[00:10.770 --> 00:18.250]  So this was supposed to go on at 10, and I was totally supposed to get like another hour to sober up.
[00:19.810 --> 00:20.870]  Dammit.
[00:22.430 --> 00:29.390]  This is going to be a really interesting Black Ops. Not only is this the first Black Ops that I've done exploits,
[00:29.390 --> 00:33.670]  this is the first Black Ops where I have been kind of sober.
[00:36.670 --> 00:41.070]  Oh, no, no, no, there's lots of people here providing booze, let me tell you.
[00:41.790 --> 00:45.410]  So, what are we here to do? We got an hour from now.
[00:46.330 --> 00:49.130]  Who am I? You should know by now.
[00:50.470 --> 00:55.970]  What are we here to do? So like last year, you know, I had like one topic, just DNS.
[00:56.030 --> 00:59.890]  It was kind of fun and, you know, left the whole ADD thing alone.
[01:00.470 --> 01:03.110]  Yeah, we're back to ADD. It's fun.
[01:03.110 --> 01:06.170]  We're going to talk about a whole bunch of stuff. We're going to kick MD5.
[01:06.170 --> 01:11.590]  We're going to play with some IP fragments. We are going to mess with intrusion protection systems,
[01:11.590 --> 01:14.490]  which are being really, really abused.
[01:15.050 --> 01:20.590]  We're going to do some DNS poisoning, which again is about the most black hat thing I've ever done.
[01:21.290 --> 01:26.690]  And if that didn't help, we are going to send about 4 billion packets onto the Internet.
[01:26.750 --> 01:32.930]  I have a new toy. It has 170 gigabits and permission to use it.
[01:33.450 --> 01:38.130]  I've never actually cackled before. You know, giggled a little, laughed, but...
[01:41.270 --> 01:44.270]  We're going to make some pretty pictures, because I like pretty pictures.
[01:44.270 --> 01:47.410]  You know why I like pretty pictures? Because I can show them to non-geeks,
[01:47.410 --> 01:51.410]  and they're like, holy crap, that is cool. I have no idea what it is, but it is cool.
[01:51.910 --> 01:55.990]  Usually it's just I have no idea what it is. It just ends there.
[01:56.730 --> 01:58.730]  And finally, you know, watch some TV.
[02:00.770 --> 02:07.950]  Attacking MD5. Instead of going through all the background, here is the web page for Lockheed Martin.
[02:08.210 --> 02:10.550]  Fun company. Some of you might have heard of it.
[02:10.670 --> 02:15.790]  Here is the web page for Boeing. Another fun company. You might have heard of it.
[02:15.810 --> 02:19.170]  Let's see what the hashes of these two pages...
[02:25.680 --> 02:29.200]  Let's see what the hashes of those two pages happen to be.
[02:31.380 --> 02:34.600]  C0F3AD. C0F3AD.
[02:34.960 --> 02:39.140]  These two web pages have the exact same hash.
[02:39.520 --> 02:41.680]  How could that have happened?
[02:42.700 --> 02:46.560]  Oh, I know you like the hash.
[02:50.800 --> 02:55.060]  I was wondering how you came up with that shit, man. Holy crap.
[02:55.060 --> 02:59.560]  Okay, I have to actually turn off my email client this time.
[02:59.680 --> 03:03.920]  I had people using their Blackberry on me the last time I did this talk.
[03:04.500 --> 03:06.320]  That was really annoying.
[03:07.360 --> 03:09.280]  So what is MD5 supposed to do?
[03:09.340 --> 03:11.980]  MD5 is supposed to be basically a data fingerprint.
[03:12.020 --> 03:15.220]  You know, you got some file, however big it happens to be.
[03:15.220 --> 03:18.640]  The end result is supposed to come down to 128-bit signature.
[03:18.640 --> 03:26.780]  The magic word is computationally infeasible to find two files with the same hash.
[03:26.800 --> 03:32.320]  Now, we've known since about, what was it, 96, 97? Bullshit.
[03:33.380 --> 03:38.960]  And, you know, about 2004, Zhang Yun Wang over in China said,
[03:38.960 --> 03:42.580]  Hell yeah, that's bullshit. Here's two files with the same hash.
[03:42.580 --> 03:45.240]  And you know what the response was from a lot of people?
[03:45.240 --> 03:47.780]  Yeah, there you have two hashes.
[03:47.780 --> 03:54.180]  But you could never use that for actual production data that had any kind of real-life meaning.
[03:54.400 --> 03:56.400]  Absolutely not.
[03:58.340 --> 04:02.260]  Okay, hype aside, I do actually try to have some technical data.
[04:02.260 --> 04:04.160]  So here's what the story is.
[04:04.500 --> 04:06.300]  MD5, it's pretty simple.
[04:06.640 --> 04:08.480]  You start out with some initial state.
[04:08.480 --> 04:12.720]  And they use magic numbers like pi and 6, 7, 8, 9, 1.
[04:12.720 --> 04:14.740]  You know, numbers decreasing, whatever.
[04:15.020 --> 04:19.380]  I'm too drunk to go 9, 8, 7, 6, 5, 4, 3, 2, 1.
[04:19.380 --> 04:20.880]  I've got a problem.
[04:21.440 --> 04:24.820]  More than that, I gotta drink.
[04:31.260 --> 04:35.820]  Oh, the way this works at my talks, I like questions.
[04:35.840 --> 04:38.580]  Ask a good one, and you get to drink.
[04:38.700 --> 04:41.300]  And if I can't answer, I have to drink.
[04:41.300 --> 04:45.860]  And, you know, if I'm not done drinking, well, that's the drinking game.
[04:46.820 --> 04:49.240]  So, MD5 basically is really simple.
[04:49.240 --> 04:50.440]  Start with some state.
[04:50.700 --> 04:53.500]  You loop over all your data, 512 bits at a time.
[04:53.500 --> 04:55.040]  And it shuffles that state.
[04:55.140 --> 04:57.240]  And at the end, you end up with some value.
[04:57.240 --> 05:00.460]  You mix in, like, the amount of data that you did, some metadata.
[05:00.460 --> 05:03.400]  And you end up with what's called the MD5 hash.
[05:03.400 --> 05:07.500]  Now, the idea is, anything's different in the input data.
[05:07.500 --> 05:12.740]  A single bit should cause half the output bits in the hash to change.
[05:13.160 --> 05:14.900]  Half. It's a big number.
[05:15.800 --> 05:19.800]  What we have here is a visualization of the internals of MD5.
[05:19.800 --> 05:23.180]  You know, we've got 64 sub-rounds and 3 rounds.
[05:24.060 --> 05:26.340]  Half of those things are supposed to be flickering.
[05:26.340 --> 05:28.060]  Now maybe you can't see the flicker.
[05:28.560 --> 05:30.360]  You see those little dots?
[05:30.360 --> 05:32.460]  There's supposed to be a hell of a lot more.
[05:32.780 --> 05:36.500]  But, you know, we've got the Chinese girl, so, you know, guess what?
[05:36.500 --> 05:38.320]  Almost none of them are different.
[05:38.320 --> 05:40.760]  You know, first round, second round.
[05:40.760 --> 05:43.200]  By the third round, nothing is different.
[05:43.200 --> 05:47.080]  That's this big advance of this, you know, this new MD5 attack.
[05:47.280 --> 05:52.680]  And what's interesting is, once you have two files with the same hash,
[05:53.040 --> 05:56.440]  because it operates 512 bits at a time,
[05:56.440 --> 06:00.780]  once you do end up at an alignment, you can add new stuff.
[06:00.780 --> 06:03.960]  And it's not like you can go back in time, back to earlier in the file and say,
[06:03.960 --> 06:06.700]  hey, wait, it was different earlier in the file.
[06:06.700 --> 06:08.800]  Because you're never supposed to have a collision,
[06:08.800 --> 06:11.540]  because that's what the whole point of a hash is.
[06:11.540 --> 06:15.440]  So in mathematical terms, if MD5 of X equals MD5 of Y,
[06:15.440 --> 06:19.580]  MD5 of X plus Q, that's going to equal MD5 of Y plus Q.
[06:19.600 --> 06:22.080]  So that means if we have two files with the same hash,
[06:22.080 --> 06:26.200]  we can append anything we want to it, including webpages.
[06:26.420 --> 06:30.140]  Funny thing about web browsers, who here has written a crappy webpage?
[06:31.800 --> 06:33.100]  Thank you!
[06:33.100 --> 06:36.580]  All of you who haven't raised your hands are fucking liars.
[06:37.960 --> 06:42.520]  Web browsers accept everything. That was one of the big advances.
[06:42.520 --> 06:46.980]  You can put a turd in your fucking webpage that's going to render something.
[06:47.300 --> 06:51.680]  And it turns out we can even put these two files that have the same hash.
[06:51.680 --> 06:54.260]  But not only do they render anything,
[06:54.260 --> 06:57.980]  oh, there's a programming environment, we got JavaScript.
[06:58.040 --> 06:59.860]  Speaking of turds...
[07:02.260 --> 07:05.820]  The browsers accept everything and they are programmable.
[07:05.820 --> 07:07.300]  So this is what we're going to do.
[07:07.860 --> 07:11.060]  By the way, GraphViz is the code to use all this. It's freaking cool.
[07:11.380 --> 07:13.800]  So what we do is we take some file.
[07:14.440 --> 07:17.640]  This is X, this is Y. These are our two files with the same hash.
[07:17.640 --> 07:21.120]  We are going to prepend our file with one of these.
[07:21.200 --> 07:23.220]  And we're going to put some extra crap on.
[07:23.220 --> 07:25.920]  Remember, we can put anything on and it will have the same hash.
[07:25.920 --> 07:29.980]  Where did my mouse go? Here we are.
[07:29.980 --> 07:32.480]  Here's the first webpage, Lockheed Martin.
[07:32.480 --> 07:36.580]  Here's the second page, Boeing. And now we have some JavaScript.
[07:36.840 --> 07:42.160]  Now the idea is that MD5 is blind because all this crap is Q.
[07:42.160 --> 07:44.380]  X, Y, all this crap is Q.
[07:45.260 --> 07:49.100]  MD5 is blind but we can put a program in that isn't.
[07:49.340 --> 07:51.400]  So the program goes back and goes,
[07:51.400 --> 07:54.040]  Ah, fuck, I was put on X. Okay, Lockheed.
[07:54.040 --> 07:57.220]  Hey, look, I was put on Y. Shows Boeing.
[07:57.380 --> 07:58.640]  And that's your output.
[07:59.000 --> 08:05.920]  And so that, in a nutshell, is how Lockheed Martin and Boeing can have the same MD5 hash.
[08:12.090 --> 08:15.850]  That was a lot of stuff that had nothing to do with packets.
[08:16.070 --> 08:18.450]  Okay, I better get back to this shit.
[08:20.450 --> 08:24.670]  I need to have my little segue that's all smooth and elite and whatnot.
[08:24.670 --> 08:27.570]  You know, we're talking about interpretation.
[08:27.590 --> 08:30.890]  Speaking of other things that have to do with fucked up interpretation,
[08:30.890 --> 08:33.390]  God damn, I really should not be doing this drunk.
[08:34.810 --> 08:37.550]  You bastards, you moved my talk up.
[08:38.030 --> 08:42.170]  Alright, yes, you put my talk at the same time it said in the schedule.
[08:44.490 --> 08:46.250]  IP fragmentation, and I quote,
[08:46.250 --> 08:53.530]  Fragmentation, an interesting early architectural error that shows how much experimentation was going on while IP was being designed.
[08:53.530 --> 08:57.910]  Quote by Paul Vixie, someone who I truly expected to kick my ass when I first met him,
[08:57.910 --> 09:00.650]  but it turns out he's about as fucked up as I am.
[09:00.650 --> 09:01.510]  Sweet.
[09:02.510 --> 09:04.830]  So, what is fragmentation all about?
[09:04.830 --> 09:08.950]  Well, IP packets can be like 65 kilobytes long.
[09:09.330 --> 09:13.150]  Okay, there is no physical network that can send a 65 kilobyte packet.
[09:13.150 --> 09:16.010]  Well, okay, none that's actually used in common usage.
[09:16.010 --> 09:23.130]  So, the idea behind IP fragmentation is we can take these ginormous packets and shrink them down into little chunks.
[09:23.210 --> 09:25.250]  Fragments. It's fairly straightforward.
[09:25.670 --> 09:26.890]  Why is this a problem?
[09:27.270 --> 09:29.890]  The whole idea with IP is that it's supposed to be stateless.
[09:29.890 --> 09:32.010]  You got a packet, you send it, you move the fuck on.
[09:32.550 --> 09:36.850]  With fragments, hey, you know, you can send fragments and not have to worry about it,
[09:36.850 --> 09:39.830]  but when you receive them, you have to store these things,
[09:39.830 --> 09:44.990]  because you get one fragment and later on you might get another and another and maybe you will and maybe you won't,
[09:44.990 --> 09:47.910]  but the point is you got to keep this stuff around in RAM.
[09:47.990 --> 09:49.150]  That's annoying.
[09:49.730 --> 09:52.770]  Not just as annoying, it's about 98.
[09:52.770 --> 09:55.110]  Tim Newsham and Tom Pacek actually showed,
[09:55.510 --> 10:01.450]  look, we can get around like every IDS out there by just doing strange games with our fragmentation.
[10:01.450 --> 10:03.110]  We have overlapping fragments.
