WEBVTT 00:10.770 --> 00:18.250 So this was supposed to go on at 10, and I was totally supposed to get like another hour to sober up. 00:19.810 --> 00:20.870 Dammit. 00:22.430 --> 00:25.490 This is going to be a really interesting Black Ops. 00:25.490 --> 00:33.670 Not only is this the first Black Ops that I've done exploits, this is the first Black Ops where I have been kind of sober. 00:36.670 --> 00:41.070 Oh, no, no, no, there's lots of people here providing booze, let me tell you. 00:41.790 --> 00:43.590 So, what are we here to do? 00:43.590 --> 00:45.410 We got an hour from now. 00:46.330 --> 00:47.410 Who am I? 00:47.530 --> 00:49.130 You should know by now. 00:50.470 --> 00:52.090 What are we here to do? 00:52.170 --> 00:55.970 So like last year, you know, I had like one topic, just DNS. 00:56.030 --> 00:59.890 It was kind of fun and, you know, left the whole ADD thing alone. 01:00.470 --> 01:02.070 Yeah, we're back to ADD. 01:02.070 --> 01:03.110 It's fun. 01:03.110 --> 01:04.710 We're going to talk about a whole bunch of stuff. 01:04.710 --> 01:06.170 We're going to kick MD5. 01:06.170 --> 01:07.850 We're going to play with some IP fragments. 01:07.850 --> 01:14.490 We are going to mess with intrusion protection systems, which are being really, really abused. 01:15.050 --> 01:20.590 We're going to do some DNS poisoning, which again is about the most black hat thing I've ever done. 01:21.290 --> 01:26.690 And if that didn't help, we are going to send about 4 billion packets onto the Internet. 01:26.750 --> 01:28.650 I have a new toy. 01:28.810 --> 01:32.930 It has 170 gigabits and permission to use it. 01:33.450 --> 01:36.350 I've never actually cackled before. 01:36.370 --> 01:38.130 You know, giggled a little, laughed, but... 01:41.270 --> 01:44.270 We're going to make some pretty pictures, because I like pretty pictures. 01:44.270 --> 01:45.810 You know why I like pretty pictures? 01:45.810 --> 01:49.370 Because I can show them to non-geeks, and they're like, holy crap, that is cool. 01:49.370 --> 01:51.410 I have no idea what it is, but it is cool. 01:51.910 --> 01:54.290 Usually it's just I have no idea what it is. 01:54.570 --> 01:55.990 It just ends there. 01:56.730 --> 01:58.730 And finally, you know, watch some TV. 02:00.770 --> 02:02.210 Attacking MD5. 02:02.730 --> 02:07.950 Instead of going through all the background, here is the web page for Lockheed Martin. 02:08.210 --> 02:09.010 Fun company. 02:09.010 --> 02:10.550 Some of you might have heard of it. 02:10.670 --> 02:13.170 Here is the web page for Boeing. 02:13.230 --> 02:14.450 Another fun company. 02:14.450 --> 02:15.790 You might have heard of it. 02:15.810 --> 02:19.170 Let's see what the hashes of these two pages... 02:25.680 --> 02:29.200 Let's see what the hashes of those two pages happen to be. 02:31.380 --> 02:32.560 C0F3AD. 02:33.240 --> 02:34.600 C0F3AD. 02:34.960 --> 02:39.140 These two web pages have the exact same hash. 02:39.520 --> 02:41.680 How could that have happened? 02:42.700 --> 02:46.560 Oh, I know you like the hash. 02:50.800 --> 02:53.820 I was wondering how you came up with that shit, man. 02:53.820 --> 02:55.060 Holy crap. 02:55.060 --> 02:59.560 Okay, I have to actually turn off my email client this time. 02:59.680 --> 03:03.920 I had people using their Blackberry on me the last time I did this talk. 03:04.500 --> 03:06.320 That was really annoying. 03:07.360 --> 03:09.280 So what is MD5 supposed to do? 03:09.340 --> 03:11.980 MD5 is supposed to be basically a data fingerprint. 03:12.020 --> 03:15.220 You know, you got some file, however big it happens to be. 03:15.220 --> 03:18.640 The end result is supposed to come down to 128-bit signature. 03:18.640 --> 03:26.780 The magic word is computationally infeasible to find two files with the same hash. 03:26.800 --> 03:30.420 Now, we've known since about, what was it, 96, 97? 03:31.280 --> 03:32.320 Bullshit. 03:33.380 --> 03:40.480 And, you know, about 2004, Zhang Yun Wang over in China said, Hell yeah, that's bullshit. 03:40.480 --> 03:42.580 Here's two files with the same hash. 03:42.580 --> 03:45.240 And you know what the response was from a lot of people? 03:45.240 --> 03:47.780 Yeah, there you have two hashes. 03:47.780 --> 03:54.180 But you could never use that for actual production data that had any kind of real-life meaning. 03:54.400 --> 03:56.400 Absolutely not. 03:58.340 --> 04:02.260 Okay, hype aside, I do actually try to have some technical data. 04:02.260 --> 04:04.160 So here's what the story is. 04:04.500 --> 04:06.300 MD5, it's pretty simple. 04:06.640 --> 04:08.480 You start out with some initial state. 04:08.480 --> 04:12.720 And they use magic numbers like pi and 6, 7, 8, 9, 1. 04:12.720 --> 04:14.740 You know, numbers decreasing, whatever. 04:15.020 --> 04:19.380 I'm too drunk to go 9, 8, 7, 6, 5, 4, 3, 2, 1. 04:19.380 --> 04:20.880 I've got a problem. 04:21.440 --> 04:24.820 More than that, I gotta drink. 04:31.260 --> 04:35.820 Oh, the way this works at my talks, I like questions. 04:35.840 --> 04:38.580 Ask a good one, and you get to drink. 04:38.700 --> 04:41.300 And if I can't answer, I have to drink. 04:41.300 --> 04:45.860 And, you know, if I'm not done drinking, well, that's the drinking game. 04:46.820 --> 04:49.240 So, MD5 basically is really simple. 04:49.240 --> 04:50.440 Start with some state. 04:50.700 --> 04:53.500 You loop over all your data, 512 bits at a time. 04:53.500 --> 04:55.040 And it shuffles that state. 04:55.140 --> 04:57.240 And at the end, you end up with some value. 04:57.240 --> 05:00.460 You mix in, like, the amount of data that you did, some metadata. 05:00.460 --> 05:03.400 And you end up with what's called the MD5 hash. 05:03.400 --> 05:07.500 Now, the idea is, anything's different in the input data. 05:07.500 --> 05:12.740 A single bit should cause half the output bits in the hash to change. 05:13.160 --> 05:13.840 Half. 05:13.840 --> 05:14.900 It's a big number. 05:15.800 --> 05:19.800 What we have here is a visualization of the internals of MD5. 05:19.800 --> 05:23.180 You know, we've got 64 sub-rounds and 3 rounds. 05:24.060 --> 05:26.340 Half of those things are supposed to be flickering. 05:26.340 --> 05:28.060 Now maybe you can't see the flicker. 05:28.560 --> 05:30.360 You see those little dots? 05:30.360 --> 05:32.460 There's supposed to be a hell of a lot more. 05:32.780 --> 05:36.500 But, you know, we've got the Chinese girl, so, you know, guess what? 05:36.500 --> 05:38.320 Almost none of them are different. 05:38.320 --> 05:40.760 You know, first round, second round. 05:40.760 --> 05:43.200 By the third round, nothing is different. 05:43.200 --> 05:47.080 That's this big advance of this, you know, this new MD5 attack. 05:47.280 --> 06:00.780 And what's interesting is, once you have two files with the same hash, because it operates 512 bits at a time, once you do end up at an alignment, you can add new stuff. 06:00.780 --> 06:06.700 And it's not like you can go back in time, back to earlier in the file and say, hey, wait, it was different earlier in the file. 06:06.700 --> 06:11.540 Because you're never supposed to have a collision, because that's what the whole point of a hash is. 06:11.540 --> 06:19.580 So in mathematical terms, if MD5 of X equals MD5 of Y, MD5 of X plus Q, that's going to equal MD5 of Y plus Q. 06:19.600 --> 06:26.200 So that means if we have two files with the same hash, we can append anything we want to it, including webpages. 06:26.420 --> 06:30.140 Funny thing about web browsers, who here has written a crappy webpage? 06:31.800 --> 06:33.100 Thank you! 06:33.100 --> 06:36.580 All of you who haven't raised your hands are fucking liars. 06:37.960 --> 06:40.680 Web browsers accept everything. 06:40.680 --> 06:42.520 That was one of the big advances. 06:42.520 --> 06:46.980 You can put a turd in your fucking webpage that's going to render something. 06:47.300 --> 06:51.680 And it turns out we can even put these two files that have the same hash. 06:51.680 --> 06:57.980 But not only do they render anything, oh, there's a programming environment, we got JavaScript. 06:58.040 --> 06:59.860 Speaking of turds... 07:02.260 --> 07:05.820 The browsers accept everything and they are programmable. 07:05.820 --> 07:07.300 So this is what we're going to do. 07:07.860 --> 07:10.120 By the way, GraphViz is the code to use all this. 07:10.120 --> 07:11.060 It's freaking cool. 07:11.380 --> 07:13.800 So what we do is we take some file. 07:14.440 --> 07:16.040 This is X, this is Y. 07:16.040 --> 07:17.640 These are our two files with the same hash. 07:17.640 --> 07:21.120 We are going to prepend our file with one of these. 07:21.200 --> 07:23.220 And we're going to put some extra crap on. 07:23.220 --> 07:25.920 Remember, we can put anything on and it will have the same hash. 07:25.920 --> 07:28.700 Where did my mouse go? 07:29.160 --> 07:29.980 Here we are. 07:29.980 --> 07:32.480 Here's the first webpage, Lockheed Martin. 07:32.480 --> 07:34.340 Here's the second page, Boeing. 07:34.340 --> 07:36.580 And now we have some JavaScript. 