1
00:00:10,640 --> 00:00:12,480
First, I'd like to thank you all for coming.

2
00:00:12,480 --> 00:00:13,220
I'm Greg Conti.

3
00:00:13,220 --> 00:00:17,840
And I'd like to talk to you about the idea of denial of information attacks.

4
00:00:17,860 --> 00:00:23,080
And in one sentence, the idea is attacking humans through the computer system.

5
00:00:23,080 --> 00:00:28,860
Not attacking the computer system, but attacking humans through their computer system, and how we can counteract that.

6
00:00:29,200 --> 00:00:31,080
And here's one example.

7
00:00:31,680 --> 00:00:32,860
Large shark.

8
00:00:33,840 --> 00:00:36,860
Currently I'm at Georgia Tech, but I'm also in the Army.

9
00:00:36,860 --> 00:00:41,280
And I'm here as a free citizen, and not as a representative of the government.

10
00:00:47,780 --> 00:00:57,540
So, more specifically, denial of information attacks attack you, the human, and try and consume the limited resources that you have.

11
00:00:57,540 --> 00:01:07,280
If you contrast what you can handle versus what your computer can handle, in certain categories, you'll fall over far faster than your box will.

12
00:01:07,280 --> 00:01:15,760
So, if it slows you down or alters your decision making, then that's a denial of information attack occurring.

13
00:01:16,420 --> 00:01:19,220
So, I think the best example is spam.

14
00:01:19,480 --> 00:01:26,800
And I won't ask you, but just consider how many of you have deleted email based on, say, a subject line that you shouldn't have.

15
00:01:26,860 --> 00:01:30,360
Or you've opened email that you shouldn't have.

16
00:01:30,860 --> 00:01:36,320
And I know, when I talked to my wife about this, we thought it was probably... you guys are at the leading edge.

17
00:01:36,320 --> 00:01:42,160
So, when spam first started coming out, you probably figured that out pretty quickly.

18
00:01:42,240 --> 00:01:50,840
But who's received, and I'll ask for a show of hands, who has received a frantic email from a family member about some virus email that they received?

19
00:01:50,840 --> 00:01:57,320
Or some, you know, if your local tech support for you or your family or friends, who's received emails like that?

20
00:01:57,880 --> 00:02:00,500
Pretty much, you know, almost the whole room.

21
00:02:00,560 --> 00:02:03,100
So, I think spam is an example.

22
00:02:03,100 --> 00:02:05,540
I mean, consider how much time have you wasted on spam?

23
00:02:05,540 --> 00:02:08,220
And these are just examples.

24
00:02:08,360 --> 00:02:13,200
So, what I'm trying to do to this problem is look at the bigger picture and look at the structure around it.

25
00:02:13,200 --> 00:02:20,040
And then, how people are defending it and defenses to just add some structure to the domain.

26
00:02:21,120 --> 00:02:22,780
I'll take one step back.

27
00:02:22,960 --> 00:02:27,920
And there's some interesting statistics that just recently came out of the University of Indiana.

28
00:02:27,920 --> 00:02:29,660
I'm sorry, Indiana University.

29
00:02:29,960 --> 00:02:32,120
About phishing.

30
00:02:32,120 --> 00:02:41,040
And what they did is they went to social networking sites like Orkut and found out who was friends with who.

31
00:02:41,040 --> 00:02:48,700
Then they used that information to send out a phishing email to college students and they sent them out to 500 people.

32
00:02:49,320 --> 00:02:51,720
But with the return address of a friend.

33
00:02:52,260 --> 00:02:55,140
The emails were just like, hey, check this site out.

34
00:02:55,140 --> 00:02:57,920
It gave a generic link off campus.

35
00:02:57,920 --> 00:03:04,600
That link prompted them for their credentials or user ID and password from college.

36
00:03:05,040 --> 00:03:07,900
And they were 72% successful.

37
00:03:08,860 --> 00:03:10,940
And the students were very mad.

38
00:03:10,940 --> 00:03:14,960
But there's some interesting statistics if you take a look at the gender.