[10:03.110 --> 10:05.510]  You know, this fragment says it has the same data as that one.
[10:05.510 --> 10:08.630]  Which one is going to be, you know, what is the correct interpretation?
[10:08.630 --> 10:10.930]  The RFCs are just like, fuck if I know.
[10:10.930 --> 10:15.250]  And then FragRouter comes out and is just like, no, really, we can kick your ass.
[10:15.250 --> 10:16.090]  Here, watch.
[10:16.990 --> 10:19.290]  And so this is like 98, 99.
[10:19.290 --> 10:21.090]  This is old shit, right?
[10:21.590 --> 10:23.830]  Look, IP has been picked clean.
[10:23.830 --> 10:25.770]  There's a reason I moved on to DNS.
[10:25.770 --> 10:28.410]  Because, like, layer 3 and 4 are done.
[10:29.850 --> 10:30.970]  So I thought.
[10:32.490 --> 10:35.410]  In the crypto realm, you know, I did all this stuff with OpenSSH,
[10:35.410 --> 10:37.450]  you know, we've been dealing with timing attacks lately.
[10:37.450 --> 10:40.690]  All this crypto is all vulnerable to, like, how long things take.
[10:40.690 --> 10:41.790]  And I'm thinking about this.
[10:41.790 --> 10:44.770]  I'm going, I wonder if I can apply timing stuff to IP.
[10:44.770 --> 10:47.530]  And it turns out, oh, yes.
[10:47.670 --> 10:51.770]  It turns out there's an IP fragment reassembly timer.
[10:51.810 --> 10:54.250]  It turns out that there's only a certain amount of time.
[10:54.250 --> 10:55.710]  Are you pointing at me?
[10:55.990 --> 10:57.430]  What are you pointing at me?
[10:57.430 --> 10:58.530]  Oh, now you're the middle finger.
[10:58.530 --> 10:59.630]  What is this shit?
[11:00.850 --> 11:02.650]  Oh, I'll take this opportunity.
[11:02.810 --> 11:05.730]  So speaking of pointing, there's all these shirts that have me pointing
[11:05.730 --> 11:08.450]  that say scanran motherfucker.
[11:09.250 --> 11:11.770]  And it's done by the TorCon sluts.
[11:14.030 --> 11:15.890]  Hey, you've got a new title.
[11:15.890 --> 11:17.230]  Would you rather be a goon?
[11:17.230 --> 11:18.750]  Should have had a better t-shirt.
[11:22.670 --> 11:24.230]  TorCon is absolutely rad.
[11:24.230 --> 11:25.930]  I've loved that con for years.
[11:25.930 --> 11:27.470]  And, you know, they have these shirts for me.
[11:27.470 --> 11:31.330]  So speaking of good questions, good questions get a shirt.
[11:32.230 --> 11:34.050]  And trashed off your ass.
[11:34.550 --> 11:36.270]  What? I can't be the only one.
[11:37.030 --> 11:38.410]  So, okay, look.
[11:38.410 --> 11:40.830]  IP fragment reassembly timer.
[11:40.890 --> 11:43.710]  Basically, these fragments come in.
[11:43.770 --> 11:46.450]  And we can't reassemble the packet because we don't have all of them.
[11:46.610 --> 11:48.790]  Eventually, the system gives up, right?
[11:48.850 --> 11:52.190]  Well, how long is it going to wait before it gives up?
[11:52.190 --> 11:55.570]  Well, it turns out we can fingerprint operating systems with that value.
[11:55.570 --> 11:57.230]  You know, some things will wait 30 seconds.
[11:57.230 --> 11:58.790]  Some things will wait two minutes.
[11:58.970 --> 12:00.850]  You know, boom, OS fingerprint.
[12:00.870 --> 12:01.630]  Ooh.
[12:01.810 --> 12:02.850]  But that's easy.
[12:02.850 --> 12:03.410]  That's cheap.
[12:03.410 --> 12:05.450]  Let's go ahead and do some more hardcore stuff.
[12:05.450 --> 12:06.170]  All right.
[12:06.530 --> 12:08.530]  What if you have an IDS?
[12:08.690 --> 12:13.930]  An IDS may very well have a different idea of how long a fragment can live
[12:13.930 --> 12:16.890]  before it just gives up on trying to reassemble it.
[12:16.890 --> 12:18.470]  In fact, this is actually true.
[12:18.470 --> 12:21.190]  Linux and FreeBSD have a 30-second timer.
[12:21.190 --> 12:24.190]  Snort's frag2 timer will wait 60 seconds.
[12:24.430 --> 12:28.770]  Now, if the timer was less, if the IDS was going to keep fragments around for less time,
[12:28.770 --> 12:33.550]  well, hell, you know, we just send fragments too slow for the IDS but fast enough for the host.
[12:33.550 --> 12:35.290]  But what if it's the other way around?
[12:35.290 --> 12:42.230]  What if the IDS, because it's all hardcore and, you know, it's going to keep things around for as long as it possibly can,
[12:42.230 --> 12:45.330]  what if the IDS keeps fragments around longer?
[12:45.370 --> 12:45.950]  Ooh.
[12:45.950 --> 12:47.230]  We can do some stuff.
[12:47.550 --> 12:50.310]  The problem is, it's keeping stuff around longer.
[12:50.310 --> 12:54.070]  How are we supposed to make the host see one thing and the IDS see another?
[12:54.170 --> 12:57.850]  Well, our problem is the IDS is keeping fragments around for too long.
[12:57.850 --> 12:58.910]  Our solution?
[12:58.950 --> 13:01.390]  Make the IDS drop our fragments.
[13:01.730 --> 13:03.010]  Well, that sounds really easy.
[13:03.010 --> 13:03.830]  How are we going to do that?
[13:03.830 --> 13:09.250]  Well, there are two ways a fragment leaves the reassembly queue.
[13:09.250 --> 13:13.850]  Either A, it times out, or B, it's reassembled against something.
[13:14.010 --> 13:15.050]  Hmm.
[13:15.630 --> 13:17.170]  I like that B.
[13:17.170 --> 13:22.590]  I like the idea that it's just going to work, but not the way it plans to.
[13:23.770 --> 13:25.330]  Watch this.
[13:25.590 --> 13:26.790]  Here's what we're going to do, right?
[13:26.790 --> 13:27.390]  Look.
[13:27.390 --> 13:28.370]  Take our payload.
[13:28.370 --> 13:30.210]  Up to 65 kilobytes.
[13:30.210 --> 13:33.690]  We are going to split it into a whole bunch of fragments.
[13:33.690 --> 13:35.590]  We're going to take the even-numbered fragments.
[13:35.590 --> 13:36.650]  We're going to make a copy of them.
[13:36.650 --> 13:39.510]  And we're going to fill those fragments' payload with noise.
[13:40.230 --> 13:41.430]  Absolute crap.
[13:42.210 --> 13:45.370]  And we're going to send this absolute crap.
[13:45.390 --> 13:46.250]  And you know what we're going to do?
[13:46.250 --> 13:47.450]  We're going to wait.
[13:47.830 --> 13:49.170]  So we send the crap.
[13:49.490 --> 13:51.530]  And the host has some crap.
[13:51.550 --> 13:53.770]  And the IDS has some crap.
[13:53.810 --> 13:55.690]  But you know what happens after 30 seconds?
[13:55.690 --> 13:57.850]  The host drops the crap.
[13:57.850 --> 14:01.490]  But the IDS, it likes the crap.
[14:01.570 --> 14:03.350]  It keeps it around.
[14:03.350 --> 14:05.350]  It thinks it might be useful.
[14:05.350 --> 14:08.110]  Oh, and indeed, it is useful.
[14:08.110 --> 14:12.010]  Because we go ahead and we send the odd-numbered fragments.
[14:12.010 --> 14:16.130]  And the odd-numbered fragments go to the host, and the host has nothing.
[14:16.130 --> 14:19.490]  So the host holds on to these odd-numbered fragments and says,
[14:19.490 --> 14:22.090]  Well, you know, gotta wait for some stuff in the future.
[14:22.250 --> 14:23.610]  IDS, no.
[14:24.150 --> 14:26.490]  IDS has been holding on to some crap.
[14:26.490 --> 14:31.630]  So the IDS has crappy even and good odd.
[14:31.630 --> 14:32.570]  It reassembles.
[14:32.570 --> 14:34.510]  It's like, what the hell is this?
[14:34.570 --> 14:36.850]  And it drops it on the floor.
[14:37.650 --> 14:42.130]  Ah, but now we send the legitimate even-numbered fragments.
[14:42.670 --> 14:46.290]  And the IDS, well, it already dropped all that stuff from before on the floor,
[14:46.290 --> 14:51.810]  so the IDS now has to keep it in its cache.
[14:52.310 --> 14:53.710]  But the host?
[14:53.710 --> 14:55.550]  Host has legitimate even.
[14:55.550 --> 14:57.330]  Host has legitimate odd.
[14:57.410 --> 14:59.830]  Host reassembles just fine.
[15:00.710 --> 15:02.070]  And then you win.
[15:09.200 --> 15:11.360]  And now my favorite line.
[15:11.460 --> 15:13.620]  It gets worse.
[15:15.400 --> 15:18.160]  Right now, we're giving the IDS crap.
[15:18.380 --> 15:20.440]  Well, IDSs are meant to look for crap.
[15:20.440 --> 15:21.740]  They might alarm.
[15:21.740 --> 15:23.220]  They might be worried.
[15:23.280 --> 15:26.320]  Is there a way we can, instead of giving it crap,
[15:26.320 --> 15:29.120]  can we make the IDS see something completely different?
[15:29.120 --> 15:31.580]  You know, like, the IDS sees a get slash,
[15:31.580 --> 15:33.920]  and the host sees a SQL injection attack?
[15:34.680 --> 15:35.500]  Ooh.
[15:37.280 --> 15:38.900]  Here's what we're going to do.
[15:39.360 --> 15:42.140]  Now, get slash has some headers,
[15:42.140 --> 15:44.520]  and the SQL injection attack has some headers,
[15:44.520 --> 15:49.000]  and it turns out a fair amount of these headers can be exactly the same.
[15:49.000 --> 15:53.620]  So what we're going to do is we're going to split our stuff into three packets.
[15:53.660 --> 15:57.960]  A common header, good stuff, and you're going to die.
[15:57.960 --> 16:04.000]  And what we do is the first thing we send is, you're going to die.
[16:04.720 --> 16:05.440]  No, no, excuse me. No, no.
[16:05.880 --> 16:06.820]  That's later.
[16:06.820 --> 16:08.440]  We're going to send the good stuff first.
[16:09.180 --> 16:11.040]  Good stuff goes first.
[16:11.180 --> 16:14.020]  You know why? Because I want the IDS to see some good stuff.
[16:14.040 --> 16:16.900]  I want to give it some happy, nice feelings.
[16:17.560 --> 16:20.660]  No problem. I would never attack you.
[16:21.920 --> 16:23.200]  So here's what we're going to do.
[16:23.200 --> 16:25.660]  So we send the good stuff, and we wait.
[16:25.660 --> 16:28.480]  And we wait long enough so the host goes, fuck this good stuff.
[16:28.480 --> 16:29.600]  It drops it.
[16:29.940 --> 16:33.620]  But the IDS still has it around, and we send the shared common header,
[16:33.620 --> 16:36.000]  and the IDS goes, I got the header, and it's nice,
[16:36.000 --> 16:38.160]  and I got the good stuff, and it's nice.
[16:38.260 --> 16:43.040]  So it assembles and says, hey, this guy just asked for a git slash.
[16:43.040 --> 16:44.040]  He's cool.
[16:44.880 --> 16:49.140]  But the host still has, at this point in time, where's the host at?
[16:49.140 --> 16:50.440]  The stuff in its header.
[16:51.080 --> 16:54.800]  Just the header packet, because it already dropped the good stuff.
[16:54.800 --> 16:58.700]  But it has the header, and now we give it the evil packet.
[16:59.040 --> 17:01.980]  And what happens when the header meets the evil packet?
[17:03.240 --> 17:05.540]  Reassembles a SQL injection exploit.
[17:05.540 --> 17:06.680]  You win.
[17:09.930 --> 17:10.910]  What's up?
[17:14.310 --> 17:15.510]  Quite a few.
[17:16.750 --> 17:18.970]  So, what about checksums?
[17:20.390 --> 17:21.970]  There's a problem.
[17:21.970 --> 17:26.650]  Our hosts may actually go ahead and, you know,
[17:26.650 --> 17:30.510]  SQL injections should not have the same checksum as git slash, right?
[17:30.510 --> 17:32.290]  I mean, there's 65,000 possibilities.
[17:32.290 --> 17:34.550]  Why would the things match up?
[17:34.550 --> 17:36.750]  Well, it turns out, there's this great book.
[17:36.750 --> 17:40.370]  It's called TCPIP Lean, by this guy, Jeremy Bentham.
[17:40.470 --> 17:41.550]  It's hardcore.
[17:41.750 --> 17:43.150]  I ain't saying it's hardcore.
[17:43.150 --> 17:46.630]  Like, the guy debugs Ethernet with an oscilloscope.
[17:46.630 --> 17:48.350]  That kind of hardcore.
[17:49.270 --> 17:50.130]  So, look.
[17:50.130 --> 17:51.030]  He's got this thing.