07:36.840 --> 07:42.160 Now the idea is that MD5 is blind because all this crap is Q. 07:42.160 --> 07:44.380 X, Y, all this crap is Q. 07:45.260 --> 07:49.100 MD5 is blind but we can put a program in that isn't. 07:49.340 --> 07:52.880 So the program goes back and goes, Ah, fuck, I was put on X. 07:52.880 --> 07:54.040 Okay, Lockheed. 07:54.040 --> 07:56.240 Hey, look, I was put on Y. 07:56.240 --> 07:57.220 Shows Boeing. 07:57.380 --> 07:58.640 And that's your output. 07:59.000 --> 08:05.920 And so that, in a nutshell, is how Lockheed Martin and Boeing can have the same MD5 hash. 08:12.090 --> 08:15.850 That was a lot of stuff that had nothing to do with packets. 08:16.070 --> 08:18.450 Okay, I better get back to this shit. 08:20.450 --> 08:24.670 I need to have my little segue that's all smooth and elite and whatnot. 08:24.670 --> 08:27.570 You know, we're talking about interpretation. 08:27.590 --> 08:33.390 Speaking of other things that have to do with fucked up interpretation, God damn, I really should not be doing this drunk. 08:34.810 --> 08:37.550 You bastards, you moved my talk up. 08:38.030 --> 08:42.170 Alright, yes, you put my talk at the same time it said in the schedule. 08:44.490 --> 08:53.530 IP fragmentation, and I quote, Fragmentation, an interesting early architectural error that shows how much experimentation was going on while IP was being designed. 08:53.530 --> 09:00.650 Quote by Paul Vixie, someone who I truly expected to kick my ass when I first met him, but it turns out he's about as fucked up as I am. 09:00.650 --> 09:01.510 Sweet. 09:02.510 --> 09:04.830 So, what is fragmentation all about? 09:04.830 --> 09:08.950 Well, IP packets can be like 65 kilobytes long. 09:09.330 --> 09:13.150 Okay, there is no physical network that can send a 65 kilobyte packet. 09:13.150 --> 09:16.010 Well, okay, none that's actually used in common usage. 09:16.010 --> 09:23.130 So, the idea behind IP fragmentation is we can take these ginormous packets and shrink them down into little chunks. 09:23.210 --> 09:23.950 Fragments. 09:23.950 --> 09:25.250 It's fairly straightforward. 09:25.670 --> 09:26.890 Why is this a problem? 09:27.270 --> 09:29.890 The whole idea with IP is that it's supposed to be stateless. 09:29.890 --> 09:32.010 You got a packet, you send it, you move the fuck on. 09:32.550 --> 09:44.990 With fragments, hey, you know, you can send fragments and not have to worry about it, but when you receive them, you have to store these things, because you get one fragment and later on you might get another and another and maybe you will and maybe you won't, 09:44.990 --> 09:47.910 but the point is you got to keep this stuff around in RAM. 09:47.990 --> 09:49.150 That's annoying. 09:49.730 --> 09:52.770 Not just as annoying, it's about 98. 09:52.770 --> 10:01.450 Tim Newsham and Tom Pacek actually showed, look, we can get around like every IDS out there by just doing strange games with our fragmentation. 10:01.450 --> 10:03.110 We have overlapping fragments. 10:03.110 --> 10:05.510 You know, this fragment says it has the same data as that one. 10:05.510 --> 10:08.630 Which one is going to be, you know, what is the correct interpretation? 10:08.630 --> 10:10.930 The RFCs are just like, fuck if I know. 10:10.930 --> 10:15.250 And then FragRouter comes out and is just like, no, really, we can kick your ass. 10:15.250 --> 10:16.090 Here, watch. 10:16.990 --> 10:19.290 And so this is like 98, 99. 10:19.290 --> 10:21.090 This is old shit, right? 10:21.590 --> 10:23.830 Look, IP has been picked clean. 10:23.830 --> 10:25.770 There's a reason I moved on to DNS. 10:25.770 --> 10:28.410 Because, like, layer 3 and 4 are done. 10:29.850 --> 10:30.970 So I thought. 10:32.490 --> 10:37.450 In the crypto realm, you know, I did all this stuff with OpenSSH, you know, we've been dealing with timing attacks lately. 10:37.450 --> 10:40.690 All this crypto is all vulnerable to, like, how long things take. 10:40.690 --> 10:41.790 And I'm thinking about this. 10:41.790 --> 10:44.770 I'm going, I wonder if I can apply timing stuff to IP. 10:44.770 --> 10:47.530 And it turns out, oh, yes. 10:47.670 --> 10:51.770 It turns out there's an IP fragment reassembly timer. 10:51.810 --> 10:54.250 It turns out that there's only a certain amount of time. 10:54.250 --> 10:55.710 Are you pointing at me? 10:55.990 --> 10:57.430 What are you pointing at me? 10:57.430 --> 10:58.530 Oh, now you're the middle finger. 10:58.530 --> 10:59.630 What is this shit? 11:00.850 --> 11:02.650 Oh, I'll take this opportunity. 11:02.810 --> 11:08.450 So speaking of pointing, there's all these shirts that have me pointing that say scanran motherfucker. 11:09.250 --> 11:11.770 And it's done by the TorCon sluts. 11:14.030 --> 11:15.890 Hey, you've got a new title. 11:15.890 --> 11:17.230 Would you rather be a goon? 11:17.230 --> 11:18.750 Should have had a better t-shirt. 11:22.670 --> 11:24.230 TorCon is absolutely rad. 11:24.230 --> 11:25.930 I've loved that con for years. 11:25.930 --> 11:27.470 And , you know, they have these shirts for me. 11:27.470 --> 11:31.330 So speaking of good questions, good questions get a shirt. 11:32.230 --> 11:34.050 And trashed off your ass. 11:34.550 --> 11:34.830 What? 11:34.830 --> 11:36.270 I can't be the only one. 11:37.030 --> 11:38.410 So, okay, look. 11:38.410 --> 11:40.830 IP fragment reassembly timer. 11:40.890 --> 11:43.710 Basically, these fragments come in. 11:43.770 --> 11:46.450 And we can't reassemble the packet because we don't have all of them. 11:46.610 --> 11:48.790 Eventually, the system gives up, right? 11:48.850 --> 11:52.190 Well, how long is it going to wait before it gives up? 11:52.190 --> 11:55.570 Well, it turns out we can fingerprint operating systems with that value. 11:55.570 --> 11:57.230 You know, some things will wait 30 seconds. 11:57.230 --> 11:58.790 Some things will wait two minutes. 11:58.970 --> 12:00.850 You know, boom, OS fingerprint. 12:00.870 --> 12:01.630 Ooh. 12:01.810 --> 12:02.850 But that's easy. 12:02.850 --> 12:03.410 That's cheap. 12:03.410 --> 12:05.450 Let's go ahead and do some more hardcore stuff. 12:05.450 --> 12:06.170 All right. 12:06.530 --> 12:08.530 What if you have an IDS? 12:08.690 --> 12:16.890 An IDS may very well have a different idea of how long a fragment can live before it just gives up on trying to reassemble it. 12:16.890 --> 12:18.470 In fact, this is actually true. 12:18.470 --> 12:21.190 Linux and FreeBSD have a 30-second timer. 12:21.190 --> 12:24.190 Snort's frag2 timer will wait 60 seconds. 12:24.430 --> 12:33.550 Now, if the timer was less, if the IDS was going to keep fragments around for less time, well, hell, you know, we just send fragments too slow for the IDS but fast enough for the host. 12:33.550 --> 12:35.290 But what if it's the other way around? 12:35.290 --> 12:45.330 What if the IDS, because it's all hardcore and, you know, it's going to keep things around for as long as it possibly can, what if the IDS keeps fragments around longer? 12:45.370 --> 12:45.950 Ooh. 12:45.950 --> 12:47.230 We can do some stuff. 12:47.550 --> 12:50.310 The problem is, it's keeping stuff around longer. 12:50.310 --> 12:54.070 How are we supposed to make the host see one thing and the IDS see another? 12:54.170 --> 12:57.850 Well, our problem is the IDS is keeping fragments around for too long. 12:57.850 --> 12:58.910 Our solution? 12:58.950 --> 13:01.390 Make the IDS drop our fragments. 13:01.730 --> 13:03.010 Well, that sounds really easy. 13:03.010 --> 13:03.830 How are we going to do that? 13:03.830 --> 13:09.250 Well, there are two ways a fragment leaves the reassembly queue. 13:09.250 --> 13:13.850 Either A, it times out, or B, it's reassembled against something. 13:14.010 --> 13:15.050 Hmm. 13:15.630 --> 13:17.170 I like that B. 13:17.170 --> 13:22.590 I like the idea that it's just going to work, but not the way it plans to. 13:23.770 --> 13:25.330 Watch this. 13:25.590 --> 13:26.790 Here's what we're going to do, right? 13:26.790 --> 13:27.390 Look. 13:27.390 --> 13:28.370 Take our payload. 13:28.370 --> 13:30.210 Up to 65 kilobytes. 13:30.210 --> 13:33.690 We are going to split it into a whole bunch of fragments. 13:33.690 --> 13:35.590 We're going to take the even-numbered fragments. 13:35.590 --> 13:36.650 We're going to make a copy of them. 13:36.650 --> 13:39.510 And we're going to fill those fragments' payload with noise. 13:40.230 --> 13:41.430 Absolute crap. 13:42.210 --> 13:45.370 And we're going to send this absolute crap. 13:45.390 --> 13:46.250 And you know what we're going to do? 13:46.250 --> 13:47.450 We're going to wait. 13:47.830 --> 13:49.170 So we send the crap. 13:49.490 --> 13:51.530 And the host has some crap. 13:51.550 --> 13:53.770 And the IDS has some crap. 13:53.810 --> 13:55.690 But you know what happens after 30 seconds? 13:55.690 --> 13:57.850 The host drops the crap. 13:57.850 --> 14:01.490 But the IDS, it likes the crap. 14:01.570 --> 14:03.350 It keeps it around. 14:03.350 --> 14:05.350 It thinks it might be useful. 14:05.350 --> 14:08.110 Oh, and indeed, it is useful. 14:08.110 --> 14:12.010 Because we go ahead and we send the odd-numbered fragments. 14:12.010 --> 14:16.130 And the odd-numbered fragments go to the host, and the host has nothing. 