3743990	3750270	you all know. I have an insane network pipe and I'm taking proposals for how to use it.
3750270	3756110	If you have an idea for what will help secure the internet, I will take the shit of spreading
3756110	3767650	it everywhere. Talk to me! Don't do it yourself! No, not porn! You sick fuck! Especially for
3767650	3774070	the kind of porn you want! Alright, I'm off to the drinking game where I will puke my
3774070	3775470	guts out. Thank you.