[17:51.070 --> 17:53.510]  He's dealing with hardware that doesn't have enough RAM
[17:53.510 --> 17:57.770]  to have an entire packet in RAM at the same time.
[17:57.930 --> 17:59.530]  Holy crap!
[18:00.590 --> 18:02.850]  So, he talks about how you do this stuff.
[18:02.850 --> 18:04.890]  He says, well, you know, your checksum.
[18:04.890 --> 18:07.690]  You don't want to have to go and go over all your data.
[18:08.130 --> 18:10.530]  How do we go ahead and stream out a packet
[18:10.530 --> 18:12.670]  and not have to worry about the checksums?
[18:12.670 --> 18:15.370]  Well, the idea is you put in the wrong checksum.
[18:15.690 --> 18:17.750]  But there's a funny thing about IP checksums.
[18:17.750 --> 18:18.610]  They're crap.
[18:19.430 --> 18:20.130]  They are.
[18:20.130 --> 18:20.850]  They really suck.
[18:20.850 --> 18:21.950]  They're just a one's compliment.
[18:21.950 --> 18:23.810]  They're just like adding numbers, right?
[18:23.950 --> 18:25.770]  So, there's a really funny thing you can do.
[18:26.050 --> 18:28.070]  At the end of your payload,
[18:28.070 --> 18:31.210]  you can be like, wow, I'm like 32,000 off
[18:31.210 --> 18:32.910]  from what my checksum should be.
[18:32.990 --> 18:35.690]  And so, you like, you know, add a little bit of a comment.
[18:35.810 --> 18:37.730]  Fix by 32,000.
[18:38.130 --> 18:39.430]  And it works.
[18:40.150 --> 18:41.310]  So, you just do that,
[18:41.310 --> 18:44.150]  and now you're going to have a constant checksum
[18:44.150 --> 18:46.710]  for different payloads.
[18:47.550 --> 18:50.490]  We can actually backport this attack
[18:50.490 --> 18:52.550]  to all the original mechanisms
[18:52.550 --> 18:55.110]  used by PatchEck and Nooshum and Song.
[18:55.110 --> 18:56.630]  And it turns out what we can do,
[18:56.630 --> 18:58.010]  and I haven't built this one yet
[18:58.010 --> 19:00.630]  because I really fucked up my arm.
[19:00.630 --> 19:02.230]  Be happy I'm here at all.
[19:03.350 --> 19:05.510]  But it turns out you could actually send
[19:05.690 --> 19:07.150]  a series of packets such that
[19:07.150 --> 19:10.690]  on Linux, they assemble into a Linux exploit.
[19:10.690 --> 19:13.430]  And on Windows, they assemble into a Windows exploit.
[19:13.430 --> 19:16.190]  And all because there's a whole bunch of different ways
[19:16.190 --> 19:19.430]  that IP stacks can reorganize data.
[19:19.450 --> 19:21.670]  And you could actually, and I haven't built this yet,
[19:21.670 --> 19:22.810]  and I'm fully honest,
[19:22.810 --> 19:25.210]  you could actually create a sequence of packets
[19:25.210 --> 19:27.890]  such that when they arrive on the host,
[19:27.890 --> 19:29.970]  the particular host being used
[19:29.970 --> 19:31.650]  will reassemble it into a way
[19:31.650 --> 19:34.270]  that is relevant for that host.
[19:34.270 --> 19:36.750]  And you don't even need to get any kind of feedback back.
[19:36.750 --> 19:37.710]  It's kind of cool.
[19:38.510 --> 19:40.330]  Now, hitting the brakes.
[19:40.330 --> 19:42.050]  There's a couple IPS vendors out there
[19:42.050 --> 19:43.950]  who are like, dude, you're full of crap.
[19:43.950 --> 19:46.130]  Because our stuff is going to see you,
[19:46.130 --> 19:48.230]  it's going to see these overlapping fragments,
[19:48.230 --> 19:49.350]  we're going to deal with you,
[19:49.350 --> 19:51.730]  and we're going to shut your session down.
[19:51.950 --> 19:54.130]  Shut my session down, that's not nice.
[19:54.430 --> 19:56.110]  And not only is it not nice,
[19:56.110 --> 19:57.050]  there's not a lot of people
[19:57.050 --> 19:58.610]  who are going to be able to do that.
[19:58.610 --> 20:00.030]  That's really unique.
[20:00.850 --> 20:01.290]  And...
[20:03.690 --> 20:05.670]  Some jackasses, actually.
[20:05.850 --> 20:08.710]  Complete and utter fucking jackasses.
[20:11.230 --> 20:13.050]  Alright, no, I'm kidding.
[20:14.530 --> 20:15.650]  Anyway.
[20:17.310 --> 20:19.870]  Look, there's a funny little thing
[20:19.870 --> 20:22.170]  that happens when you block a session.
[20:22.930 --> 20:25.250]  You send a bit of information.
[20:25.310 --> 20:27.490]  I blocked you, I stopped you,
[20:27.490 --> 20:28.710]  I got in your way,
[20:28.710 --> 20:29.830]  I'm telling you I'm here
[20:29.830 --> 20:31.450]  and I'm getting in your way.
[20:31.570 --> 20:34.450]  Yo, that's a fingerprint.
[20:35.390 --> 20:37.670]  It turns out that anytime
[20:37.670 --> 20:39.110]  an intrusion detection system
[20:39.110 --> 20:40.850]  or a firewall gets in your way,
[20:40.850 --> 20:43.030]  it has actually identified itself.
[20:43.030 --> 20:44.810]  Because there's about a million different ways
[20:44.810 --> 20:47.010]  that these things can go ahead.
[20:47.070 --> 20:48.430]  Do they block invalid checksums?
[20:48.430 --> 20:49.670]  Do they block invalid options?
[20:49.670 --> 20:51.270]  Do they block invalid ICMP types?
[20:51.270 --> 20:52.290]  How about HTTP?
[20:52.290 --> 20:53.330]  How about SQL injection?
[20:53.330 --> 20:54.810]  How about SQL injection of this type?
[20:54.810 --> 20:56.530]  How about invalid DNS packets?
[20:56.530 --> 20:58.230]  How about tipping point?
[20:58.230 --> 21:00.710]  Oh, you sent a TCP fragment out of order.
[21:00.710 --> 21:02.150]  We're going to drop you on the floor
[21:02.150 --> 21:04.210]  because we don't like RFCs.
[21:04.210 --> 21:05.770]  They're overrated.
[21:06.950 --> 21:08.110]  Or checkpoint.
[21:08.110 --> 21:09.870]  Oh, you're using DNSSEC.
[21:09.870 --> 21:11.690]  That's never going to be feasible.
[21:11.690 --> 21:14.030]  Point is, you can go ahead and identify
[21:14.030 --> 21:15.630]  pretty much every firewall
[21:15.630 --> 21:17.230]  and every intrusion protection system
[21:17.230 --> 21:19.850]  based on whether, in a given session,
[21:19.850 --> 21:21.590]  if you do something it doesn't like,
[21:21.590 --> 21:23.210]  if it kills your session.
[21:23.290 --> 21:25.990]  And it turns out you can find out the precise hop
[21:25.990 --> 21:28.250]  that the IDS and IPS is at
[21:28.250 --> 21:31.190]  by using Mike Schiffman's firewalk method.
[21:31.190 --> 21:33.370]  Which is basically, you go ahead
[21:33.370 --> 21:34.730]  and you send your nastiest off
[21:34.730 --> 21:36.390]  one hop before the firewall
[21:36.390 --> 21:38.730]  and then you send it one hop after.
[21:38.730 --> 21:40.790]  If your session dies one hop after,
[21:40.790 --> 21:43.430]  you know the hop where the firewall lives at.
[21:43.770 --> 21:45.790]  Hi, how you doing?
[21:45.830 --> 21:47.670]  Not that this is anything wildly new.
[21:47.670 --> 21:49.790]  This is a slide from like 2003.
[21:50.250 --> 21:52.170]  And it basically shows you
[21:52.170 --> 21:54.330]  how you detect a PIX firewall.
[21:54.690 --> 21:57.350]  And I'm not giving any details,
[21:57.350 --> 21:58.630]  but if anyone ever tells you
[21:58.630 --> 22:01.670]  it's ever impossible to remotely detect a firewall,
[22:01.670 --> 22:04.070]  dude, I've been doing it for like two years.
[22:04.910 --> 22:07.550]  So I can't say what that's in reference to,
[22:07.550 --> 22:09.610]  but you can always detect
[22:09.850 --> 22:11.270]  a firewall remotely.
[22:11.270 --> 22:12.970]  There's just too many different variations
[22:12.970 --> 22:15.250]  on how the protocol can be broken.
[22:16.390 --> 22:16.910]  So...
[22:17.710 --> 22:19.270]  IP shunning.
[22:19.410 --> 22:21.770]  Turns out, a bunch of intrusion protection systems,
[22:21.770 --> 22:23.970]  they are, they're acting all hardcore.
[22:23.970 --> 22:25.730]  You mess with them a little too much,
[22:25.730 --> 22:27.610]  they're going to block your IP entirely
[22:28.130 --> 22:28.770]  because they're like,
[22:28.770 --> 22:31.110]  well obviously your IP is evil.
[22:31.310 --> 22:33.510]  And, you know, it's not like anyone
[22:33.510 --> 22:36.210]  ever spoofs IP addresses.
[22:36.470 --> 22:37.970]  Lies about who they are.
[22:37.970 --> 22:40.270]  Oh, nobody ever does that.
[22:40.450 --> 22:41.850]  Let me tell you why it's a really
[22:41.850 --> 22:44.110]  bad idea to block traffic
[22:44.110 --> 22:45.850]  that comes from random IP addresses
[22:45.850 --> 22:47.650]  on the internet. Anyone ever type
[22:47.650 --> 22:49.530]  dig? You know, that whole like
[22:49.530 --> 22:52.330]  domain internet grouper DNS thing?
[22:52.330 --> 22:54.010]  Here's a couple hosts, you might have heard
[22:54.010 --> 22:55.910]  of them, they're called the root servers.
[22:56.030 --> 22:58.430]  If you can't talk to them, you're fucked.
[23:05.810 --> 23:07.490]  So like anyone who's running
[23:07.490 --> 23:09.370]  these IPS's is like, hello
[23:09.370 --> 23:11.410]  internet, here is my
[23:11.410 --> 23:13.330]  firewall rule set, would you like
[23:13.330 --> 23:15.510]  to submit new rules?
[23:16.010 --> 23:17.370]  By any chance, would you
[23:17.370 --> 23:19.330]  like to knock my stuff down?
[23:19.330 --> 23:20.310]  We'll talk after.
[23:20.950 --> 23:22.710]  It's like, seriously?
[23:23.190 --> 23:25.310]  Now, you know, I'm showing this stuff
[23:25.310 --> 23:27.430]  and yeah, you can knock out any of these networks by just
[23:27.430 --> 23:29.150]  like, you know, hi, I'm 128
[23:29.150 --> 23:30.690]  810 90.
[23:31.110 --> 23:33.490]  I'm trying to slammer you.
[23:36.150 --> 23:37.450]  But oh,
[23:38.050 --> 23:40.030]  I can't stop here.
[23:40.390 --> 23:41.950]  I can't stop here, because it is
[23:41.950 --> 23:44.290]  too large scale, and more importantly,
[23:44.290 --> 23:46.050]  I thought it was all cool, but it's
[23:46.050 --> 23:48.090]  been whispered about for years.
[23:48.650 --> 23:50.070]  And you know, I can't go ahead and take
[23:50.070 --> 23:51.490]  full credit for something people have been
[23:51.490 --> 23:53.530]  talking about, so let's do a little bit
[23:53.530 --> 23:55.890]  more elegant attack.
[23:55.930 --> 23:58.110]  Again, it gets worse.
[23:59.370 --> 24:01.630]  I've been investigating DNS poisoning.
[24:01.630 --> 24:02.750]  I've been investigating a lot.
[24:02.750 --> 24:04.710]  Does anyone here know,
[24:04.710 --> 24:06.750]  oh, hang on, we'll deal with that later.
[24:06.790 --> 24:09.410]  But I've been investigating DNS poisoning quite a bit.
[24:09.670 --> 24:11.370]  Four billion packets, quite a bit.
[24:12.410 --> 24:14.890]  Is it possible, given these networks
[24:14.890 --> 24:16.550]  that implement automatic network
[24:16.550 --> 24:18.850]  shunning, to not just like, knock them
[24:18.850 --> 24:20.730]  off the network, but to poison
[24:20.730 --> 24:22.710]  their name servers, to go ahead and
[24:22.710 --> 24:25.610]  redirect traffic from their network arbitrarily?
[24:25.790 --> 24:27.210]  Oh, yeah.
[24:27.850 --> 24:28.590]  Well,
[24:28.590 --> 24:29.930]  there's a funny thing.
[24:29.930 --> 24:31.850]  I showed you before, we will block you
[24:31.850 --> 24:34.330]  from the name servers. And that's nice.
[24:34.330 --> 24:35.730]  But let's do worse.
[24:35.730 --> 24:37.970]  Let's block them from individual name
[24:37.970 --> 24:39.870]  servers. Not the root, but
[24:39.870 --> 24:42.710]  say, hey, large ISP,
[24:42.710 --> 24:43.990]  see that big bank all your
[24:43.990 --> 24:46.430]  customers go to? Yeah,
[24:46.430 --> 24:48.310]  we don't want them to do that.