14:16.130 --> 14:22.090 So the host holds on to these odd-numbered fragments and says, Well, you know, gotta wait for some stuff in the future. 14:22.250 --> 14:23.610 IDS, no. 14:24.150 --> 14:26.490 IDS has been holding on to some crap. 14:26.490 --> 14:31.630 So the IDS has crappy even and good odd. 14:31.630 --> 14:32.570 It reassembles. 14:32.570 --> 14:34.510 It's like, what the hell is this? 14:34.570 --> 14:36.850 And it drops it on the floor. 14:37.650 --> 14:42.130 Ah, but now we send the legitimate even-numbered fragments. 14:42.670 --> 14:51.810 And the IDS, well, it already dropped all that stuff from before on the floor, so the IDS now has to keep it in its cache. 14:52.310 --> 14:53.710 But the host? 14:53.710 --> 14:55.550 Host has legitimate even. 14:55.550 --> 14:57.330 Host has legitimate odd. 14:57.410 --> 14:59.830 Host reassembles just fine. 15:00.710 --> 15:02.070 And then you win. 15:09.200 --> 15:11.360 And now my favorite line. 15:11.460 --> 15:13.620 It gets worse. 15:15.400 --> 15:18.160 Right now, we're giving the IDS crap. 15:18.380 --> 15:20.440 Well, IDSs are meant to look for crap. 15:20.440 --> 15:21.740 They might alarm. 15:21.740 --> 15:23.220 They might be worried. 15:23.280 --> 15:29.120 Is there a way we can, instead of giving it crap, can we make the IDS see something completely different? 15:29.120 --> 15:33.920 You know, like, the IDS sees a get slash, and the host sees a SQL injection attack? 15:34.680 --> 15:35.500 Ooh. 15:37.280 --> 15:38.900 Here's what we're going to do. 15:39.360 --> 15:49.000 Now, get slash has some headers, and the SQL injection attack has some headers, and it turns out a fair amount of these headers can be exactly the same. 15:49.000 --> 15:53.620 So what we're going to do is we're going to split our stuff into three packets. 15:53.660 --> 15:57.960 A common header, good stuff, and you're going to die. 15:57.960 --> 16:04.000 And what we do is the first thing we send is, you're going to die. 16:04.720 --> 16:05.240 No, no, excuse me. 16:05.240 --> 16:05.440 No, no. 16:05.880 --> 16:06.820 That's later. 16:06.820 --> 16:08.440 We're going to send the good stuff first. 16:09.180 --> 16:11.040 Good stuff goes first. 16:11.180 --> 16:11.740 You know why? 16:11.740 --> 16:14.020 Because I want the IDS to see some good stuff. 16:14.040 --> 16:16.900 I want to give it some happy, nice feelings. 16:17.560 --> 16:18.500 No problem. 16:18.500 --> 16:20.660 I would never attack you. 16:21.920 --> 16:23.200 So here's what we're going to do. 16:23.200 --> 16:25.660 So we send the good stuff, and we wait. 16:25.660 --> 16:28.480 And we wait long enough so the host goes, fuck this good stuff. 16:28.480 --> 16:29.600 It drops it. 16:29.940 --> 16:38.160 But the IDS still has it around, and we send the shared common header, and the IDS goes, I got the header, and it's nice, and I got the good stuff, and it's nice. 16:38.260 --> 16:43.040 So it assembles and says, hey, this guy just asked for a git slash. 16:43.040 --> 16:44.040 He's cool. 16:44.880 --> 16:49.140 But the host still has, at this point in time, where's the host at? 16:49.140 --> 16:50.440 The stuff in its header. 16:51.080 --> 16:54.800 Just the header packet, because it already dropped the good stuff. 16:54.800 --> 16:58.700 But it has the header, and now we give it the evil packet. 16:59.040 --> 17:01.980 And what happens when the header meets the evil packet? 17:03.240 --> 17:05.540 Reassembles a SQL injection exploit. 17:05.540 --> 17:06.680 You win. 17:09.930 --> 17:10.910 What's up? 17:14.310 --> 17:15.510 Quite a few. 17:16.750 --> 17:18.970 So, what about checksums? 17:20.390 --> 17:21.970 There's a problem. 17:21.970 --> 17:30.510 Our hosts may actually go ahead and, you know, SQL injections should not have the same checksum as git slash, right? 17:30.510 --> 17:32.290 I mean, there's 65,000 possibilities. 17:32.290 --> 17:34.550 Why would the things match up? 17:34.550 --> 17:36.750 Well, it turns out, there's this great book. 17:36.750 --> 17:40.370 It's called TCPIP Lean, by this guy, Jeremy Bentham. 17:40.470 --> 17:41.550 It's hardcore. 17:41.750 --> 17:43.150 I ain't saying it's hardcore. 17:43.150 --> 17:46.630 Like, the guy debugs Ethernet with an oscilloscope. 17:46.630 --> 17:48.350 That kind of hardcore. 17:49.270 --> 17:50.130 So, look. 17:50.130 --> 17:51.030 He's got this thing. 17:51.070 --> 17:57.770 He's dealing with hardware that doesn't have enough RAM to have an entire packet in RAM at the same time. 17:57.930 --> 17:59.530 Holy crap! 18:00.590 --> 18:02.850 So, he talks about how you do this stuff. 18:02.850 --> 18:04.890 He says, well, you know, your checksum. 18:04.890 --> 18:07.690 You don't want to have to go and go over all your data. 18:08.130 --> 18:12.670 How do we go ahead and stream out a packet and not have to worry about the checksums? 18:12.670 --> 18:15.370 Well, the idea is you put in the wrong checksum. 18:15.690 --> 18:17.750 But there's a funny thing about IP checksums. 18:17.750 --> 18:18.610 They're crap. 18:19.430 --> 18:20.130 They are. 18:20.130 --> 18:20.850 They really suck. 18:20.850 --> 18:21.950 They're just a one's compliment. 18:21.950 --> 18:23.810 They're just like adding numbers, right? 18:23.950 --> 18:25.770 So, there's a really funny thing you can do. 18:26.050 --> 18:32.910 At the end of your payload, you can be like, wow, I'm like 32,000 off from what my checksum should be. 18:32.990 --> 18:35.690 And so, you like, you know, add a little bit of a comment. 18:35.810 --> 18:37.730 Fix by 32,000. 18:38.130 --> 18:39.430 And it works. 18:40.150 --> 18:46.710 So, you just do that, and now you're going to have a constant checksum for different payloads. 18:47.550 --> 18:55.110 We can actually backport this attack to all the original mechanisms used by PatchEck and Nooshum and Song. 18:55.110 --> 19:00.630 And it turns out what we can do, and I haven't built this one yet because I really fucked up my arm. 19:00.630 --> 19:02.230 Be happy I'm here at all. 19:03.350 --> 19:10.690 But it turns out you could actually send a series of packets such that on Linux, they assemble into a Linux exploit. 19:10.690 --> 19:13.430 And on Windows, they assemble into a Windows exploit. 19:13.430 --> 19:19.430 And all because there's a whole bunch of different ways that IP stacks can reorganize data. 19:19.450 --> 19:34.270 And you could actually, and I haven't built this yet, and I'm fully honest, you could actually create a sequence of packets such that when they arrive on the host, the particular host being used will reassemble it into a way that is relevant for that host. 19:34.270 --> 19:36.750 And you don't even need to get any kind of feedback back. 19:36.750 --> 19:37.710 It's kind of cool. 19:38.510 --> 19:40.330 Now, hitting the brakes. 19:40.330 --> 19:43.950 There's a couple IPS vendors out there who are like, dude, you're full of crap. 19:43.950 --> 19:51.730 Because our stuff is going to see you, it's going to see these overlapping fragments, we're going to deal with you, and we're going to shut your session down. 19:51.950 --> 19:54.130 Shut my session down, that's not nice. 19:54.430 --> 19:58.610 And not only is it not nice, there's not a lot of people who are going to be able to do that. 19:58.610 --> 20:00.030 That's really unique. 20:00.850 --> 20:01.290 And... 20:03.690 --> 20:05.670 Some jackasses, actually. 20:05.850 --> 20:08.710 Complete and utter fucking jackasses. 20:11.230 --> 20:13.050 Alright, no, I'm kidding. 20:14.530 --> 20:15.650 Anyway. 20:17.310 --> 20:22.170 Look, there's a funny little thing that happens when you block a session. 20:22.930 --> 20:25.250 You send a bit of information. 20:25.310 --> 20:31.450 I blocked you, I stopped you, I got in your way, I'm telling you I'm here and I'm getting in your way. 20:31.570 --> 20:34.450 Yo, that's a fingerprint. 20:35.390 --> 20:43.030 It turns out that anytime an intrusion detection system or a firewall gets in your way, it has actually identified itself. 20:43.030 --> 20:47.010 Because there's about a million different ways that these things can go ahead. 20:47.070 --> 20:48.430 Do they block invalid checksums? 20:48.430 --> 20:49.670 Do they block invalid options? 20:49.670 --> 20:51.270 Do they block invalid ICMP types? 20:51.270 --> 20:52.290 How about HTTP? 20:52.290 --> 20:53.330 How about SQL injection? 20:53.330 --> 20:54.810 How about SQL injection of this type? 20:54.810 --> 20:56.530 How about invalid DNS packets? 20:56.530 --> 20:58.230 How about tipping point? 20:58.230 --> 21:00.710 Oh, you sent a TCP fragment out of order. 21:00.710 --> 21:04.210 We're going to drop you on the floor because we don't like RFCs. 21:04.210 --> 21:05.770 They're overrated. 21:06.950 --> 21:08.110 Or checkpoint. 21:08.110 --> 21:09.870 Oh, you're using DNSSEC. 21:09.870 --> 21:11.690 That's never going to be feasible. 21:11.690 --> 21:23.210 Point is, you can go ahead and identify pretty much every firewall and every intrusion protection system based on whether, in a given session, if you do something it doesn't like, if it kills your session. 21:23.290 --> 21:31.190 And it turns out you can find out the precise hop that the IDS and IPS is at by using Mike Schiffman's firewalk method. 