39
00:03:15,420 --> 00:03:21,200
If a male sent an email to another male, only 53% of them fell for it.

40
00:03:22,340 --> 00:03:24,520
You can see where we're going here.

41
00:03:26,940 --> 00:03:32,280
If a female sent an email to a male, it went up from 53% to 68%.

42
00:03:34,560 --> 00:03:38,080
Female to female, 76%.

43
00:03:39,280 --> 00:03:41,720
And then they live in a different world than I do.

44
00:03:41,720 --> 00:03:45,640
But male to female, 78% of them fell for it.

45
00:03:45,640 --> 00:03:47,620
So on average it was 72%.

46
00:03:47,620 --> 00:03:49,980
So male to female was the worst category.

47
00:03:49,980 --> 00:03:53,580
But I thought the real insight there was using that social networking information.

48
00:03:54,980 --> 00:03:58,560
So I don't want you to confuse this with denial of service attacks.

49
00:03:58,700 --> 00:04:04,940
This is a recent innovation from a major operating system manufacturer.

50
00:04:05,640 --> 00:04:09,440
They've evolved from the blue screen of death to the red screen of death.

51
00:04:09,920 --> 00:04:11,160
This is from Longhorn.

52
00:04:11,160 --> 00:04:12,960
I guess it's Vista these days.

53
00:04:12,960 --> 00:04:14,960
Anyway, back to the...

54
00:04:14,960 --> 00:04:24,460
It's not what you consider denial of service where you're consuming system resources, RAM, hard drive space, processing power.

55
00:04:24,460 --> 00:04:28,220
You're consuming the human's resources is the key difference.

56
00:04:29,340 --> 00:04:32,620
And it's compounded by the idea of information growth.

57
00:04:32,620 --> 00:04:37,220
If you look, information is being generated at a prodigious rate.

58
00:04:37,740 --> 00:04:40,000
This study is very, very good.

59
00:04:40,000 --> 00:04:45,020
And I'd also like to mention I personally hate bullet slides, so I have very, very few in here.

60
00:04:45,020 --> 00:04:53,360
But on the slides on your disk, on the Con CD, I've included an extended version that has more information with links and things.

61
00:04:53,360 --> 00:04:55,660
Anyway, I just wanted to highlight one of these.

62
00:04:55,680 --> 00:05:02,280
This is a study coming out of Berkeley from 2003 entitled How Much Information?

63
00:05:02,460 --> 00:05:07,800
It's a very good study, except it's like 150 pages, which again is information overload.

64
00:05:07,800 --> 00:05:14,160
But the surface web at that time, they estimated, was about 170 terabytes.

65
00:05:14,160 --> 00:05:16,680
Or 17 times the U.S.

66
00:05:16,680 --> 00:05:19,400
Library of Congress print collection.

67
00:05:19,440 --> 00:05:23,120
So a tremendous amount of information in 2003.

68
00:05:25,420 --> 00:05:28,960
And that's just the surface web, not the dynamically generated web.

69
00:05:30,000 --> 00:05:41,060
So we just talked about spam attacking primarily your cognitive decision making.

70
00:05:41,320 --> 00:05:44,520
Well, there's other attacks that attack your perception.

71
00:05:44,940 --> 00:05:46,840
I had this on a web page.

72
00:05:47,160 --> 00:05:50,780
How much work can you get done with that sitting on the web page blinking?

73
00:05:52,020 --> 00:05:53,940
So that was on a real estate web page.

74
00:05:53,940 --> 00:05:57,720
I had to slide it off to the side to be able to get any work done.

75
00:05:57,720 --> 00:05:59,200
And it just makes me mad.

76
00:05:59,200 --> 00:06:00,960
What were they thinking?

77
00:06:00,960 --> 00:06:03,200
Who's going to go out and buy coffee based on that?

78
00:06:04,820 --> 00:06:09,340
So we talked about cognitive resources and perceptual resources.

79
00:06:09,340 --> 00:06:10,960
Then we have motor resources.

80
00:06:11,360 --> 00:06:18,400
And the idea then, if you go back to the denial of information attack, if you're slowing the human down, you're beginning to win.