[24:48.450 --> 24:49.690]  And how can you do that? Well,
[24:49.690 --> 24:52.050]  block the communication between
[24:52.050 --> 24:53.890]  the name server at the
[24:53.890 --> 24:55.870]  ISP and the name server
[24:55.870 --> 24:57.990]  at the bank. And there are
[24:57.990 --> 24:59.790]  two sides you can do the blocking.
[24:59.790 --> 25:00.370]  You can cause the
[25:04.590 --> 25:05.010]  ISP...
[25:05.010 --> 25:06.070]  God damn!
[25:19.610 --> 25:20.110]  Humberdink,
[25:20.110 --> 25:21.570]  I believe I am out.
[25:23.050 --> 25:24.070]  Hey, I drank
[25:24.070 --> 25:25.610]  everything that was there. I think you need
[25:25.730 --> 25:26.410]  a drink.
[25:27.930 --> 25:29.590]  So, there are, you can
[25:29.590 --> 25:31.510]  block at the ISP side, you can block
[25:31.510 --> 25:33.750]  at the bank side. Both ways.
[25:33.750 --> 25:33.850]  Humberdink,
[25:38.930 --> 25:39.810]  no.
[25:43.570 --> 25:44.110]  So,
[25:44.110 --> 25:46.550]  only if I really screw up.
[25:47.550 --> 25:48.370]  In which case,
[25:48.370 --> 25:50.430]  you are having a shot with me up here.
[25:51.190 --> 25:51.690]  So,
[25:52.290 --> 25:54.290]  general theme is to block communication between
[25:54.290 --> 25:56.170]  any two name servers. You can block at either the server
[25:56.170 --> 25:57.450]  or the client side.
[25:58.510 --> 26:00.250]  All right, let's say you spoof
[26:00.250 --> 26:02.170]  malicious traffic from the client network
[26:02.170 --> 26:04.150]  to the server network. So, say, the big
[26:04.150 --> 26:05.950]  bank no longer likes podunk
[26:05.950 --> 26:08.050]  ISP. All right?
[26:08.050 --> 26:09.930]  That means podunk ISP
[26:09.930 --> 26:11.970]  sending out requests and
[26:11.970 --> 26:14.370]  nothing's coming back.
[26:14.430 --> 26:16.050]  All right? You know, let's think
[26:16.050 --> 26:17.750]  about that for a second. We got about,
[26:18.350 --> 26:20.030]  assuming a fixed port, we'll talk about
[26:20.030 --> 26:21.490]  that in a second. We got about
[26:21.490 --> 26:24.030]  65,000 possibilities for what the
[26:24.030 --> 26:25.870]  transaction ID is going to be. The
[26:25.870 --> 26:28.090]  transaction ID, of course, controls whether
[26:28.090 --> 26:30.330]  or not when I spoof a packet,
[26:30.330 --> 26:31.970]  it actually is going to get blindly
[26:31.970 --> 26:34.210]  accepted. Well, kind of
[26:34.210 --> 26:36.390]  funny, is usually it's called a
[26:36.390 --> 26:38.190]  race condition. I would have to
[26:38.190 --> 26:40.630]  get my fake
[26:40.630 --> 26:42.470]  reply back before the real reply
[26:42.470 --> 26:44.170]  comes back. But you know what happens
[26:44.170 --> 26:46.710]  when the intrusion protection systems are in place?
[26:46.710 --> 26:49.190]  Well, it's a race, but I
[26:49.450 --> 26:50.430]  took a bat and knocked
[26:50.430 --> 26:52.330]  out the other guy's kneecap, so he's
[26:52.330 --> 26:55.290]  not running anymore.
[26:55.290 --> 26:56.370]  So, I got about an average
[26:56.370 --> 26:58.150]  of 32,000 packets to do
[26:58.150 --> 27:00.270]  and instead of about 100 milliseconds,
[27:00.270 --> 27:02.410]  I can do it, like, about
[27:02.410 --> 27:04.370]  as long as I freaking want.
[27:05.470 --> 27:06.990]  Moral of the story,
[27:06.990 --> 27:08.370]  do not automatically
[27:08.370 --> 27:10.010]  shun IPs.
[27:10.010 --> 27:12.630]  But, you know, I can do the other side.
[27:12.650 --> 27:14.170]  I can also spoof malicious traffic
[27:14.170 --> 27:16.510]  from the server network to the client network.
[27:16.510 --> 27:18.450]  So, you know, use some podunk ISP and it's like,
[27:18.450 --> 27:20.250]  holy crap, the bank is trying to
[27:20.250 --> 27:21.250]  kill me!
[27:21.650 --> 27:23.950]  I paid my loan, man!
[27:24.670 --> 27:26.450]  Well, so, there's a
[27:26.450 --> 27:28.210]  little difference here, because you'd think
[27:28.210 --> 27:30.270]  if the ISP is no longer talking to
[27:30.270 --> 27:32.150]  the bank, well, you know, the ISP sends out
[27:32.150 --> 27:34.170]  the request and the reply comes back and the reply
[27:34.170 --> 27:35.810]  is blocked. But,
[27:35.810 --> 27:38.290]  if the reply, you know, you think, well,
[27:38.290 --> 27:39.930]  when I spoof stuff,
[27:39.930 --> 27:42.070]  it also has to be blocked, right?
[27:43.070 --> 27:44.250]  Funny thing about
[27:44.250 --> 27:46.570]  IP, there's no affinity.
[27:46.750 --> 27:48.050]  And by that I mean,
[27:48.050 --> 27:50.010]  IP addresses, you know, you can actually
[27:50.010 --> 27:52.250]  return a DNS, when you send out a
[27:52.250 --> 27:54.350]  DNS request, about 15%
[27:54.350 --> 27:56.490]  of the time some other guy replies.
[27:56.490 --> 27:58.150]  And it works.
[27:58.710 --> 28:00.310]  So that means, the legitimate
[28:00.310 --> 28:02.410]  host can't send you back replies, but
[28:02.410 --> 28:04.530]  the entire internet can be spoofing
[28:04.530 --> 28:06.150]  replies back.
[28:06.150 --> 28:08.670]  And they'll all work if their transaction
[28:08.670 --> 28:10.390]  ID is correct.
[28:10.770 --> 28:12.450]  Oops. Again,
[28:12.450 --> 28:14.590]  do not implement automated network
[28:14.590 --> 28:15.570]  shunning.
[28:16.070 --> 28:18.410]  But there are people who like it, and I'll go
[28:18.410 --> 28:20.490]  ahead and I'll say, okay, make sure
[28:20.490 --> 28:22.530]  you can talk to name servers,
[28:22.530 --> 28:24.330]  see if you can make it so your outbound
[28:24.330 --> 28:26.570]  communications override any automatic
[28:26.570 --> 28:28.470]  shunning. And, you know, again,
[28:28.470 --> 28:30.670]  do not touch name servers.
[28:31.130 --> 28:32.330]  But seriously,
[28:32.330 --> 28:34.390]  don't do this stuff. There's just 80
[28:34.390 --> 28:36.750]  million ways that automatic shunning,
[28:36.750 --> 28:38.050]  you're giving,
[28:38.050 --> 28:40.350]  they're giving you guys access to their firewall
[28:40.350 --> 28:42.950]  table. What is wrong with these people?
[28:43.570 --> 28:44.950]  So don't do that.
[28:46.130 --> 28:47.510]  Go to the next slide.
[28:47.590 --> 28:48.490]  But what about complaint
[28:48.490 --> 28:50.290]  emails? You know,
[28:50.290 --> 28:52.550]  funny thing, you know, often they get assigned complaint emails
[28:52.550 --> 28:54.710]  and they negotiate and find out this stuff's going on.
[28:54.710 --> 28:56.850]  Well, funny thing happens when you block someone's
[28:56.850 --> 28:58.550]  name server. You can't send mail
[28:58.550 --> 29:00.170]  to that domain anymore.
[29:00.690 --> 29:01.730]  Oops.
[29:02.250 --> 29:05.410]  Now, what would I know about complaints?
[29:05.410 --> 29:06.670]  Well, when you send
[29:06.670 --> 29:08.730]  4 billion IP packets,
[29:08.730 --> 29:10.870]  people can tend to notice.
[29:11.970 --> 29:12.570]  I've been
[29:12.570 --> 29:15.090]  working with these guys called Prolexic.
[29:15.250 --> 29:15.710]  And...
[29:17.790 --> 29:19.430]  God damn it.
[29:27.020 --> 29:28.460]  All right, look.
[29:28.640 --> 29:30.660]  So, basically,
[29:30.660 --> 29:31.080]  you know how you have these
[29:31.080 --> 29:33.740]  third-party spam filters?
[29:33.740 --> 29:34.920]  They get your mail and
[29:35.480 --> 29:37.280]  they send you the good stuff?
[29:37.300 --> 29:39.020]  These guys do that for IP.
[29:39.300 --> 29:40.780]  They announce your route and
[29:40.780 --> 29:42.600]  they take all the crap that you guys send
[29:42.600 --> 29:44.700]  and be like, that's a very nice
[29:44.700 --> 29:46.960]  10 gig UDP flood. I'm going to
[29:46.960 --> 29:48.780]  filter that. These guys have just
[29:48.780 --> 29:50.600]  ridiculous amounts of extra bandwidth
[29:50.600 --> 29:52.240]  and they gave it to me.
[29:53.780 --> 29:54.460]  I've never
[29:54.460 --> 29:56.480]  actually been able to, like,
[29:56.480 --> 29:58.760]  I can't send packets faster
[29:58.760 --> 30:00.820]  than this network can route them.
[30:00.820 --> 30:02.880]  I feel like less of a man.
[30:04.440 --> 30:04.980]  I've been
[30:04.980 --> 30:06.500]  working with all sorts of cool people
[30:06.500 --> 30:08.560]  and, you know, I've been doing
[30:08.560 --> 30:10.840]  all sorts of stuff to be all legitimate.
[30:10.840 --> 30:12.660]  You know, don't do this
[30:12.660 --> 30:15.200]  at home. Your colo will die.
[30:15.720 --> 30:16.780]  I tried.
[30:16.780 --> 30:18.520]  It was out in an hour.
[30:18.520 --> 30:20.040]  You will get complaints
[30:20.040 --> 30:22.440]  and very scary people
[30:22.440 --> 30:24.500]  will be calling you personally and be like, what the
[30:24.500 --> 30:26.020]  hell are you doing?
[30:26.180 --> 30:28.220]  So seriously, I can't emphasize
[30:28.220 --> 30:30.280]  this enough. I'm doing this because
[30:30.280 --> 30:32.340]  there's a little problem with, you know,
[30:32.340 --> 30:34.140]  large scale network attackers having better
[30:34.140 --> 30:36.720]  intelligence on the network than I do.
[30:36.760 --> 30:37.900]  That's not cool.
[30:38.740 --> 30:40.480]  But yeah, don't do this at home.
[30:40.920 --> 30:42.160]  I've set up, you know, reverse
[30:42.160 --> 30:44.640]  lookups. I'm in Aaron.
[30:45.500 --> 30:46.500]  There's Dan Kaminski
[30:46.500 --> 30:49.220]  security research. How rad is that?
[30:50.300 --> 30:50.580]  Like
[30:50.580 --> 30:52.420]  abuse mails. Someone has hacked
[30:52.420 --> 30:54.580]  in your box. Dude, that's
[30:54.580 --> 30:55.320]  me.
[30:57.780 --> 30:58.600]  So yeah,
[30:58.600 --> 31:00.420]  you know, oh, best email is like, you know,
[31:00.420 --> 31:02.320]  thank you for your information.
[31:02.480 --> 31:04.100]  We will see you in Vegas.
[31:04.100 --> 31:06.820]  Like, oh, crap. Handcuffs.
[31:09.380 --> 31:09.960]  So,
[31:09.960 --> 31:10.600]  what do I
[31:10.600 --> 31:12.260]  want to do? I wanted to go ahead and find, you know,
[31:12.260 --> 31:14.680]  Google's taken out by some DNS poisoning attack.
[31:14.680 --> 31:16.760]  You know, who is actually hit by this
[31:16.760 --> 31:19.000]  thing? So, you know, we scan the world,
[31:19.000 --> 31:20.900]  the entire world, and we find
[31:20.900 --> 31:22.800]  somewhere between, we find actually
[31:22.800 --> 31:25.060]  9 million name servers,
[31:25.060 --> 31:26.980]  but after the scan, only about 2.5
[31:26.980 --> 31:29.320]  million of them would actually talk to me.
[31:31.440 --> 31:32.560]  Shit.
[31:33.360 --> 31:34.680]  Um,
[31:35.880 --> 31:37.000]  I needed
[31:37.000 --> 31:38.780]  to find, because it turns out you had
[31:38.780 --> 31:40.620]  to have a Microsoft server talking to
[31:40.920 --> 31:42.560]  a Windows server.
[31:42.560 --> 31:44.500]  No, excuse me, Microsoft server talking
[31:44.500 --> 31:46.120]  God damn it.
[31:50.740 --> 31:51.740]  Okay, the problem
[31:51.740 --> 31:54.240]  with this plan is, like, the more I drink,
[31:54.240 --> 31:55.980]  the more mistakes I'll make.
[31:57.060 --> 31:57.980]  Okay, so,
[31:57.980 --> 32:00.260]  I'm totally getting that ever clear.