21:31.190 --> 21:38.730 Which is basically, you go ahead and you send your nastiest off one hop before the firewall and then you send it one hop after. 21:38.730 --> 21:43.430 If your session dies one hop after, you know the hop where the firewall lives at. 21:43.770 --> 21:45.790 Hi, how you doing? 21:45.830 --> 21:47.670 Not that this is anything wildly new. 21:47.670 --> 21:49.790 This is a slide from like 2003. 21:50.250 --> 21:54.330 And it basically shows you how you detect a PIX firewall. 21:54.690 --> 22:04.070 And I'm not giving any details, but if anyone ever tells you it's ever impossible to remotely detect a firewall, dude, I've been doing it for like two years. 22:04.910 --> 22:11.270 So I can't say what that's in reference to, but you can always detect a firewall remotely. 22:11.270 --> 22:15.250 There's just too many different variations on how the protocol can be broken. 22:16.390 --> 22:16.910 So... 22:17.710 --> 22:19.270 IP shunning. 22:19.410 --> 22:23.970 Turns out, a bunch of intrusion protection systems, they are, they're acting all hardcore. 22:23.970 --> 22:31.110 You mess with them a little too much, they're going to block your IP entirely because they're like, well obviously your IP is evil. 22:31.310 --> 22:36.210 And, you know, it's not like anyone ever spoofs IP addresses. 22:36.470 --> 22:37.970 Lies about who they are. 22:37.970 --> 22:40.270 Oh, nobody ever does that. 22:40.450 --> 22:46.930 Let me tell you why it's a really bad idea to block traffic that comes from random IP addresses on the internet. 22:46.930 --> 22:48.570 Anyone ever type dig? 22:48.630 --> 22:52.330 You know, that whole like domain internet grouper DNS thing? 22:52.330 --> 22:55.910 Here's a couple hosts, you might have heard of them, they're called the root servers. 22:56.030 --> 22:58.430 If you can't talk to them, you're fucked. 23:05.810 --> 23:15.510 So like anyone who's running these IPS's is like, hello internet, here is my firewall rule set, would you like to submit new rules? 23:16.010 --> 23:19.330 By any chance, would you like to knock my stuff down? 23:19.330 --> 23:20.310 We'll talk after. 23:20.950 --> 23:22.710 It's like, seriously? 23:23.190 --> 23:30.690 Now, you know, I'm showing this stuff and yeah, you can knock out any of these networks by just like, you know, hi, I'm 128 810 90. 23:31.110 --> 23:33.490 I'm trying to slammer you. 23:36.150 --> 23:40.030 But oh, I can't stop here. 23:40.390 --> 23:48.090 I can't stop here, because it is too large scale, and more importantly, I thought it was all cool, but it's been whispered about for years. 23:48.650 --> 23:55.890 And you know, I can't go ahead and take full credit for something people have been talking about, so let's do a little bit more elegant attack. 23:55.930 --> 23:58.110 Again, it gets worse. 23:59.370 --> 24:01.630 I've been investigating DNS poisoning. 24:01.630 --> 24:02.750 I've been investigating a lot. 24:02.750 --> 24:06.750 Does anyone here know, oh, hang on, we'll deal with that later. 24:06.790 --> 24:09.410 But I've been investigating DNS poisoning quite a bit. 24:09.670 --> 24:11.370 Four billion packets, quite a bit. 24:12.410 --> 24:25.610 Is it possible, given these networks that implement automatic network shunning, to not just like, knock them off the network, but to poison their name servers, to go ahead and redirect traffic from their network arbitrarily? 24:25.790 --> 24:27.210 Oh, yeah. 24:27.850 --> 24:29.930 Well, there's a funny thing. 24:29.930 --> 24:33.250 I showed you before, we will block you from the name servers. 24:33.250 --> 24:34.330 And that's nice. 24:34.330 --> 24:35.730 But let's do worse. 24:35.730 --> 24:38.790 Let's block them from individual name servers. 24:38.790 --> 24:45.410 Not the root, but say, hey, large ISP, see that big bank all your customers go to? 24:45.410 --> 24:48.310 Yeah, we don't want them to do that. 24:48.450 --> 24:49.470 And how can you do that? 24:49.470 --> 24:57.470 Well, block the communication between the name server at the ISP and the name server at the bank. 24:57.470 --> 24:59.790 And there are two sides you can do the blocking. 24:59.790 --> 25:00.370 You can cause the 25:04.590 --> 25:05.010 ISP... 25:05.010 --> 25:06.070 God damn! 25:19.610 --> 25:21.570 Humberdink, I believe I am out. 25:23.050 --> 25:25.110 Hey, I drank everything that was there. 25:25.110 --> 25:26.410 I think you need a drink. 25:27.930 --> 25:32.650 So, there are, you can block at the ISP side, you can block at the bank side. 25:32.650 --> 25:33.750 Both ways. 25:33.750 --> 25:33.850 Humberdink , 25:38.930 --> 25:39.810 no. 25:43.570 --> 25:46.550 So, only if I really screw up. 25:47.550 --> 25:50.430 In which case, you are having a shot with me up here. 25:51.190 --> 25:55.130 So, general theme is to block communication between any two name servers. 25:55.130 --> 25:57.450 You can block at either the server or the client side. 25:58.510 --> 26:03.230 All right, let's say you spoof malicious traffic from the client network to the server network. 26:03.230 --> 26:06.970 So, say, the big bank no longer likes podunk ISP. 26:07.430 --> 26:08.050 All right? 26:08.050 --> 26:14.370 That means podunk ISP sending out requests and nothing's coming back. 26:14.430 --> 26:15.210 All right? 26:15.390 --> 26:17.010 You know, let's think about that for a second. 26:17.010 --> 26:20.830 We got about, assuming a fixed port, we'll talk about that in a second. 26:20.850 --> 26:25.650 We got about 65,000 possibilities for what the transaction ID is going to be. 26:25.650 --> 26:32.870 The transaction ID, of course, controls whether or not when I spoof a packet, it actually is going to get blindly accepted. 26:33.470 --> 26:37.210 Well, kind of funny, is usually it's called a race condition. 26:37.210 --> 26:43.110 I would have to get my fake reply back before the real reply comes back. 26:43.110 --> 26:46.490 But you know what happens when the intrusion protection systems are in place? 26:46.490 --> 26:53.710 Well , it's a race, but I took a bat and knocked out the other guy's kneecap, so he's not running anymore. 26:54.770 --> 27:04.370 So , I got about an average of 32,000 packets to do and instead of about 100 milliseconds, I can do it, like, about as long as I freaking want. 27:05.470 --> 27:10.010 Moral of the story, do not automatically shun IPs. 27:10.010 --> 27:12.630 But, you know, I can do the other side. 27:12.650 --> 27:16.510 I can also spoof malicious traffic from the server network to the client network. 27:16.510 --> 27:21.250 So, you know, use some podunk ISP and it's like, holy crap, the bank is trying to kill me! 27:21.650 --> 27:23.950 I paid my loan, man! 27:24.670 --> 27:35.070 Well, so, there's a little difference here, because you'd think if the ISP is no longer talking to the bank, well, you know, the ISP sends out the request and the reply comes back and the reply is blocked. 27:35.330 --> 27:42.070 But, if the reply, you know, you think, well, when I spoof stuff, it also has to be blocked, right? 27:43.070 --> 27:46.570 Funny thing about IP, there's no affinity. 27:46.750 --> 27:56.490 And by that I mean, IP addresses, you know, you can actually return a DNS, when you send out a DNS request, about 15% of the time some other guy replies. 27:56.490 --> 27:58.150 And it works. 27:58.710 --> 28:06.150 So that means, the legitimate host can't send you back replies, but the entire internet can be spoofing replies back. 28:06.150 --> 28:10.390 And they'll all work if their transaction ID is correct. 28:10.770 --> 28:11.690 Oops. 28:11.770 --> 28:15.570 Again, do not implement automated network shunning. 28:16.070 --> 28:27.550 But there are people who like it, and I'll go ahead and I'll say, okay, make sure you can talk to name servers, see if you can make it so your outbound communications override any automatic shunning. 28:27.670 --> 28:30.670 And, you know, again, do not touch name servers. 28:31.130 --> 28:33.410 But seriously, don't do this stuff. 28:33.410 --> 28:40.850 There's just 80 million ways that automatic shunning, you're giving, they're giving you guys access to their firewall table. 28:40.850 --> 28:42.950 What is wrong with these people? 28:43.570 --> 28:44.950 So don't do that. 28:46.130 --> 28:47.510 Go to the next slide. 28:47.590 --> 28:49.390 But what about complaint emails? 28:49.670 --> 28:54.710 You know, funny thing, you know, often they get assigned complaint emails and they negotiate and find out this stuff's going on. 28:54.710 --> 28:57.650 Well, funny thing happens when you block someone's name server. 28:57.650 --> 29:00.170 You can't send mail to that domain anymore. 29:00.690 --> 29:01.730 Oops. 29:02.250 --> 29:05.410 Now, what would I know about complaints? 29:05.410 --> 29:10.870 Well, when you send 4 billion IP packets, people can tend to notice. 29:11.970 --> 29:15.090 I've been working with these guys called Prolexic. 29:15.250 --> 29:15.710 And... 29:17.790 --> 29:19.430 God damn it. 29:27.020 --> 29:28.460 All right, look. 29:28.640 --> 29:33.740 So, basically, you know how you have these third-party spam filters? 