81
00:06:18,400 --> 00:06:21,500
If you're sending them in the wrong direction, you're beginning to win.

82
00:06:21,580 --> 00:06:23,880
Motor resource attacks often slow you down.

83
00:06:23,880 --> 00:06:29,180
You have to stop what you're doing, grab the mouse, click the pop-up, get back to what you were doing.

84
00:06:31,520 --> 00:06:42,100
And I thought this example from hack-proofing your network, again, gives an insight into the idea of the decision making by the human versus the decision making by the computer.

85
00:06:42,100 --> 00:06:43,940
And I'll read it for those in the back.

86
00:06:44,480 --> 00:06:52,740
In the end, all the power of the intrusion detection system is ultimately controlled by a single judgment call on whether or not to take action.

87
00:06:52,740 --> 00:06:58,140
So if you can get into that decision making cycle, you can affect major outcomes.

88
00:07:00,670 --> 00:07:04,110
I thought it was also relevant to look at information flows.

89
00:07:04,150 --> 00:07:12,330
So if you consider signal being what you're looking for, if you're out on the web, for example, or in any information space, you're looking for certain information.

90
00:07:12,470 --> 00:07:13,930
That would be the signal.

91
00:07:14,270 --> 00:07:17,310
Noise would be everything but what you're looking for.

92
00:07:17,550 --> 00:07:23,870
So the best case would be signal is very high, and noise would be very low, so that's the best situation.

93
00:07:23,870 --> 00:07:27,130
So what you're trying to do is increase your signal-to-noise ratio.

94
00:07:28,270 --> 00:07:34,410
If you consider a small amount of signal and a small amount of noise, it's still manageable for a human.

95
00:07:34,410 --> 00:07:40,070
So you can look at this list of 10 things, and even if it's 50-50, you can still pick out what you're looking for.

96
00:07:40,110 --> 00:07:42,430
Some Google results are like that.

97
00:07:44,990 --> 00:07:48,210
But it starts getting worse when you have low signal-to-noise.

98
00:07:48,210 --> 00:07:56,210
And particularly, you have a lot of noise, a little bit of signal, what you're looking for, that's the domain of the denial-of-information attack.

99
00:07:57,910 --> 00:08:00,250
And then you start getting into denial-of-service.

100
00:08:00,250 --> 00:08:05,950
If you have lots and lots of information, then you start overcoming your computer's resources.

101
00:08:05,950 --> 00:08:08,250
So that's more the denial-of-service attack.

102
00:08:09,530 --> 00:08:12,970
So if you consider this webpage, and this is weather.com.

103
00:08:12,970 --> 00:08:17,310
I started going to specific news sites, and then I thought I'd get in trouble for whatever one I chose.

104
00:08:17,310 --> 00:08:18,990
So I thought weather would be safe.

105
00:08:19,150 --> 00:08:25,610
So if you went to this website to get something done, and I actually tried to do this to find out Las Vegas weather.

106
00:08:27,370 --> 00:08:29,670
Yeah, I mean hot and dry, what was I thinking?

107
00:08:31,570 --> 00:08:42,570
Anyway, say you came to this site, and putting your signal-to-noise ratio goggles on, and all you wanted was the United States weather and some basic weather information.

108
00:08:44,030 --> 00:08:46,030
All of that is noise.

109
00:08:46,030 --> 00:08:48,370
So just a tremendous amount.

110
00:08:48,370 --> 00:08:51,390
And I know there's some plug-ins for various browsers that help.

111
00:08:51,470 --> 00:08:56,170
But the idea, if you can just get down to the signal, it's a tremendously better experience.

112
00:08:57,630 --> 00:09:06,850
So besides the idea of the signal-to-noise ratio, and the keynote speaker at Black Hat was Gilman Louie, who also mentioned this.

113
00:09:07,170 --> 00:09:15,250
He is the CEO of In-Q-Tel, which I think is a CIA startup funding venture capital company.

114
00:09:15,250 --> 00:09:16,250
I think it's pretty interesting.