[32:00.980 --> 32:01.980]  So, look,
[32:01.980 --> 32:03.660]  you have to have Windows servers who are linking
[32:03.660 --> 32:06.000]  to bind date servers.
[32:06.000 --> 32:08.160]  Fairly obscure situation, right?
[32:08.360 --> 32:10.120]  Um, okay.
[32:10.120 --> 32:11.800]  Well, how do we find that one server is
[32:11.800 --> 32:13.840]  linking to another? By linking, I mean, instead
[32:13.840 --> 32:15.680]  of going out and resolving it itself,
[32:15.680 --> 32:17.420]  it asks its buddy.
[32:17.720 --> 32:19.480]  How do we find these links?
[32:19.840 --> 32:21.260]  And, um,
[32:21.260 --> 32:23.960]  the way that I ended up using is basically
[32:23.960 --> 32:25.380]  to just ask
[32:25.860 --> 32:27.880]  everyone, hey, you know,
[32:27.880 --> 32:29.900]  hey you, go ahead, you know, what's your name?
[32:29.900 --> 32:31.740]  Your name's Bob? Go ahead and look up
[32:31.740 --> 32:33.740]  bob.madness.net
[32:33.740 --> 32:35.780]  and madness is a domain I own.
[32:35.860 --> 32:38.340]  If some guy named Charlie walks up to me,
[32:38.340 --> 32:39.700]  okay, I know Bob
[32:39.700 --> 32:41.500]  asked Charlie to look something up.
[32:41.500 --> 32:43.640]  So I know there's a link between those two domains
[32:43.640 --> 32:46.180]  and those name servers. That's how I did it.
[32:46.640 --> 32:48.280]  What were the end results?
[32:48.760 --> 32:49.460]  Um, well, we got about
[32:49.460 --> 32:51.740]  two and a half million verified name servers,
[32:51.740 --> 32:53.600]  meaning, um, they would still talk to
[32:53.600 --> 32:55.580]  me. And, uh, of
[32:55.580 --> 32:57.540]  those two and a half million, we
[32:58.220 --> 32:59.180]  used a tool called
[32:59.180 --> 33:01.180]  fpDNS, fingerprint DNS,
[33:01.180 --> 33:03.500]  and we fingerprinted every single
[33:03.500 --> 33:04.560]  one of them.
[33:05.320 --> 33:08.020]  Ooh, I got some emails out of that one.
[33:08.560 --> 33:09.840]  Ooh, crap.
[33:09.840 --> 33:12.000]  There are a lot of IDSs that are like,
[33:12.000 --> 33:14.020]  you tried to check version.
[33:14.020 --> 33:16.660]  How could you possibly do that?
[33:16.660 --> 33:17.180]  You know,
[33:17.690 --> 33:19.620]  your attack is detected by
[33:20.880 --> 33:21.380]  100%.
[33:22.660 --> 33:23.700]  You know it
[33:23.700 --> 33:25.100]  without fail.
[33:26.120 --> 33:27.820]  Like, seriously, people did not
[33:27.820 --> 33:29.680]  like it. But you know what? We're dealing with
[33:29.680 --> 33:31.580]  security and, um, you know, we found about
[33:31.580 --> 33:33.920]  230,000 hosts that are
[33:33.920 --> 33:35.400]  possibly broken,
[33:35.400 --> 33:37.660]  13,000 that are definitely broken,
[33:37.660 --> 33:39.620]  and you know what? I'm going to be sending
[33:39.620 --> 33:41.740]  some emails. And we're going to get
[33:41.740 --> 33:44.020]  this problem dealt with.
[33:44.240 --> 33:45.740]  And incidentally, uh,
[33:45.740 --> 33:48.200]  scan was done in under a day.
[33:48.480 --> 33:49.660]  It's good to be the author of
[33:49.660 --> 33:51.560]  scanrand. I send packets fast.
[33:51.680 --> 33:53.400]  Fuck yeah. Oh, oh,
[33:53.400 --> 33:55.140]  who said that?
[33:55.920 --> 33:57.100]  Who said that? Oh.
[33:57.900 --> 33:59.640]  Hell yeah. Well, maybe
[33:59.640 --> 34:01.660]  not. Hey, someone get him
[34:01.660 --> 34:02.600]  that shirt.
[34:04.700 --> 34:05.420]  Um,
[34:05.920 --> 34:07.560]  I'm not replying.
[34:08.540 --> 34:09.780]  So look,
[34:09.780 --> 34:12.140]  kind of, uh, reversing the thing.
[34:12.160 --> 34:13.420]  Normally with an exploit, you're like,
[34:13.420 --> 34:15.560]  I've got this box. I wonder what it's
[34:15.560 --> 34:17.440]  vulnerable to. Reverse.
[34:17.440 --> 34:19.200]  Um, I wonder if someone
[34:19.200 --> 34:22.140]  fucked this up. Let's ask everyone.
[34:23.140 --> 34:24.060]  So I'm like,
[34:24.060 --> 34:25.100]  you know, I wonder,
[34:25.100 --> 34:27.540]  you know, there's these transaction IDs
[34:27.540 --> 34:29.460]  and if there's a known transaction ID,
[34:29.460 --> 34:31.220]  you can DNS spoof on demand.
[34:31.220 --> 34:33.500]  I wonder, is anyone
[34:33.500 --> 34:35.380]  using the same transaction ID
[34:35.380 --> 34:37.000]  when I make a request,
[34:37.000 --> 34:38.960]  when they go out to the outside world,
[34:38.960 --> 34:40.860]  does anyone use the same thing?
[34:40.860 --> 34:43.980]  Because that'd be really insecure. That'd be dumb.
[34:43.980 --> 34:45.720]  You'd have to be like, you know,
[34:45.720 --> 34:47.640]  one in a hundred thousand to be this
[34:47.640 --> 34:49.520]  dumb. But there's a funny thing
[34:49.520 --> 34:51.620]  that happens when you ask two and a half million
[34:51.620 --> 34:53.540]  people a question. You find
[34:53.540 --> 34:55.360]  the dumb ones.
[34:55.820 --> 34:57.620]  So there's like, uh, so we asked
[34:57.620 --> 34:59.780]  everyone with a fixed, you know, transaction ID.
[34:59.780 --> 35:01.140]  I had the data anyway.
[35:01.140 --> 35:02.740]  And we found about
[35:02.740 --> 35:05.040]  110 hosts that are
[35:05.040 --> 35:07.360]  dumb. And of these 110
[35:07.360 --> 35:08.680]  hosts, it's
[35:08.680 --> 35:10.920]  major vendors
[35:10.920 --> 35:12.520]  ADSL modem, so
[35:12.520 --> 35:15.240]  wow, look at all these networks I can completely own
[35:15.240 --> 35:16.500]  on demand.
[35:16.700 --> 35:18.920]  And the name server
[35:18.920 --> 35:20.880]  that I was using to host
[35:20.880 --> 35:22.320]  my own data.
[35:24.830 --> 35:26.750]  God dammit.
[35:26.750 --> 35:28.670]  In my defense, it was an old
[35:28.670 --> 35:31.230]  version, but oh yeah.
[35:34.200 --> 35:34.760]  So...
[35:34.760 --> 35:36.220]  Oh, fuck that.
[35:38.770 --> 35:40.190]  God dammit.
[35:42.670 --> 35:43.790]  Speaking of...
[35:43.790 --> 35:44.910]  You fucking
[35:44.910 --> 35:46.250]  assholes, I need to do the
[35:46.250 --> 35:47.590]  drinking game.
[35:48.150 --> 35:50.210]  Alright. I'm liking this.
[35:50.210 --> 35:52.090]  I may do all my talks smashed.
[35:53.950 --> 35:55.150]  Hello, sir.
[35:55.150 --> 35:56.590]  I'm drunk.
[35:57.430 --> 35:58.270]  I don't know
[35:58.270 --> 36:00.550]  how we never noticed this before.
[36:02.010 --> 36:02.690]  You know
[36:02.690 --> 36:05.050]  on TCP you can scan for servers?
[36:05.470 --> 36:06.570]  Well, UDP is a little
[36:06.570 --> 36:08.650]  different. There really is no difference between
[36:08.810 --> 36:10.270]  a client and a server.
[36:10.790 --> 36:12.870]  How did we not realize until 2005
[36:12.870 --> 36:14.570]  that you can scan for client
[36:14.570 --> 36:16.270]  ports as well?
[36:16.470 --> 36:18.750]  Name servers very often have
[36:18.750 --> 36:20.770]  fixed ports that they send all their requests
[36:20.770 --> 36:22.550]  from. They use a single socket.
[36:22.810 --> 36:24.770]  And it turns out, you can
[36:24.770 --> 36:26.930]  scan for this client socket.
[36:26.930 --> 36:28.670]  You can find out who they're sending requests
[36:28.670 --> 36:30.610]  out to. And I'm like, well, what
[36:30.610 --> 36:32.670]  are these ports? I bet there's lots of servers
[36:32.670 --> 36:34.930]  that send out questions from a
[36:34.930 --> 36:36.730]  source port of 53.
[36:36.730 --> 36:38.990]  But you see, that's, I think, the nice
[36:38.990 --> 36:41.410]  thing about having ASLO to data
[36:41.410 --> 36:43.210]  is you can know.
[36:43.210 --> 36:45.090]  Let's look at the data.
[36:45.090 --> 36:47.470]  Oh, look at that.
[36:47.470 --> 36:49.050]  823,000 times
[36:49.050 --> 36:51.750]  the source port was 32,768
[36:51.750 --> 36:54.730]  on an outgoing request.
[36:54.730 --> 36:55.830]  And 195,000
[36:55.830 --> 36:58.730]  times it was 32,769.
[36:58.730 --> 36:59.090]  And 54,000
[36:59.090 --> 37:01.130]  times, oh, you're telling me
[37:01.130 --> 37:03.150]  on a large portion of the internet infrastructure
[37:03.150 --> 37:05.410]  I can monitor load levels
[37:05.410 --> 37:07.530]  on remote name servers?
[37:07.810 --> 37:08.930]  Sweet.
[37:10.350 --> 37:11.090]  So, um,
[37:11.090 --> 37:13.110]  yeah, you should be running
[37:13.250 --> 37:15.070]  a name server that actually buries its
[37:15.070 --> 37:16.270]  local port.
[37:16.810 --> 37:19.110]  Other stuff, there's like a 15 minute chunk
[37:19.110 --> 37:21.590]  of DNS poisoning things I can't tell you about.
[37:21.590 --> 37:23.190]  But holy crap, someone's up
[37:23.190 --> 37:24.630]  to some nasty shit.
[37:24.950 --> 37:26.070]  Wow.
[37:26.070 --> 37:28.250]  And I wasn't even looking for it.
[37:28.250 --> 37:29.890]  It just accidentally came back.
[37:29.890 --> 37:32.350]  Hey, by the way, we're spoofing these guys.
[37:32.650 --> 37:34.150]  You're what?
[37:35.110 --> 37:36.250]  And it turns out
[37:36.250 --> 37:38.310]  there's all these systems that automatically
[37:38.310 --> 37:40.110]  investigate what the hell you're doing
[37:40.110 --> 37:42.070]  when you are sending 4 billion
[37:42.070 --> 37:44.030]  packets, but when they investigate
[37:44.030 --> 37:45.750]  they have no idea that the investigation
[37:45.750 --> 37:47.470]  comes back to you.
[37:47.630 --> 37:50.070]  So I've got traffic from really, really
[37:50.070 --> 37:52.730]  dark networks where it's just like,
[37:52.730 --> 37:54.310]  hi, there's no one within
[37:54.310 --> 37:56.530]  the rest of my class A,
[37:56.530 --> 37:58.310]  but who are you?
[37:59.830 --> 38:00.970]  No, no, no, no, no.
[38:00.970 --> 38:02.450]  Who are you?
[38:05.470 --> 38:07.090]  So, um,
[38:07.090 --> 38:08.930]  as long as we're sending
[38:08.930 --> 38:10.470]  assloads of traffic,
[38:10.470 --> 38:12.370]  can we make some pretty pictures?
[38:12.370 --> 38:14.210]  Because, you know, people like that.
[38:14.290 --> 38:16.070]  And so I've actually generated
[38:16.250 --> 38:17.670]  a methodology that goes ahead
[38:17.670 --> 38:20.090]  and create maps
[38:20.090 --> 38:22.150]  all internet routes in about
[38:22.490 --> 38:23.650]  a couple hours.
[38:23.650 --> 38:25.990]  It's really, really fast.
[38:26.550 --> 38:27.650]  And, um, you know, rather than
[38:27.650 --> 38:29.590]  just like hype, I'll show you
[38:29.590 --> 38:31.870]  the raw data as it's collected.
[38:32.470 --> 38:33.590]  And before anyone from
[38:33.590 --> 38:35.730]  DEF CON has a heart attack, this scan is happening
[38:35.730 --> 38:38.050]  from the 170 gigabit pipe.
[38:38.650 --> 38:40.170]  So we go ahead,
[38:40.170 --> 38:41.590]  we go into it.
[38:45.880 --> 38:46.920]  Boom!
[38:47.700 --> 38:49.800]  Hi, internet, how are you doing?
[38:49.800 --> 38:51.560]  We're sending out about 20,000
[38:51.560 --> 38:53.440]  packets a second right now.
[38:53.440 --> 38:55.280]  And, um, we're tracerouting in this
[38:55.280 --> 38:57.960]  massive, uncontrolled manner.