29:33.740 --> 29:37.280 They get your mail and they send you the good stuff? 29:37.300 --> 29:39.020 These guys do that for IP. 29:39.300 --> 29:46.500 They announce your route and they take all the crap that you guys send and be like, that's a very nice 10 gig UDP flood. 29:46.500 --> 29:47.900 I'm going to filter that. 29:47.900 --> 29:52.240 These guys have just ridiculous amounts of extra bandwidth and they gave it to me. 29:53.780 --> 30:00.820 I've never actually been able to, like, I can't send packets faster than this network can route them. 30:00.820 --> 30:02.880 I feel like less of a man. 30:04.440 --> 30:10.840 I've been working with all sorts of cool people and, you know, I've been doing all sorts of stuff to be all legitimate. 30:10.840 --> 30:13.300 You know, don't do this at home. 30:13.300 --> 30:15.200 Your colo will die. 30:15.720 --> 30:16.780 I tried. 30:16.780 --> 30:18.520 It was out in an hour. 30:18.520 --> 30:26.020 You will get complaints and very scary people will be calling you personally and be like, what the hell are you doing? 30:26.180 --> 30:29.400 So seriously, I can't emphasize this enough. 30:29.400 --> 30:36.720 I'm doing this because there's a little problem with, you know, large scale network attackers having better intelligence on the network than I do. 30:36.760 --> 30:37.900 That's not cool. 30:38.740 --> 30:40.480 But yeah, don't do this at home. 30:40.920 --> 30:43.260 I've set up, you know, reverse lookups. 30:43.260 --> 30:44.640 I'm in Aaron. 30:45.500 --> 30:47.600 There's Dan Kaminski security research. 30:47.600 --> 30:49.220 How rad is that? 30:50.300 --> 30:51.520 Like abuse mails. 30:51.520 --> 30:53.660 Someone has hacked in your box. 30:53.920 --> 30:55.320 Dude, that's me. 30:57.780 --> 31:02.320 So yeah, you know, oh, best email is like, you know, thank you for your information. 31:02.480 --> 31:04.100 We will see you in Vegas. 31:04.100 --> 31:05.400 Like, oh, crap. 31:06.020 --> 31:06.820 Handcuffs. 31:09.380 --> 31:11.080 So, what do I want to do? 31:11.080 --> 31:14.680 I wanted to go ahead and find, you know, Google's taken out by some DNS poisoning attack. 31:14.680 --> 31:17.380 You know, who is actually hit by this thing? 31:17.380 --> 31:29.320 So, you know, we scan the world, the entire world, and we find somewhere between, we find actually 9 million name servers, but after the scan, only about 2.5 million of them would actually talk to me. 31:31.440 --> 31:32.560 Shit. 31:33.360 --> 31:42.560 Um, I needed to find, because it turns out you had to have a Microsoft server talking to a Windows server. 31:42.560 --> 31:46.120 No, excuse me, Microsoft server talking God damn it. 31:50.740 --> 31:55.980 Okay, the problem with this plan is, like, the more I drink, the more mistakes I'll make. 31:57.060 --> 32:00.260 Okay, so, I'm totally getting that ever clear. 32:00.980 --> 32:06.000 So, look, you have to have Windows servers who are linking to bind date servers. 32:06.000 --> 32:08.160 Fairly obscure situation, right? 32:08.360 --> 32:10.120 Um, okay. 32:10.120 --> 32:12.640 Well, how do we find that one server is linking to another? 32:12.640 --> 32:17.420 By linking, I mean, instead of going out and resolving it itself, it asks its buddy. 32:17.720 --> 32:19.480 How do we find these links? 32:19.840 --> 32:29.900 And, um, the way that I ended up using is basically to just ask everyone, hey, you know, hey you, go ahead, you know, what's your name? 32:29.900 --> 32:30.760 Your name's Bob? 32:30.760 --> 32:35.780 Go ahead and look up bob.madness.net and madness is a domain I own. 32:35.860 --> 32:41.500 If some guy named Charlie walks up to me, okay, I know Bob asked Charlie to look something up. 32:41.500 --> 32:44.660 So I know there's a link between those two domains and those name servers. 32:44.660 --> 32:46.180 That's how I did it. 32:46.640 --> 32:48.280 What were the end results? 32:48.760 --> 32:53.900 Um , well, we got about two and a half million verified name servers, meaning, um, they would still talk to me. 32:54.600 --> 33:04.560 And, uh, of those two and a half million, we used a tool called fpDNS, fingerprint DNS, and we fingerprinted every single one of them. 33:05.320 --> 33:08.020 Ooh, I got some emails out of that one. 33:08.560 --> 33:09.840 Ooh, crap. 33:09.840 --> 33:14.020 There are a lot of IDSs that are like, you tried to check version. 33:14.020 --> 33:16.660 How could you possibly do that? 33:16.660 --> 33:21.380 You know, your attack is detected by 100%. 33:22.660 --> 33:25.100 You know it without fail. 33:26.120 --> 33:28.420 Like, seriously, people did not like it. 33:28.420 --> 33:29.100 But you know what? 33:29.100 --> 33:38.800 We're dealing with security and, um, you know, we found about 230,000 hosts that are possibly broken, 13,000 that are definitely broken, and you know what? 33:38.800 --> 33:40.760 I'm going to be sending some emails. 33:41.120 --> 33:44.020 And we're going to get this problem dealt with. 33:44.240 --> 33:48.200 And incidentally, uh, scan was done in under a day. 33:48.480 --> 33:50.140 It's good to be the author of scanrand. 33:50.140 --> 33:51.560 I send packets fast. 33:51.680 --> 33:52.520 Fuck yeah. 33:52.520 --> 33:55.140 Oh, oh, who said that? 33:55.920 --> 33:56.460 Who said that? 33:56.460 --> 33:57.100 Oh. 33:57.900 --> 33:59.180 Hell yeah. 33:59.200 --> 34:00.300 Well, maybe not. 34:00.640 --> 34:02.600 Hey, someone get him that shirt. 34:04.700 --> 34:07.560 Um, I'm not replying. 34:08.540 --> 34:12.140 So look, kind of, uh, reversing the thing. 34:12.160 --> 34:14.660 Normally with an exploit, you're like, I've got this box. 34:14.660 --> 34:16.720 I wonder what it's vulnerable to. 34:16.800 --> 34:17.440 Reverse. 34:17.440 --> 34:20.400 Um, I wonder if someone fucked this up. 34:20.400 --> 34:22.140 Let's ask everyone. 34:23.140 --> 34:31.220 So I'm like, you know, I wonder, you know, there's these transaction IDs and if there's a known transaction ID, you can DNS spoof on demand. 34:31.220 --> 34:40.860 I wonder, is anyone using the same transaction ID when I make a request, when they go out to the outside world, does anyone use the same thing? 34:40.860 --> 34:42.240 Because that'd be really insecure. 34:42.240 --> 34:43.980 That'd be dumb. 34:43.980 --> 34:48.340 You'd have to be like, you know, one in a hundred thousand to be this dumb. 34:48.340 --> 34:52.760 But there's a funny thing that happens when you ask two and a half million people a question. 34:52.760 --> 34:55.360 You find the dumb ones. 34:55.820 --> 34:59.780 So there's like, uh, so we asked everyone with a fixed, you know, transaction ID. 34:59.780 --> 35:01.140 I had the data anyway. 35:01.140 --> 35:06.220 And we found about 110 hosts that are dumb. 35:06.320 --> 35:16.500 And of these 110 hosts, it's major vendors ADSL modem, so wow, look at all these networks I can completely own on demand. 35:16.700 --> 35:22.320 And the name server that I was using to host my own data. 35:24.830 --> 35:26.750 God dammit. 35:26.750 --> 35:31.230 In my defense, it was an old version, but oh yeah. 35:34.200 --> 35:34.760 So... 35:34.760 --> 35:36.220 Oh, fuck that. 35:38.770 --> 35:40.190 God dammit. 35:42.670 --> 35:43.790 Speaking of... 35:43.790 --> 35:47.590 You fucking assholes, I need to do the drinking game. 35:48.150 --> 35:49.090 Alright. 35:49.270 --> 35:50.210 I'm liking this. 35:50.210 --> 35:52.090 I may do all my talks smashed. 35:53.950 --> 35:55.150 Hello, sir. 35:55.150 --> 35:56.590 I'm drunk. 35:57.430 --> 36:00.550 I don't know how we never noticed this before. 36:02.010 --> 36:05.050 You know on TCP you can scan for servers? 36:05.470 --> 36:07.170 Well, UDP is a little different. 36:07.170 --> 36:10.270 There really is no difference between a client and a server. 36:10.790 --> 36:16.270 How did we not realize until 2005 that you can scan for client ports as well? 36:16.470 --> 36:21.110 Name servers very often have fixed ports that they send all their requests from. 36:21.110 --> 36:22.550 They use a single socket. 36:22.810 --> 36:26.930 And it turns out, you can scan for this client socket. 36:26.930 --> 36:29.590 You can find out who they're sending requests out to. 36:29.730 --> 36:31.450 And I'm like, well, what are these ports? 36:31.450 --> 36:36.190 I bet there's lots of servers that send out questions from a source port of 53. 36:36.630 --> 36:42.950 But you see, that's, I think, the nice thing about having ASLO to data is you can know. 36:42.950 --> 36:44.530 Let's look at the data. 36:44.530 --> 36:46.470 Oh, look at that. 36:46.950 --> 36:53.350 823 ,000 times the source port was 32,768 on an outgoing request. 36:53.590 --> 36:57.970 And 195 ,000 times it was 32,769. 36:57.970 --> 37:07.530 And 54 ,000 times, oh, you're telling me on a large portion of the internet infrastructure I can monitor load levels on remote name servers? 37:07.810 --> 37:08.930 Sweet. 37:10.350 --> 37:16.270 So, um, yeah, you should be running a name server that actually buries its local port. 37:16.810 --> 37:21.590 Other stuff, there's like a 15 minute chunk of DNS poisoning things I can't tell you about. 