[38:57.960 --> 38:59.440]  And lots and lots and lots and lots
[38:59.440 --> 39:01.820]  and lots of hosts are talking to us.
[39:01.820 --> 39:03.340]  That's a mess, right?
[39:03.340 --> 39:05.340]  How are we going to filter it?
[39:05.340 --> 39:07.480]  Well, welcome to SQL.
[39:07.480 --> 39:09.460]  Fun little language, lets us organize
[39:09.460 --> 39:11.400]  things. Once we run this stupid
[39:11.400 --> 39:13.020]  little query, you know,
[39:13.020 --> 39:16.260]  show me what, you know, reorder this until it makes sense.
[39:16.400 --> 39:17.180]  Oh, look!
[39:17.200 --> 39:20.980]  On the way to 12.10.41.178,
[39:20.980 --> 39:22.100]  here's all of our
[39:22.100 --> 39:24.080]  hops. And here's hop
[39:24.080 --> 39:26.020]  one, hop two, hop three, hop four.
[39:26.020 --> 39:28.180]  What you were seeing before was wildly
[39:28.760 --> 39:30.080]  disordered, and now we have it in
[39:30.080 --> 39:32.020]  order. And how do we define
[39:32.020 --> 39:34.120]  that two things are linked? Well, if
[39:34.120 --> 39:36.220]  that number's three and that number's
[39:36.220 --> 39:38.340]  four, then 67,
[39:38.340 --> 39:39.800]  you know, this host is probably
[39:39.800 --> 39:42.080]  connected to this host. Mind you,
[39:42.080 --> 39:43.860]  we're scanning the internet over a range of like
[39:43.860 --> 39:45.980]  two hours, so this is actually kind of
[39:45.980 --> 39:47.760]  cool to see it in some degree of order.
[39:48.320 --> 39:50.060]  And, um, what does
[39:50.060 --> 39:52.100]  this crap look, well, hang on, what does this look
[39:52.100 --> 39:54.100]  like when we actually get
[39:54.100 --> 39:55.180]  it said and done?
[39:56.060 --> 39:57.860]  Finally, I get to show some pretty pictures.
[40:06.170 --> 40:07.210]  I know.
[40:08.450 --> 40:09.050]  I'm well
[40:09.050 --> 40:09.710]  aware.
[40:16.180 --> 40:18.700]  So this data's been around for a while,
[40:18.700 --> 40:20.360]  but, uh, being able to zoom
[40:20.360 --> 40:22.540]  in on it is kind of new.
[40:23.820 --> 40:24.520]  And, uh,
[40:24.520 --> 40:26.400]  being able to, like, tilt it down
[40:26.400 --> 40:28.200]  and, you know, raise
[40:28.200 --> 40:30.300]  it up and, like, fly around.
[40:30.300 --> 40:32.160]  Everyone, you know, Hollywood really
[40:32.160 --> 40:34.480]  wants someone to do this, so fine,
[40:34.480 --> 40:36.340]  here, I'm flying around the internet, ain't that
[40:36.340 --> 40:36.920]  rad?
[40:46.360 --> 40:48.300]  Now the eventual goal,
[40:48.300 --> 40:50.160]  and this will happen sometime in the next
[40:50.160 --> 40:52.180]  couple of months, yeah, I really
[40:52.180 --> 40:53.800]  broke my arm, um,
[40:53.800 --> 40:56.320]  but the goal is that we can go ahead and we can take live
[40:56.320 --> 40:58.300]  data and we can go ahead and plot
[40:58.300 --> 41:00.140]  it so this is all black and white and as
[41:00.140 --> 41:02.180]  you actually use the net, it goes, you're going over
[41:02.180 --> 41:04.140]  this path, you're going over this path, here's all
[41:04.140 --> 41:06.120]  the constraints and all that kind of stuff.
[41:06.120 --> 41:08.280]  And that's the kind of data I want to be able
[41:08.280 --> 41:10.260]  to, you know, collect. It turns
[41:10.260 --> 41:12.260]  out when you do this kind of large mapping,
[41:12.260 --> 41:14.440]  there's a couple things you can do extra,
[41:14.440 --> 41:16.140]  um, whenever, you know,
[41:16.140 --> 41:18.220]  we have to scan up to a certain range, if we
[41:18.220 --> 41:20.300]  actually find someone, you know, at the,
[41:20.300 --> 41:22.100]  you know, the farthest away possible,
[41:22.100 --> 41:24.540]  we can go back, fill in the gaps,
[41:24.540 --> 41:26.200]  um, we can actually go ahead and,
[41:26.200 --> 41:28.140]  you know, put out senders all over the
[41:28.140 --> 41:30.220]  internet and have all the reception
[41:31.020 --> 41:32.420]  happen at the same point,
[41:32.420 --> 41:34.520]  so we can say, here's how the net looks from China,
[41:34.520 --> 41:36.480]  here's how the net looks from Japan, here's how the net
[41:36.480 --> 41:38.440]  looks from Abu Dhabi, and
[41:38.440 --> 41:40.880]  all of it will come back to the same collector,
[41:40.880 --> 41:43.020]  and we can go ahead and we can integrate the data.
[41:43.400 --> 41:44.540]  Um, and
[41:44.540 --> 41:46.560]  the results look pretty cool, but
[41:46.560 --> 41:48.800]  there is, there is a weakness.
[41:49.300 --> 41:50.520]  Yeah, how are we going to make this
[41:50.520 --> 41:52.320]  useful? And beyond that,
[41:52.320 --> 41:54.680]  I don't want to have to do this big preprocessing
[41:54.680 --> 41:56.760]  phase, I would like to graph live
[41:56.760 --> 41:58.860]  data. How could I do that?
[41:59.140 --> 42:00.560]  Well, there's these
[42:00.560 --> 42:02.580]  guys, they wrote some
[42:02.580 --> 42:04.800]  code in C++, it makes
[42:04.800 --> 42:06.500]  my nose bleed, but it's
[42:06.500 --> 42:08.480]  really, really cool. It's really, really
[42:08.480 --> 42:10.560]  cool to the level of, like, it will
[42:10.560 --> 42:12.760]  handle, like, 2 million node networks
[42:12.760 --> 42:14.780]  and be like, huh, sweet, got more?
[42:15.560 --> 42:16.760]  It's really cool.
[42:16.760 --> 42:18.880]  It's called the Boost Graph Library.
[42:18.880 --> 42:21.100]  It's rad. And not only is it rad,
[42:21.100 --> 42:22.780]  but their developers are like, okay,
[42:22.780 --> 42:24.580]  we're going to support Dan.
[42:24.800 --> 42:26.180]  Like, sweet.
[42:26.420 --> 42:28.600]  They're getting, like, updates, like, here is
[42:28.600 --> 42:30.660]  your code, here are the answers to the
[42:30.660 --> 42:32.520]  test. Like, struggle with this stuff
[42:32.520 --> 42:35.200]  for, like, four days, send them a mail, here you go.
[42:35.680 --> 42:36.340]  Rad.
[42:37.440 --> 42:38.320]  So,
[42:38.920 --> 42:40.640]  what kind of stuff can we do now that
[42:40.640 --> 42:42.600]  we have, like, you know, real graph
[42:42.600 --> 42:44.020]  logical stuff?
[42:45.640 --> 42:47.100]  Let's see here.
[42:51.780 --> 42:52.660]  This is
[42:52.920 --> 42:54.520]  a router trace on a small
[42:54.520 --> 42:55.420]  network.
[42:57.800 --> 42:58.460]  That's a little
[42:58.460 --> 42:59.940]  dark, isn't it?
[43:00.400 --> 43:03.080]  We'll set the next one to be a little lighter.
[43:29.680 --> 43:32.100]  This is a fairly large-scale network.
[43:33.060 --> 43:34.160]  And, actually, this is a router
[43:34.160 --> 43:36.400]  trace. We're watching traffic.
[43:36.780 --> 43:37.880]  And it's actually
[43:37.880 --> 43:40.140]  animating out in front of us in real time.
[43:40.300 --> 43:42.140]  And we're watching, basically,
[43:42.140 --> 43:43.980]  nodes that aren't talking to anyone else.
[43:43.980 --> 43:45.980]  Here's a cluster right here that's just one server
[43:45.980 --> 43:47.460]  talking to lots of hosts.
[43:47.480 --> 43:50.460]  Here are servers that have a multi-tier relationship.
[43:50.460 --> 43:52.420]  This is all very early code
[43:52.420 --> 43:54.080]  written in the last week or two.
[43:54.120 --> 43:55.660]  But, ooh, it's pretty.
[43:56.820 --> 43:58.260]  And, um,
[43:58.260 --> 44:00.480]  the idea is you can actually, like, stream
[44:00.480 --> 44:02.400]  random data in. If I had any faith
[44:02.400 --> 44:04.380]  in the networks of these things, I could actually
[44:04.380 --> 44:06.560]  do live TCP dump with all
[44:07.160 --> 44:08.040]  interrelationships shown
[44:08.040 --> 44:10.160]  on that kind of map.
[44:10.160 --> 44:12.640]  And is this useful? Well, I haven't made a discovery
[44:12.640 --> 44:14.280]  on it. I took all my DNS
[44:14.860 --> 44:16.380]  interrelationship data and put it into
[44:16.380 --> 44:18.760]  that graph. And what did we find?
[44:19.380 --> 44:20.580]  Interestingly enough,
[44:20.580 --> 44:22.980]  oh, crap, there's a whole bunch of hosts
[44:22.980 --> 44:24.540]  that are all coming back to one
[44:25.280 --> 44:26.680]  that I expected.
[44:26.680 --> 44:28.580]  What I did not expect, and it'll take, actually,
[44:28.660 --> 44:30.640]  a few seconds for it to show up on this,
[44:30.640 --> 44:32.240]  but you'll just have to believe me.
[44:32.260 --> 44:34.680]  My expectation was that you would
[44:34.680 --> 44:36.740]  have, you know, lots and lots of hosts
[44:36.740 --> 44:38.700]  that actually went to one backend that talked
[44:38.700 --> 44:40.900]  to me. What you actually see is a
[44:40.900 --> 44:43.120]  pretty complex multi-tier relationship.
[44:43.120 --> 44:44.920]  One name server will talk to another name server,
[44:44.920 --> 44:47.360]  will talk to another name server, and will talk to another name server.
[44:47.360 --> 44:49.020]  This was something that I
[44:49.020 --> 44:51.420]  would not have expected.
[44:51.420 --> 44:53.360]  I actually don't know the layouts that create
[44:53.360 --> 44:54.360]  this, but
[44:56.380 --> 44:57.520]  having seen the
[44:57.520 --> 44:59.440]  data, having seen it visually, I could
[44:59.440 --> 45:01.420]  now build my systems
[45:01.420 --> 45:02.960]  around that assumption.
[45:03.180 --> 45:05.580]  The goal of all of this
[45:05.580 --> 45:07.060]  is that when I do
[45:07.060 --> 45:09.700]  mass internet scale scans,
[45:09.700 --> 45:11.580]  every time I send a packet,
[45:11.580 --> 45:13.240]  I can know the route that packet
[45:13.240 --> 45:15.080]  is going to probably take.
[45:15.080 --> 45:17.720]  I can know the routers it's probably going to go over.
[45:17.720 --> 45:20.180]  I can know what the bandwidth implications are.
[45:20.180 --> 45:21.400]  I can look at my pipe
[45:21.400 --> 45:23.360]  as a water hose.
[45:23.420 --> 45:25.100]  Not a hose, as a pipe
[45:25.100 --> 45:26.960]  of just high pressure water.
[45:26.960 --> 45:29.040]  And I can go ahead and build taps on that
[45:29.040 --> 45:31.240]  based on what the implications are
[45:31.240 --> 45:33.020]  on the underlying network.
[45:33.020 --> 45:35.120]  So I can say, here's a T1.
[45:35.120 --> 45:36.880]  Packets through there can only go at this rate.
[45:36.880 --> 45:39.160]  Here's an OC48. Packets on here can only go
[45:39.160 --> 45:41.420]  on this rate. And most interestingly,
[45:41.420 --> 45:42.960]  I can put monitors on
[45:42.960 --> 45:44.920]  every single router that I'm sending
[45:44.920 --> 45:46.820]  traffic through. And the moment
[45:46.820 --> 45:49.220]  those monitors, I call it canaries,
[45:49.220 --> 45:50.980]  you send five or ten packets a second
[45:50.980 --> 45:53.180]  to each router you expect to go through,
[45:53.180 --> 45:55.520]  as soon as these canaries stop responding,
[45:55.520 --> 45:56.980]  you know you killed them.
[45:58.100 --> 45:58.500]  So...
[45:58.500 --> 46:01.400]  I'm going to start killing canaries. Ain't that fun?
[46:04.860 --> 46:06.800]  And now the last thing. I have no idea
[46:06.800 --> 46:09.340]  if I've gone over, but I hope you guys have had fun.
[46:10.880 --> 46:13.120]  Who here was at my ATalk here last year?
[46:16.950 --> 46:17.590]  Hey,
[46:17.590 --> 46:19.090]  I haven't screwed up yet.
[46:19.610 --> 46:19.930]  So...
[46:23.740 --> 46:25.780]  You're wearing a power glove!
[46:25.780 --> 46:27.040]  How can I resist?
[46:28.400 --> 46:30.180]  Anyone got shot glasses?