37:21.590 --> 37:24.630 But holy crap, someone's up to some nasty shit. 37:24.950 --> 37:26.070 Wow. 37:26.070 --> 37:28.250 And I wasn't even looking for it. 37:28.250 --> 37:29.890 It just accidentally came back. 37:29.890 --> 37:32.350 Hey, by the way, we're spoofing these guys. 37:32.650 --> 37:34.150 You're what? 37:35.110 --> 37:47.470 And it turns out there's all these systems that automatically investigate what the hell you're doing when you are sending 4 billion packets, but when they investigate they have no idea that the investigation comes back to you. 37:47.630 --> 37:58.310 So I've got traffic from really, really dark networks where it's just like, hi, there's no one within the rest of my class A, but who are you? 37:59.830 --> 38:00.970 No, no, no, no, no. 38:00.970 --> 38:02.450 Who are you? 38:05.470 --> 38:12.370 So, um, as long as we're sending assloads of traffic, can we make some pretty pictures? 38:12.370 --> 38:14.210 Because, you know, people like that. 38:14.290 --> 38:23.650 And so I've actually generated a methodology that goes ahead and create maps all internet routes in about a couple hours. 38:23.650 --> 38:25.990 It's really, really fast. 38:26.550 --> 38:31.870 And , um, you know, rather than just like hype, I'll show you the raw data as it's collected. 38:32.470 --> 38:38.050 And before anyone from DEF CON has a heart attack, this scan is happening from the 170 gigabit pipe. 38:38.650 --> 38:41.590 So we go ahead, we go into it. 38:45.880 --> 38:46.920 Boom! 38:47.700 --> 38:49.800 Hi, internet, how are you doing? 38:49.800 --> 38:53.440 We're sending out about 20,000 packets a second right now. 38:53.440 --> 38:57.960 And, um, we're tracerouting in this massive, uncontrolled manner. 38:57.960 --> 39:01.820 And lots and lots and lots and lots and lots of hosts are talking to us. 39:01.820 --> 39:03.340 That's a mess, right? 39:03.340 --> 39:05.340 How are we going to filter it? 39:05.340 --> 39:07.480 Well, welcome to SQL. 39:07.480 --> 39:10.280 Fun little language, lets us organize things. 39:10.280 --> 39:16.260 Once we run this stupid little query, you know, show me what, you know, reorder this until it makes sense. 39:16.400 --> 39:17.180 Oh, look! 39:17.200 --> 39:22.840 On the way to 12.10.41.178, here's all of our hops. 39:23.160 --> 39:26.020 And here's hop one, hop two, hop three, hop four. 39:26.020 --> 39:30.700 What you were seeing before was wildly disordered, and now we have it in order. 39:31.140 --> 39:33.140 And how do we define that two things are linked? 39:33.140 --> 39:41.380 Well, if that number's three and that number's four, then 67, you know, this host is probably connected to this host. 39:41.660 --> 39:47.760 Mind you, we're scanning the internet over a range of like two hours, so this is actually kind of cool to see it in some degree of order. 39:48.320 --> 39:55.180 And, um, what does this crap look, well, hang on, what does this look like when we actually get it said and done? 39:56.060 --> 39:57.860 Finally, I get to show some pretty pictures. 40:06.170 --> 40:07.210 I know. 40:08.450 --> 40:09.710 I'm well aware. 40:16.180 --> 40:22.540 So this data's been around for a while, but, uh, being able to zoom in on it is kind of new. 40:23.820 --> 40:30.300 And, uh, being able to, like, tilt it down and, you know, raise it up and, like, fly around. 40:30.300 --> 40:36.920 Everyone, you know, Hollywood really wants someone to do this, so fine, here, I'm flying around the internet, ain't that rad? 40:46.360 --> 41:01.220 Now the eventual goal, and this will happen sometime in the next couple of months, yeah, I really broke my arm, um, but the goal is that we can go ahead and we can take live data and we can go ahead and plot it so this is all black and white and as you actually use the net, 41:01.220 --> 41:06.120 it goes, you're going over this path, you're going over this path, here's all the constraints and all that kind of stuff. 41:06.120 --> 41:09.700 And that's the kind of data I want to be able to, you know, collect. 41:09.720 --> 41:23.120 It turns out when you do this kind of large mapping, there's a couple things you can do extra, um, whenever, you know, we have to scan up to a certain range, if we actually find someone, you know, at the, you know, the farthest away possible, we can go back, 41:23.120 --> 41:38.140 fill in the gaps, um, we can actually go ahead and, you know, put out senders all over the internet and have all the reception happen at the same point, so we can say, here's how the net looks from China, here's how the net looks from Japan, here's how the net looks from Abu Dhabi, 41:38.140 --> 41:43.020 and all of it will come back to the same collector, and we can go ahead and we can integrate the data. 41:43.400 --> 41:48.800 Um , and the results look pretty cool, but there is, there is a weakness. 41:49.300 --> 41:51.180 Yeah, how are we going to make this useful? 41:51.180 --> 41:57.380 And beyond that, I don't want to have to do this big preprocessing phase, I would like to graph live data. 41:57.380 --> 41:58.860 How could I do that? 41:59.140 --> 42:07.620 Well, there's these guys, they wrote some code in C++, it makes my nose bleed, but it's really, really cool. 42:07.620 --> 42:14.780 It's really, really cool to the level of, like, it will handle, like, 2 million node networks and be like, huh, sweet, got more? 42:15.560 --> 42:16.760 It's really cool. 42:16.760 --> 42:18.880 It's called the Boost Graph Library. 42:18.880 --> 42:19.660 It's rad. 42:19.660 --> 42:24.580 And not only is it rad, but their developers are like, okay, we're going to support Dan. 42:24.800 --> 42:26.180 Like, sweet. 42:26.420 --> 42:31.340 They're getting, like, updates, like, here is your code, here are the answers to the test. 42:31.340 --> 42:35.200 Like, struggle with this stuff for, like, four days, send them a mail, here you go. 42:35.680 --> 42:36.340 Rad. 42:37.440 --> 42:44.020 So, what kind of stuff can we do now that we have, like, you know, real graph logical stuff? 42:45.640 --> 42:47.100 Let's see here. 42:51.780 --> 42:55.420 This is a router trace on a small network. 42:57.800 --> 42:59.940 That's a little dark, isn't it? 43:00.400 --> 43:03.080 We'll set the next one to be a little lighter. 43:29.680 --> 43:32.100 This is a fairly large-scale network. 43:33.060 --> 43:34.920 And , actually, this is a router trace. 43:34.920 --> 43:36.400 We're watching traffic. 43:36.780 --> 43:40.140 And it's actually animating out in front of us in real time. 43:40.300 --> 43:43.980 And we're watching, basically, nodes that aren't talking to anyone else. 43:43.980 --> 43:47.460 Here's a cluster right here that's just one server talking to lots of hosts. 43:47.480 --> 43:50.460 Here are servers that have a multi-tier relationship. 43:50.460 --> 43:54.080 This is all very early code written in the last week or two. 43:54.120 --> 43:55.660 But, ooh, it's pretty. 43:56.820 --> 44:01.420 And, um, the idea is you can actually, like, stream random data in. 44:01.420 --> 44:10.160 If I had any faith in the networks of these things, I could actually do live TCP dump with all interrelationships shown on that kind of map. 44:10.160 --> 44:11.260 And is this useful? 44:11.260 --> 44:13.320 Well, I haven't made a discovery on it. 44:13.320 --> 44:17.220 I took all my DNS interrelationship data and put it into that graph. 44:17.220 --> 44:18.760 And what did we find? 44:19.380 --> 44:26.680 Interestingly enough, oh, crap, there's a whole bunch of hosts that are all coming back to one that I expected. 44:26.680 --> 44:32.240 What I did not expect, and it'll take, actually, a few seconds for it to show up on this, but you'll just have to believe me. 44:32.260 --> 44:39.340 My expectation was that you would have, you know, lots and lots of hosts that actually went to one backend that talked to me. 44:39.340 --> 44:42.920 What you actually see is a pretty complex multi-tier relationship. 44:42.920 --> 44:47.360 One name server will talk to another name server, will talk to another name server, and will talk to another name server. 44:47.360 --> 44:51.420 This was something that I would not have expected. 44:51.420 --> 45:02.960 I actually don't know the layouts that create this, but having seen the data, having seen it visually, I could now build my systems around that assumption. 45:03.180 --> 45:15.080 The goal of all of this is that when I do mass internet scale scans, every time I send a packet, I can know the route that packet is going to probably take. 45:15.080 --> 45:17.720 I can know the routers it's probably going to go over. 45:17.720 --> 45:20.180 I can know what the bandwidth implications are. 45:20.180 --> 45:23.360 I can look at my pipe as a water hose. 45:23.420 --> 45:26.960 Not a hose, as a pipe of just high pressure water. 45:26.960 --> 45:33.020 And I can go ahead and build taps on that based on what the implications are on the underlying network. 45:33.020 --> 45:35.120 So I can say, here's a T1. 45:35.120 --> 45:36.880 Packets through there can only go at this rate. 45:36.880 --> 45:38.040 Here's an OC48. 45:38.040 --> 45:39.900 Packets on here can only go on this rate. 45:39.900 --> 45:46.240 And most interestingly, I can put monitors on every single router that I'm sending traffic through. 