[46:30.180 --> 46:32.160]  Can I get some shot glasses up here?
[46:32.380 --> 46:34.380]  What's your name? Patrick!
[46:34.420 --> 46:35.780]  Patrick, this is why I
[46:35.780 --> 46:37.280]  fucking come to DEF CON.
[46:37.320 --> 46:40.100]  Because people will get me really fucked up.
[46:40.500 --> 46:41.600]  Mind you, I've never had Everclear
[46:41.600 --> 46:42.500]  before.
[46:47.340 --> 46:49.080]  Hey, am I
[46:49.080 --> 46:51.060]  shying away from this? No, because I'm
[46:51.060 --> 46:52.540]  trashed.
[46:53.880 --> 46:55.920]  I am so fucked.
[47:00.900 --> 47:02.640]  Hey, I am drinking.
[47:10.580 --> 47:13.020]  Alright, we're here. You know what we're drinking
[47:13.020 --> 47:15.040]  to? We're drinking to TourCon.
[47:15.040 --> 47:16.920]  Probably my favorite small con
[47:16.920 --> 47:19.640]  in the world. It is just the shit.
[47:19.820 --> 47:21.160]  DEF CON is rad.
[47:21.200 --> 47:23.020]  TourCon is just...
[47:23.700 --> 47:25.160]  Hikari is awesome. Is Hikari
[47:25.160 --> 47:26.800]  even here? Dude!
[47:28.360 --> 47:28.800]  Fucking
[47:28.800 --> 47:30.640]  Hikari. Dude!
[47:31.380 --> 47:33.020]  Hey, wait, wait, wait. Do we have a
[47:33.020 --> 47:36.360]  third shot glass by any chance?
[47:36.360 --> 47:37.540]  Hikari, get the fuck
[47:39.620 --> 47:40.220]  up here.
[47:40.220 --> 47:42.420]  Here, you're drinking this shit.
[47:42.420 --> 47:43.880]  I'm drinking Everclear. You can
[47:43.880 --> 47:48.580]  drink the fucking Morgans.
[47:48.720 --> 47:49.320]  Just drink.
[47:49.320 --> 47:50.300]  Alright. To a
[47:50.300 --> 47:51.960]  great fucking con. You guys all rule.
[47:51.960 --> 47:52.680]  Thank you so much for coming here.
[48:50.200 --> 48:51.160]  It's actually
[48:51.160 --> 48:52.820]  working. Holy hell, I didn't
[48:52.820 --> 48:54.380]  think it would actually work.
[48:55.200 --> 48:56.760]  Alright, I'm putting audio out through
[48:56.760 --> 48:59.040]  the PC interface. This better work, guys.
[48:59.660 --> 49:01.040]  I'm warning you.
[49:01.040 --> 49:02.780]  Audio's coming any minute now. Oh,
[49:02.780 --> 49:04.760]  so I had to put on a huge cache on this
[49:04.760 --> 49:06.780]  thing because the Black Hat network was
[49:06.780 --> 49:09.600]  broken beyond all description.
[49:10.120 --> 49:11.000]  It was like wireless
[49:11.000 --> 49:13.040]  from like 20 feet away.
[49:13.700 --> 49:14.180]  Michael
[49:15.560 --> 49:16.520]  Flackley is
[49:16.520 --> 49:19.000]  the Lord of the Dance.
[49:20.040 --> 49:20.540]  Darth
[49:20.540 --> 49:22.540]  Vader is the Lord
[49:22.540 --> 49:24.120]  of the Sith.
[49:26.220 --> 49:26.620]  Okay,
[49:26.620 --> 49:28.640]  Robot Chicken is the best fucking
[49:28.640 --> 49:30.160]  show in the world.
[49:30.580 --> 49:44.540]  Robot Chicken rocks. And that's all
[49:44.540 --> 49:46.300]  about all I have for you
[49:46.300 --> 49:47.520]  fucking guys.
[49:58.160 --> 49:59.040]  Wow.
[50:13.620 --> 50:14.500]  So,
[50:17.340 --> 50:18.540]  just fucking come up here.
[50:18.540 --> 50:20.040]  I want people to hear your shit.
[50:20.740 --> 50:22.520]  Seriously, I really want people to come up
[50:22.520 --> 50:24.560]  and ask questions. Can I fucking
[50:24.560 --> 50:25.760]  have your babies?
[50:27.840 --> 50:28.560]  Dude, you're
[50:28.780 --> 50:29.740]  a guy.
[50:31.800 --> 50:32.540]  Seriously,
[50:32.540 --> 50:34.880]  someone came up with some auto-shunning question?
[50:34.880 --> 50:36.620]  Come on, come here. Alright, what
[50:36.620 --> 50:37.520]  you got, man?
[50:37.980 --> 50:40.660]  Do the IPSs that you're aware
[50:40.660 --> 50:42.760]  of, will they auto-shun their loopback
[50:42.760 --> 50:43.740]  interface?
[50:44.960 --> 50:46.640]  I had totally not
[50:46.640 --> 50:47.600]  thought of that.
[50:48.620 --> 50:49.740]  That would...
[50:50.980 --> 50:52.620]  I seem to have nothing
[50:52.620 --> 50:54.520]  to drink. You guys are
[50:54.520 --> 50:56.560]  falling down on the
[50:56.560 --> 50:58.940]  job. I bring you here for...
[50:58.940 --> 51:00.760]  What, you want me to drink? Okay.
[51:08.920 --> 51:09.720]  That's a
[51:09.720 --> 51:11.020]  really interesting question.
[51:11.020 --> 51:12.980]  Okay, so here's
[51:12.980 --> 51:15.040]  the idea, and this is fucked.
[51:15.200 --> 51:16.800]  This is really, really impressively
[51:16.800 --> 51:18.580]  fucked up. The idea is
[51:18.580 --> 51:20.920]  that you spoof a whole bunch of traffic to some
[51:20.920 --> 51:24.040]  network from the address 127.0.0.1,
[51:24.040 --> 51:24.820]  which is, of course,
[51:24.820 --> 51:26.760]  the loopback address on a host.
[51:26.760 --> 51:28.780]  Will the IPS actually
[51:28.780 --> 51:30.800]  block local host? Because if
[51:30.800 --> 51:32.740]  it does, all sorts of shit's
[51:32.740 --> 51:34.060]  going down.
[51:37.640 --> 51:38.720]  IPS vendors in
[51:38.720 --> 51:40.460]  this room, test.
[51:40.460 --> 51:42.500]  Like, now. Because there's, like, a thousand
[51:42.500 --> 51:44.760]  people who have the idea of testing it.
[51:45.400 --> 51:46.560]  Hey, you have your hand up.
[51:46.560 --> 51:47.560]  Get the fuck up here.
[51:49.680 --> 51:50.820]  No, no, come up.
[51:50.820 --> 51:51.680]  Come up.
[51:52.820 --> 51:54.460]  Seriously, come on up. There's, like,
[51:54.460 --> 51:57.140]  booze and books and, like, good shit and, like...
[51:57.140 --> 51:58.260]  God damn it.
[52:00.440 --> 52:02.640]  No, it's just a rebuttal to the earlier question
[52:02.640 --> 52:04.320]  is if you've got your router set up right, your
[52:04.320 --> 52:06.620]  edge router 127 shouldn't get in?
[52:07.320 --> 52:08.580]  If your edge router's
[52:08.580 --> 52:10.280]  automatic, already blocking
[52:10.280 --> 52:12.620]  127.0.0.1, then, uh,
[52:12.620 --> 52:14.460]  of course, yeah, you're not going to go ahead and get nasty
[52:14.460 --> 52:16.440]  traffic. But, um,
[52:16.640 --> 52:19.020]  a lot of people have the attitude, well, I got an IPS.
[52:19.020 --> 52:21.000]  What do I need to put custom firewalls
[52:21.000 --> 52:22.760]  rules in for? The internet
[52:22.760 --> 52:24.540]  will be giving me firewall
[52:24.540 --> 52:25.980]  rules!
[52:27.080 --> 52:28.560]  Actually, honestly, probably
[52:28.820 --> 52:30.580]  a lot of IPSs already have
[52:30.580 --> 52:32.280]  blocks against 127 and
[52:32.280 --> 52:34.240]  have blocks against RFC 1918
[52:34.240 --> 52:36.360]  space, but I'm sure
[52:36.360 --> 52:38.180]  there's one that doesn't because there's
[52:38.180 --> 52:40.280]  some really crappy IPSs
[52:40.280 --> 52:41.240]  out there.
[52:42.040 --> 52:43.780]  What's up? Hang on, hang on, hang on.
[52:44.140 --> 52:46.660]  You're trying to kick my ass, and so, of course,
[52:46.660 --> 52:48.060]  I have to give you the mic.
[52:48.980 --> 52:50.780]  What happens to overlapping segments, Dan?
[52:50.940 --> 52:52.400]  What do you mean, what happens to overlapping
[52:52.400 --> 52:54.720]  segments? What happens to
[52:54.720 --> 52:56.300]  the segments, uh, the timeout values
[52:56.300 --> 52:57.980]  if the segments are overlapping, Dan?
[52:58.020 --> 53:00.200]  Ah, yes, yes, yes, that's one of the things I pointed
[53:00.200 --> 53:02.280]  out. There are some very good...
[53:02.280 --> 53:04.240]  Okay. There are
[53:04.240 --> 53:06.240]  some relatively good IPSs
[53:06.240 --> 53:08.520]  because they're all shit, but there are some relatively
[53:08.520 --> 53:10.280]  good IPSs that will notice
[53:10.280 --> 53:12.220]  hey, look, this...
[53:12.220 --> 53:14.220]  They basically will go ahead and have
[53:14.220 --> 53:16.400]  their timing value for how long the fragment
[53:16.400 --> 53:18.380]  can live, but fragments
[53:18.380 --> 53:20.340]  have a particular IP
[53:20.340 --> 53:22.220]  ID associated with them, and there
[53:22.220 --> 53:24.300]  will be a separate timer, a much
[53:24.300 --> 53:26.200]  longer timer that notes, hey,
[53:26.200 --> 53:28.720]  I may have flushed this from my queue,
[53:28.720 --> 53:29.140]  but
[53:30.100 --> 53:32.300]  this is a fragment on a
[53:32.300 --> 53:34.600]  session from an old...
[53:34.600 --> 53:36.400]  This is an old... This is a fragment
[53:36.400 --> 53:38.300]  that could be applied to an old session.
[53:38.300 --> 53:40.300]  In other words, someone could be trying to mess with
[53:40.300 --> 53:42.280]  me. Hmm. Why would I try
[53:42.280 --> 53:44.180]  to be messing with anyone? Yeah, I guess they can
[53:44.180 --> 53:46.400]  bust me. Um, those...
[53:47.300 --> 53:48.100]  Those IPSs
[53:48.100 --> 53:50.180]  are really easy to fingerprint,
[53:50.180 --> 53:52.320]  and there is a problem in this industry.
[53:52.320 --> 53:54.240]  There are vulnerabilities in security
[53:54.240 --> 53:56.240]  code itself. I don't
[53:56.240 --> 53:58.300]  want to share that. I just want you to take a drink.
[54:01.140 --> 54:01.880]  Get ready
[54:01.880 --> 54:02.660]  to drink.
[54:03.780 --> 54:05.880]  Really, I am so screwed in
[54:05.880 --> 54:07.900]  TC Baby Drinking Game. Hey,
[54:07.900 --> 54:08.880]  come up here.
[54:12.740 --> 54:14.720]  Can I have your baby?
[54:14.860 --> 54:17.360]  Well, you definitely are a girl.
[54:19.380 --> 54:20.860]  New comment.
[54:23.820 --> 54:25.020]  Later.
[54:26.960 --> 54:28.340]  Come here.
[54:29.920 --> 54:31.260]  All the fragmenting
[54:31.260 --> 54:33.100]  stuff, does that work if they're filtering
[54:33.100 --> 54:34.620]  fragmented packets?
[54:35.200 --> 54:37.220]  No, it doesn't. But that's
[54:37.340 --> 54:39.540]  a problem because fragments are a legitimate
[54:39.540 --> 54:41.020]  part of the IP
[54:41.020 --> 54:43.100]  spec. They're actually...
[54:43.100 --> 54:45.160]  No, there's quite a few networks that are
[54:45.160 --> 54:47.140]  tunneled inside of tunnels, and
[54:47.140 --> 54:49.060]  they end up with much smaller...
[54:49.060 --> 54:51.120]  You know, in the multi-tunneling,
[54:51.120 --> 54:53.460]  end up with packets larger than the MTU
[54:53.460 --> 54:55.200]  because there's a lot of packets that will be
[54:55.200 --> 54:57.340]  sent with an MTU of 1500.
[54:57.640 --> 54:59.420]  So, fragmentation happens.
[54:59.420 --> 55:01.120]  It's supposed to be limited by
[55:01.120 --> 55:03.300]  TCP's MSS value,
[55:03.300 --> 55:05.120]  but sometimes it really does happen,
[55:05.120 --> 55:07.360]  and it does happen entirely legitimately.
[55:07.460 --> 55:09.160]  Now, small fragments, and this is
[55:09.160 --> 55:11.120]  very obscure, but small fragments at the
[55:11.120 --> 55:13.480]  beginning of a packet should not happen.
[55:13.480 --> 55:15.360]  And those things are legitimately dropped,
[55:15.360 --> 55:16.380]  and that's good.