45:46.260 --> 45:56.980 And the moment those monitors, I call it canaries, you send five or ten packets a second to each router you expect to go through, as soon as these canaries stop responding, you know you killed them. 45:58.100 --> 45:58.500 So... 45:58.500 --> 46:00.400 I'm going to start killing canaries. 46:00.400 --> 46:01.400 Ain't that fun? 46:04.860 --> 46:06.260 And now the last thing. 46:06.260 --> 46:09.340 I have no idea if I've gone over, but I hope you guys have had fun. 46:10.880 --> 46:13.120 Who here was at my ATalk here last year? 46:16.950 --> 46:19.090 Hey, I haven't screwed up yet. 46:19.610 --> 46:19.930 So... 46:23.740 --> 46:25.780 You're wearing a power glove! 46:25.780 --> 46:27.040 How can I resist? 46:28.400 --> 46:30.180 Anyone got shot glasses? 46:30.180 --> 46:32.160 Can I get some shot glasses up here? 46:32.380 --> 46:33.340 What's your name? 46:33.340 --> 46:34.380 Patrick! 46:34.420 --> 46:37.280 Patrick, this is why I fucking come to DEF CON. 46:37.320 --> 46:40.100 Because people will get me really fucked up. 46:40.500 --> 46:42.500 Mind you, I've never had Everclear before. 46:47.340 --> 46:50.380 Hey, am I shying away from this? 46:50.380 --> 46:52.540 No, because I'm trashed. 46:53.880 --> 46:55.920 I am so fucked. 47:00.900 --> 47:02.640 Hey, I am drinking. 47:10.580 --> 47:12.320 Alright, we're here. 47:12.320 --> 47:13.560 You know what we're drinking to? 47:13.560 --> 47:15.040 We're drinking to TourCon. 47:15.040 --> 47:17.880 Probably my favorite small con in the world. 47:17.880 --> 47:19.640 It is just the shit. 47:19.820 --> 47:21.160 DEF CON is rad. 47:21.200 --> 47:23.020 TourCon is just... 47:23.700 --> 47:24.740 Hikari is awesome. 47:24.740 --> 47:25.980 Is Hikari even here? 47:25.980 --> 47:26.800 Dude! 47:28.360 --> 47:29.700 Fucking Hikari. 47:29.920 --> 47:30.640 Dude! 47:31.380 --> 47:32.340 Hey, wait, wait, wait. 47:32.340 --> 47:35.460 Do we have a third shot glass by any chance? 47:36.020 --> 47:37.540 Hikari , get the fuck up here. 47:39.620 --> 47:41.300 Here, you're drinking this shit. 47:41.540 --> 47:42.500 I'm drinking Everclear . 47:42.500 --> 47:44.280 You can drink the fucking Morgans . 47:45.160 --> 47:46.380 Just drink. 47:46.780 --> 47:47.660 Alright. 47:48.140 --> 47:49.920 To a great fucking con. 47:49.920 --> 47:50.800 You guys all rule. 47:50.800 --> 47:52.680 Thank you so much for coming here. 48:50.200 --> 48:51.920 It's actually working. 48:51.920 --> 48:54.380 Holy hell, I didn't think it would actually work. 48:55.200 --> 48:57.700 Alright, I'm putting audio out through the PC interface. 48:57.700 --> 48:59.040 This better work, guys. 48:59.660 --> 49:01.040 I'm warning you. 49:01.040 --> 49:02.320 Audio's coming any minute now. 49:02.320 --> 49:09.600 Oh, so I had to put on a huge cache on this thing because the Black Hat network was broken beyond all description. 49:10.120 --> 49:13.040 It was like wireless from like 20 feet away. 49:13.700 --> 49:19.000 Michael Flackley is the Lord of the Dance. 49:20.040 --> 49:24.120 Darth Vader is the Lord of the Sith. 49:26.220 --> 49:30.160 Okay, Robot Chicken is the best fucking show in the world. 49:30.580 --> 49:43.880 Robot Chicken rocks. 49:43.880 --> 49:47.520 And that's all about all I have for you fucking guys. 49:58.160 --> 49:59.040 Wow. 50:13.620 --> 50:18.540 So, just fucking come up here. 50:18.540 --> 50:20.040 I want people to hear your shit. 50:20.740 --> 50:23.620 Seriously, I really want people to come up and ask questions. 50:23.940 --> 50:25.760 Can I fucking have your babies? 50:27.840 --> 50:29.740 Dude, you're a guy. 50:31.800 --> 50:34.880 Seriously, someone came up with some auto-shunning question? 50:34.880 --> 50:35.900 Come on, come here. 50:35.980 --> 50:37.520 Alright, what you got, man? 50:37.980 --> 50:43.740 Do the IPSs that you're aware of, will they auto-shun their loopback interface? 50:44.960 --> 50:47.600 I had totally not thought of that. 50:48.620 --> 50:49.740 That would... 50:50.980 --> 50:53.740 I seem to have nothing to drink. 50:53.740 --> 50:57.160 You guys are falling down on the job. 50:57.160 --> 50:58.940 I bring you here for... 50:58.940 --> 50:59.880 What, you want me to drink? 50:59.880 --> 51:00.760 Okay. 51:08.920 --> 51:11.020 That's a really interesting question. 51:11.020 --> 51:15.040 Okay, so here's the idea, and this is fucked. 51:15.200 --> 51:17.780 This is really, really impressively fucked up. 51:17.780 --> 51:26.760 The idea is that you spoof a whole bunch of traffic to some network from the address 127.0.0.1, which is, of course, the loopback address on a host. 51:26.760 --> 51:30.420 Will the IPS actually block local host? 51:30.420 --> 51:34.060 Because if it does, all sorts of shit's going down. 51:37.640 --> 51:40.460 IPS vendors in this room, test. 51:40.460 --> 51:41.500 Like, now. 51:41.520 --> 51:44.760 Because there's, like, a thousand people who have the idea of testing it. 51:45.400 --> 51:46.560 Hey, you have your hand up. 51:46.560 --> 51:47.560 Get the fuck up here. 51:49.680 --> 51:50.820 No, no, come up. 51:50.820 --> 51:51.680 Come up. 51:52.820 --> 51:54.080 Seriously, come on up. 51:54.080 --> 51:57.140 There's, like, booze and books and, like, good shit and, like... 51:57.140 --> 51:58.260 God damn it. 52:00.440 --> 52:06.620 No, it's just a rebuttal to the earlier question is if you've got your router set up right, your edge router 127 shouldn't get in? 52:07.320 --> 52:15.360 If your edge router's automatic, already blocking 127.0.0.1, then, uh, of course, yeah, you're not going to go ahead and get nasty traffic. 52:15.360 --> 52:19.020 But, um, a lot of people have the attitude, well, I got an IPS. 52:19.020 --> 52:21.940 What do I need to put custom firewalls rules in for? 52:21.940 --> 52:25.980 The internet will be giving me firewall rules! 52:27.080 --> 52:41.240 Actually, honestly, probably a lot of IPSs already have blocks against 127 and have blocks against RFC 1918 space, but I'm sure there's one that doesn't because there's some really crappy IPSs out there. 52:42.040 --> 52:42.680 What's up? 52:42.680 --> 52:43.780 Hang on, hang on, hang on. 52:44.140 --> 52:48.060 You're trying to kick my ass, and so, of course, I have to give you the mic. 52:48.980 --> 52:50.780 What happens to overlapping segments, Dan? 52:50.940 --> 52:53.080 What do you mean, what happens to overlapping segments? 52:53.080 --> 52:57.980 What happens to the segments, uh, the timeout values if the segments are overlapping, Dan? 52:58.020 --> 53:00.580 Ah, yes, yes, yes, that's one of the things I pointed out. 53:00.580 --> 53:02.280 There are some very good... 53:02.280 --> 53:03.120 Okay. 53:03.800 --> 53:12.220 There are some relatively good IPSs because they're all shit, but there are some relatively good IPSs that will notice hey, look, this... 53:12.220 --> 53:28.720 They basically will go ahead and have their timing value for how long the fragment can live, but fragments have a particular IP ID associated with them, and there will be a separate timer, a much longer timer that notes, hey, I may have flushed this from my queue, 53:28.720 --> 53:34.600 but this is a fragment on a session from an old... 53:34.600 --> 53:38.300 This is an old... This is a fragment that could be applied to an old session. 53:38.300 --> 53:40.900 In other words, someone could be trying to mess with me. 53:41.000 --> 53:41.440 Hmm. 53:41.440 --> 53:43.240 Why would I try to be messing with anyone? 53:43.240 --> 53:45.100 Yeah, I guess they can bust me. 53:45.460 --> 53:46.400 Um, those... 53:47.300 --> 53:52.320 Those IPSs are really easy to fingerprint, and there is a problem in this industry. 53:52.320 --> 53:55.320 There are vulnerabilities in security code itself. 53:55.640 --> 53:56.900 I don't want to share that. 53:56.900 --> 53:58.300 I just want you to take a drink. 54:01.140 --> 54:02.660 Get ready to drink. 54:03.780 --> 54:07.500 Really, I am so screwed in TC Baby Drinking Game. 54:07.600 --> 54:08.880 Hey, come up here. 54:12.740 --> 54:14.720 Can I have your baby? 54:14.860 --> 54:17.360 Well, you definitely are a girl. 54:19.380 --> 54:20.860 New comment. 54:23.820 --> 54:25.020 Later. 54:26.960 --> 54:28.340 Come here. 54:29.920 --> 54:34.620 All the fragmenting stuff, does that work if they're filtering fragmented packets? 54:35.200 --> 54:36.900 No, it doesn't. 54:36.900 --> 54:41.680 But that's a problem because fragments are a legitimate part of the IP spec. 54:41.680 --> 54:43.100 They're actually... 54:43.100 --> 54:49.060 No, there's quite a few networks that are tunneled inside of tunnels, and they end up with much smaller... 54:49.060 --> 54:57.340 You know, in the multi-tunneling, end up with packets larger than the MTU because there's a lot of packets that will be sent with an MTU of 1500. 54:57.640 --> 54:59.420 So, fragmentation happens. 54:59.420 --> 55:07.360 It's supposed to be limited by TCP's MSS value, but sometimes it really does happen, and it does happen entirely legitimately. 55:07.460 --> 55:13.480 Now, small fragments, and this is very obscure, but small fragments at the beginning of a packet should not happen. 55:13.480 --> 55:16.380 And those things are legitimately dropped, and that's good. 55:17.560 --> 55:18.320 Go ahead. 55:18.320 --> 55:20.060 Because I've seen networks that do that. 55:20.060 --> 55:21.600 They filter out the fragmented packets. 55:21.600 --> 55:22.940 What are they missing out on? 55:23.580 --> 55:25.540 Is there anything interesting about them? 55:25.540 --> 55:26.820 Well, there's an interesting thing. 55:26.820 --> 55:29.460 A lot of people say, hey, I can drop 1% of traffic. 55:29.460 --> 55:30.060 No problem. 55:30.060 --> 55:31.100 It's just, you know, 1%. 55:31.680 --> 55:38.300 But you get, you know, this 1%, and this 1%, and this 1%, and suddenly, the internet doesn't work very well anymore. 55:38.300 --> 55:39.400 And that happens. 55:39.400 --> 55:47.340 And that's ultimately, you know, we have this thing called, like, congestion collapse, when there are too much, there's too much traffic that doesn't back off. 55:47.340 --> 55:48.560 There's another kind of collapse. 55:48.560 --> 56:01.800 It's firewall collapse, when there's too many overlapping rules from people who think, well, our one little variation on the IP spec is okay, and, you know, we're just going to do it, and, you know, who cares if we drop 1% of traffic, and then the internet no longer works. 56:02.640 --> 56:05.360 And, tipping point, I'm talking to you. 56:07.100 --> 56:09.300 I can't remember what the denial of service attack is. 56:09.300 --> 56:14.420 It's either New Dawn or Teardrop, where it's based on fragmented TCP packets. 56:14.420 --> 56:16.900 How would that work against an IPS? 56:18.120 --> 56:27.760 The fragmented packet, I dream about Ping of Death, maybe, where you have a packet that reassembles larger than the maximum IP size? 56:28.460 --> 56:35.900 Where the TCP packet reassembles and it's broken, and it causes various problems. 56:35.900 --> 56:38.280 At this point, you know, it's really sad. 56:38.280 --> 56:40.000 It's 2005, right? 56:40.000 --> 56:41.840 When the hell did Teardrop come out? 56:41.840 --> 56:44.280 Wasn't it, like, 97 or 98? 56:44.380 --> 56:54.580 Okay, so very well-known vendor, Netscreen, actually goes ahead and has, like, on their thing, we blocked this many Teardrop attacks. 56:54.860 --> 56:57.540 Dude, it's the 21st century. 56:57.540 --> 56:59.760 We aren't worried about that shit anymore. 56:59.760 --> 57:02.720 It doesn't work, even if it's unblocked. 57:02.720 --> 57:05.480 We're not running Windows 95. 57:08.040 --> 57:09.380 So, I don't know. 57:09.380 --> 57:12.280 I mean, Teardrop, I mean, it's a great brand. 57:12.500 --> 57:15.940 Oh, incidentally, you guys know how names are done in the virus industry? 57:15.940 --> 57:19.760 It's like, you know, they're all, like, named by the guys who find them. 57:19.760 --> 57:22.480 So, just like, you know, we're gonna call this attack Teardrop. 57:22.480 --> 57:33.500 We're gonna call this attack CodeRed, because, you know, hey, you know, they didn't, like, put a big brand copyright on it when they attacked our network, so we're gonna name it whatever gets us the most attention possible. 57:33.520 --> 57:36.160 And that's why they all have sexy names. 57:36.420 --> 57:52.660 Of course, there was a real problem when one of them named their thing Doxpar, because I do Doxpar research, and Doxpar caused me all sorts of problems, especially when the variant happened, Doxpar.A. 57:53.760 --> 57:55.520 You bastards. 57:57.100 --> 57:58.600 All right, other questions? 57:59.180 --> 58:00.520 What, hey, uh-oh. 58:00.860 --> 58:03.720 What do you think of the recent ICMP-based attacks? 58:07.020 --> 58:10.680 There's so much overh... So, it's really funny. 58:11.280 --> 58:19.740 Yes, you can kill ICMP sessions if you can figure out the four tuple of source IP, desk IP, source port, you totally can. 58:19.740 --> 58:26.260 But I went on Deja News, and I found a post from 1993 calling this shit old. 58:28.400 --> 58:29.840 Dear God. 58:30.760 --> 58:36.060 No, I mean, okay, the actual attacks are real, but old. 58:36.120 --> 58:39.840 To his credit, he's right, they still work, and they shouldn't. 58:40.020 --> 58:43.840 His stuff about slow... There's this guy, he has this stuff about slowing down networks. 58:43.840 --> 58:44.560 Why am I drinking? 58:44.560 --> 58:45.680 I was right. 58:46.440 --> 58:47.540 Okay, his stuff... 58:47.540 --> 58:48.580 Fuck. 58:54.080 --> 58:55.380 Funny guy. 58:55.380 --> 58:56.720 He should test his shit. 58:57.320 --> 59:02.000 He has this whole thing, well, I can slow down communication of BGP sessions. 59:02.140 --> 59:06.880 I can reduce a session down to one packet sent per round trip time. 59:07.520 --> 59:11.700 So, BGP sessions, I don't know if you guys know, they're about three kilobytes a second. 59:11.780 --> 59:13.560 Three kilobytes a second, okay. 59:13.660 --> 59:24.200 So, you reduce a session down to one packet per round trip time on a session that has somewhere between one millisecond and a tenth of a millisecond latency. 59:24.220 --> 59:25.420 Oh, no! 59:25.420 --> 59:33.480 I can only send a thousand to ten thousand packets a second on my three kilobyte a second link. 59:33.480 --> 59:34.540 No! 59:35.860 --> 59:37.560 It's ridiculous. 59:38.180 --> 59:39.380 Any other questions? 59:39.380 --> 59:42.840 Seriously, you don't even have to come up if I can somehow hear you. 59:46.640 --> 59:49.360 Says the guy from Prolexic. 59:49.360 --> 59:50.620 That took some balls. 59:50.620 --> 59:51.900 Here, have a book. 59:53.820 --> 59:55.660 Prolexic's been rad, by the way. 59:55.660 --> 59:56.840 I mean, seriously. 59:56.840 --> 01:00:00.920 They've been giving me shit tons of bandwidth and taking calls from DoD. 01:00:00.920 --> 01:00:01.920 Rad. 01:00:03.800 --> 01:00:05.800 Oh, shit, it's George. 01:00:06.380 --> 01:00:08.840 It's ScanRan motherfucker George. 01:00:15.430 --> 01:00:17.310 I hate you. 01:00:18.350 --> 01:00:21.050 So, I'm going to the T2 con out in Finland. 01:00:21.070 --> 01:00:22.850 Who here is from Europe? 01:00:24.550 --> 01:00:27.510 Dude, Euro guys, I'm coming out to you guys mostly. 01:00:27.510 --> 01:00:28.770 That's the plan. 01:00:29.370 --> 01:00:37.290 So, T2, I didn't intend to give them props, because TorCon is the shit, but yeah, T2 should be good. 01:00:38.270 --> 01:00:38.890 What? 01:00:39.010 --> 01:00:40.550 I didn't screw up! 01:00:40.550 --> 01:00:41.630 You drink! 01:00:41.630 --> 01:00:43.950 Hey, someone get these fuckers drinks. 01:00:43.950 --> 01:00:45.970 They need to be drunk so they'll shut up. 01:00:45.970 --> 01:00:48.470 I'm not drinking. 01:00:48.870 --> 01:00:50.150 No, stop. 01:00:55.340 --> 01:00:56.880 All right, do we have anything else? 01:00:56.880 --> 01:00:59.060 Because I should probably give this shit up to Hacker Jeopardy. 01:00:59.060 --> 01:00:59.780 OK, go ahead. 01:00:59.780 --> 01:01:00.580 You have a good question? 01:01:01.000 --> 01:01:02.060 No dude, hang on. 01:01:02.060 --> 01:01:03.440 I want this guy to ask a question. 01:01:04.800 --> 01:01:10.480 You said that one of your attacks is based on a difference between IDS timing and host timing. 01:01:10.480 --> 01:01:22.060 Well, in Linux and FreeBSD, isn't it possible, even in extreme situations, just to rebuild the stack so if you know your vendor in advance just to match Man gets a book. 01:01:22.060 --> 01:01:24.080 Man gets both books. 01:01:25.040 --> 01:01:27.660 That is an excellent point. 01:01:27.660 --> 01:01:37.580 Those of you who are very smart admins can go ahead, adapt your host to your shit ass IDS and make things align perfectly. 01:01:37.580 --> 01:01:39.280 Absolutely correct. 01:01:39.280 --> 01:01:41.060 Fantastic point. 01:01:41.060 --> 01:01:46.180 Are you advocating we break our host and match our IDS? 01:01:46.400 --> 01:01:51.500 Hey, I'm advocating we adapt our host to agree with our IDS's fucked up view of the universe. 01:01:51.500 --> 01:01:52.320 Thank you very much. 01:01:52.320 --> 01:01:53.140 Absolutely. 01:01:53.620 --> 01:01:54.780 What's up? 01:01:57.970 --> 01:02:02.270 And I think, unless there's any more questions, I think I am done here. 01:02:02.270 --> 01:02:04.090 You guys are fantastic! 01:02:04.330 --> 01:02:06.030 I love you guys! 01:02:11.130 --> 01:02:15.890 As a note, I talk at Black Hat as practice for you guys. 01:02:15.890 --> 01:02:17.470 You guys are awesome. 01:02:17.490 --> 01:02:20.810 I cannot even say thank you so much for all. 01:02:20.930 --> 01:02:25.050 Oh, there's one last thing that is really important that you all know. 01:02:25.090 --> 01:02:30.270 I have an insane network pipe and I'm taking proposals for how to use it. 01:02:30.270 --> 01:02:37.770 If you have an idea for what will help secure the internet, I will take the shit of spreading it everywhere. 01:02:38.490 --> 01:02:40.110 Talk to me! 01:02:40.730 --> 01:02:41.850 Don't do it yourself! 01:02:41.850 --> 01:02:43.510 No, not porn! 01:02:45.090 --> 01:02:46.990 You sick fuck! 01:02:46.990 --> 01:02:49.450 Especially for the kind of porn you want! 01:02:50.750 --> 01:02:54.710 Alright, I'm off to the drinking game where I will puke my guts out. 01:02:54.710 --> 01:02:55.470 Thank you.