[55:17.560 --> 55:18.980]  Go ahead. Because I've seen
[55:18.980 --> 55:21.180]  networks that do that. They filter out the fragmented
[55:21.180 --> 55:22.940]  packets. What are they missing out on?
[55:23.580 --> 55:25.540]  Is there anything interesting about them?
[55:25.540 --> 55:27.180]  Well, there's an interesting thing. A lot of
[55:27.180 --> 55:29.100]  people say, hey, I can drop 1% of
[55:29.100 --> 55:31.100]  traffic. No problem. It's just, you know, 1%.
[55:31.680 --> 55:33.440]  But you get, you know, this 1%,
[55:33.440 --> 55:34.980]  and this 1%, and this 1%,
[55:34.980 --> 55:37.000]  and suddenly, the internet doesn't work
[55:37.000 --> 55:39.400]  very well anymore. And that happens.
[55:39.400 --> 55:41.100]  And that's ultimately, you know,
[55:41.100 --> 55:43.000]  we have this thing called, like, congestion
[55:43.000 --> 55:45.000]  collapse, when there are too much,
[55:45.000 --> 55:47.340]  there's too much traffic that doesn't back off.
[55:47.340 --> 55:49.100]  There's another kind of collapse. It's firewall
[55:49.100 --> 55:51.060]  collapse, when there's too many overlapping
[55:51.060 --> 55:53.040]  rules from people who think, well, our one
[55:53.040 --> 55:55.020]  little variation on the IP spec is
[55:55.020 --> 55:57.180]  okay, and, you know, we're just going to do it,
[55:57.180 --> 55:59.420]  and, you know, who cares if we drop 1% of traffic,
[55:59.420 --> 56:01.800]  and then the internet no longer works.
[56:02.640 --> 56:03.200]  And, tipping
[56:03.200 --> 56:05.360]  point, I'm talking to you.
[56:07.100 --> 56:07.760]  I can't
[56:07.760 --> 56:09.300]  remember what the denial of service attack is.
[56:09.300 --> 56:11.060]  It's either New Dawn or Teardrop,
[56:11.060 --> 56:13.160]  where it's based on fragmented
[56:13.160 --> 56:15.240]  TCP packets. How would that work
[56:15.240 --> 56:16.900]  against an IPS?
[56:18.120 --> 56:19.000]  The fragmented
[56:19.000 --> 56:21.120]  packet, I dream about Ping
[56:21.120 --> 56:23.380]  of Death, maybe, where you have a packet
[56:23.380 --> 56:25.360]  that reassembles
[56:25.360 --> 56:27.760]  larger than the maximum IP size?
[56:28.460 --> 56:29.500]  Where the
[56:29.500 --> 56:31.280]  TCP packet reassembles
[56:31.280 --> 56:32.640]  and it's broken, and it causes
[56:34.360 --> 56:35.900]  various problems.
[56:35.900 --> 56:37.440]  At this point, you know, it's really
[56:37.440 --> 56:39.500]  sad. It's 2005,
[56:39.500 --> 56:41.280]  right? When the hell did Teardrop
[56:41.280 --> 56:44.280]  come out? Wasn't it, like, 97 or 98?
[56:44.380 --> 56:45.540]  Okay, so
[56:45.540 --> 56:47.580]  very well-known vendor,
[56:47.580 --> 56:49.500]  Netscreen, actually goes ahead
[56:49.500 --> 56:51.820]  and has, like, on their thing,
[56:51.820 --> 56:53.700]  we blocked this many Teardrop
[56:53.700 --> 56:55.720]  attacks. Dude, it's
[56:55.720 --> 56:57.620]  the 21st century. We
[56:57.620 --> 56:59.760]  aren't worried about that shit anymore.
[56:59.760 --> 57:01.780]  It doesn't work, even if
[57:01.780 --> 57:03.760]  it's unblocked. We're not running
[57:03.760 --> 57:05.480]  Windows 95.
[57:08.040 --> 57:09.580]  So, I don't know. I mean,
[57:09.580 --> 57:12.280]  Teardrop, I mean, it's a great brand.
[57:12.500 --> 57:13.720]  Oh, incidentally, you guys know
[57:13.720 --> 57:15.940]  how names are done in the virus industry?
[57:15.940 --> 57:17.800]  It's like, you know, they're all, like,
[57:17.800 --> 57:19.760]  named by the guys who find them.
[57:19.760 --> 57:21.760]  So, just like, you know, we're gonna call this attack
[57:21.760 --> 57:23.620]  Teardrop. We're gonna call this attack
[57:23.620 --> 57:25.680]  CodeRed, because, you know, hey, you know,
[57:25.680 --> 57:27.720]  they didn't, like, put a big brand copyright
[57:27.720 --> 57:29.680]  on it when they attacked our network,
[57:29.680 --> 57:31.800]  so we're gonna name it whatever gets us
[57:31.800 --> 57:33.500]  the most attention possible.
[57:33.520 --> 57:36.160]  And that's why they all have sexy names.
[57:36.420 --> 57:37.780]  Of course, there was a real problem
[57:37.780 --> 57:39.540]  when one of them named their thing
[57:40.780 --> 57:41.660]  Doxpar,
[57:41.660 --> 57:43.320]  because I do Doxpar
[57:44.420 --> 57:45.300]  research, and
[57:45.800 --> 57:47.700]  Doxpar caused me all sorts
[57:47.700 --> 57:49.800]  of problems, especially when the variant
[57:49.800 --> 57:52.660]  happened, Doxpar.A.
[57:53.760 --> 57:54.080]  You
[57:54.560 --> 57:55.520]  bastards.
[57:57.100 --> 57:58.600]  All right, other questions?
[57:59.180 --> 58:00.520]  What, hey, uh-oh.
[58:00.860 --> 58:01.940]  What do you think of the recent
[58:01.940 --> 58:03.720]  ICMP-based attacks?
[58:07.020 --> 58:07.900]  There's so
[58:07.900 --> 58:09.740]  much overh... So, it's really
[58:09.740 --> 58:11.860]  funny. Yes, you
[58:11.860 --> 58:13.840]  can kill ICMP sessions if you
[58:13.840 --> 58:15.380]  can figure out the four tuple of
[58:15.380 --> 58:17.700]  source IP, desk IP, source port,
[58:17.700 --> 58:19.740]  you totally can.
[58:19.740 --> 58:21.720]  But I went on Deja News, and
[58:21.720 --> 58:24.060]  I found a post from 1993
[58:24.060 --> 58:26.260]  calling this shit old.
[58:28.400 --> 58:29.840]  Dear God.
[58:30.760 --> 58:31.860]  No, I mean,
[58:31.860 --> 58:33.580]  okay, the actual attacks
[58:33.580 --> 58:36.060]  are real, but old.
[58:36.120 --> 58:37.800]  To his credit, he's right, they still
[58:37.800 --> 58:39.840]  work, and they shouldn't.
[58:40.020 --> 58:41.840]  His stuff about slow... There's this guy,
[58:41.840 --> 58:43.840]  he has this stuff about slowing down networks.
[58:43.840 --> 58:45.680]  Why am I drinking? I was right.
[58:46.440 --> 58:47.540]  Okay, his stuff...
[58:47.540 --> 58:48.580]  Fuck.
[58:54.080 --> 58:55.660]  Funny guy. He should
[58:55.660 --> 58:56.720]  test his shit.
[58:57.320 --> 58:59.800]  He has this whole thing, well, I can slow down
[58:59.800 --> 59:02.000]  communication of BGP sessions.
[59:02.140 --> 59:03.640]  I can reduce a session down
[59:03.640 --> 59:05.860]  to one packet sent per round
[59:05.860 --> 59:07.820]  trip time. So,
[59:07.820 --> 59:09.800]  BGP sessions, I don't know if you guys know,
[59:09.800 --> 59:11.700]  they're about three kilobytes a second.
[59:11.780 --> 59:13.560]  Three kilobytes a second, okay.
[59:13.660 --> 59:15.560]  So, you reduce a session down to
[59:15.560 --> 59:17.760]  one packet per round trip
[59:17.760 --> 59:19.740]  time on a session that has somewhere
[59:19.740 --> 59:21.700]  between one millisecond and a tenth
[59:21.700 --> 59:24.200]  of a millisecond latency.
[59:24.220 --> 59:25.920]  Oh, no! I can
[59:25.920 --> 59:27.800]  only send a thousand to
[59:27.800 --> 59:29.920]  ten thousand packets a second
[59:29.920 --> 59:31.960]  on my three kilobyte
[59:32.140 --> 59:33.480]  a second link.
[59:33.480 --> 59:34.540]  No!
[59:35.860 --> 59:37.560]  It's ridiculous.
[59:38.180 --> 59:40.080]  Any other questions? Seriously,
[59:40.080 --> 59:41.700]  you don't even have to come up if I can somehow
[59:41.700 --> 59:42.840]  hear you.
[59:46.640 --> 59:47.240]  Says
[59:47.240 --> 59:49.360]  the guy from Prolexic.
[59:49.360 --> 59:51.900]  That took some balls. Here, have a book.
[59:53.820 --> 59:55.320]  Prolexic's been rad, by the
[59:55.320 --> 59:57.160]  way. I mean, seriously. They've been
[59:57.160 --> 59:59.340]  giving me shit tons of bandwidth and taking
[59:59.340 --> 01:00:01.920]  calls from DoD. Rad.
[01:00:03.800 --> 01:00:05.800]  Oh, shit, it's George.
[01:00:06.380 --> 01:00:07.160]  It's ScanRan
[01:00:07.160 --> 01:00:08.840]  motherfucker George.
[01:00:15.430 --> 01:00:17.310]  I hate you.
[01:00:18.350 --> 01:00:19.070]  So, I'm going
[01:00:19.070 --> 01:00:21.050]  to the T2 con out in Finland.
[01:00:21.070 --> 01:00:22.850]  Who here is from Europe?
[01:00:24.550 --> 01:00:24.990]  Dude,
[01:00:24.990 --> 01:00:27.090]  Euro guys, I'm coming out to you guys
[01:00:27.090 --> 01:00:28.770]  mostly. That's the plan.
[01:00:29.370 --> 01:00:30.910]  So, T2,
[01:00:30.910 --> 01:00:32.850]  I didn't intend to give them props, because
[01:00:32.850 --> 01:00:34.690]  TorCon is the shit, but
[01:00:35.390 --> 01:00:37.290]  yeah, T2 should be good.
[01:00:38.270 --> 01:00:38.890]  What?
[01:00:39.010 --> 01:00:41.630]  I didn't screw up! You drink!
[01:00:41.630 --> 01:00:43.150]  Hey, someone get these fuckers
[01:00:43.150 --> 01:00:45.010]  drinks. They need to be drunk so they'll
[01:00:45.010 --> 01:00:45.970]  shut up.
[01:00:45.970 --> 01:00:48.470]  I'm not drinking.
[01:00:48.870 --> 01:00:50.150]  No, stop.
[01:00:55.340 --> 01:00:56.880]  All right, do we have anything else?
[01:00:56.880 --> 01:00:59.060]  Because I should probably give this shit up to Hacker Jeopardy.
[01:00:59.060 --> 01:01:00.580]  OK, go ahead. You have a good question?
[01:01:01.000 --> 01:01:03.440]  No dude, hang on. I want this guy to ask a question.
[01:01:04.800 --> 01:01:07.320]  You said that one of your attacks
[01:01:07.320 --> 01:01:09.360]  is based on a difference between IDS timing
[01:01:09.360 --> 01:01:11.200]  and host timing. Well, in Linux
[01:01:11.200 --> 01:01:13.140]  and FreeBSD, isn't it possible, even
[01:01:13.140 --> 01:01:15.120]  in extreme situations, just to rebuild the stack
[01:01:15.120 --> 01:01:17.040]  so if you know your vendor in advance just to match
[01:01:19.600 --> 01:01:28.580]  Man gets a book. Man gets both books. That is an excellent point. Those of you who are
[01:01:28.580 --> 01:01:36.060]  very smart admins can go ahead, adapt your host to your shit ass IDS and make things
[01:01:36.060 --> 01:01:44.880]  align perfectly. Absolutely correct. Fantastic point. Are you advocating we break our host
[01:01:44.880 --> 01:01:50.320]  and match our IDS? Hey, I'm advocating we adapt our host to agree with our IDS's fucked
[01:01:50.320 --> 01:01:59.490]  up view of the universe. Thank you very much. Absolutely. What's up? And I think, unless
[01:01:59.490 --> 01:02:06.030]  there's any more questions, I think I am done here. You guys are fantastic! I love you guys!
[01:02:11.130 --> 01:02:17.970]  As a note, I talk at Black Hat as practice for you guys. You guys are awesome. I cannot
[01:02:17.970 --> 01:02:23.990]  even say thank you so much for all. Oh, there's one last thing that is really important that
[01:02:23.990 --> 01:02:30.270]  you all know. I have an insane network pipe and I'm taking proposals for how to use it.
[01:02:30.270 --> 01:02:36.110]  If you have an idea for what will help secure the internet, I will take the shit of spreading
[01:02:36.110 --> 01:02:47.650]  it everywhere. Talk to me! Don't do it yourself! No, not porn! You sick fuck! Especially for
[01:02:47.650 --> 01:02:54.070]  the kind of porn you want! Alright, I'm off to the drinking game where I will puke my
[01:02:54.070 --> 01:02:55.470]  guts out. Thank you.