115
00:09:17,850 --> 00:09:19,850
But anyway, he mentioned the OODA loop.

116
00:09:19,910 --> 00:09:24,610
And the OODA loop was Observe, Orient, Decide, and Act.

117
00:09:24,610 --> 00:09:28,150
And it was developed by Colonel John Boyd, who was in the Air Force.

118
00:09:28,150 --> 00:09:33,030
And this came out in the 60s, about how fighter pilots make decisions.

119
00:09:33,170 --> 00:09:38,390
And if you could make your decisions faster than the other person, you could go through this cycle, then you win.

120
00:09:38,390 --> 00:09:49,330
So consider, if you're in a certain situation, you're even looking at a webpage or any, looking at logs, you have to observe the data, or even your email is probably the best example.

121
00:09:49,450 --> 00:09:57,930
You have to observe your email, and after you observe it and orient yourself to it, then you have to decide, what do I do?

122
00:09:58,330 --> 00:10:03,990
And if it's a puzzling subject line, you spend time, you're wasting time, you're slowing down this loop.

123
00:10:04,690 --> 00:10:11,910
And then after you do it, you have to act, and typically action requires some physical response, which is a motor response, which will slow it down.

124
00:10:11,910 --> 00:10:20,490
So if you're slowing your opponent's OODA loop down, again, you're conducting a successful attack.

125
00:10:20,490 --> 00:10:25,050
So you can have people go through cycles unnecessarily, or you can slow it down.

126
00:10:27,470 --> 00:10:33,310
So, with that in mind, Observe, Orient, Decide, and Act, let's look at the webpage again.

127
00:10:34,470 --> 00:10:51,390
And this time, if your task was to just find out your local weather, which isn't available, and it took me a while, so you observe this, and orient yourself to it, and find out where do you type it in, where do you get your local weather.

128
00:10:52,370 --> 00:10:54,950
So think how long it would take.

129
00:10:55,310 --> 00:10:57,850
Well, it turns out, it's there.

130
00:10:57,850 --> 00:11:00,030
Everything else is noise for the task at hand.

131
00:11:00,030 --> 00:11:02,510
So you've slowed the person down as they go through that.

132
00:11:02,510 --> 00:11:06,810
And granted, they've got business reasons for doing so, they want to show you ads.

133
00:11:08,650 --> 00:11:12,110
Some of the news websites are the worst offenders of all.

134
00:11:13,730 --> 00:11:22,050
Okay, so moving forward, let's look at then, you've seen some of these examples, big examples, let's look at how people are defending against these type of attacks.

135
00:11:24,230 --> 00:11:31,230
And I spent about, oh jeez, three years of my life reading Slashdot every day, looking for denial of information attacks in the news.

136
00:11:31,230 --> 00:11:33,610
And certain trends came out of it.

137
00:11:33,610 --> 00:11:36,250
And clearly, there were legal responses.

138
00:11:36,530 --> 00:11:41,150
And you can consider the anti-telemarketer legislation, for example.

139
00:11:41,450 --> 00:11:43,150
As well as regulatory.

140
00:11:43,310 --> 00:11:54,500
There were moral responses, public relation campaigns, from the Motion Picture Association of America, for example, like you'll put our employees out of their jobs if you pirate movies.

141
00:11:57,720 --> 00:12:01,580
And I was particularly intrigued by the use of violence.

142
00:12:01,580 --> 00:12:08,340
Violence is, if people are receiving information they don't want, violence has been a proven countermeasure in certain instances.

143
00:12:08,600 --> 00:12:20,520
And I was particularly intrigued by the, let's see, Charles Bauer, Charles Bauer case, where he received one spam too many, and snapped, and started sending death threats back to the spammers.

144
00:12:20,680 --> 00:12:22,840
And he was arrested for his troubles.

145
00:12:26,300 --> 00:12:32,440
So, I want to take a harder look at, alright, you've got these limited resources, how do they all interplay?

146
00:12:32,440 --> 00:12:35,120
So, this is you.

147
00:12:35,220 --> 00:12:44,840
And I've modeled it, and it's hard, many of you may not be able to see it, but those boxes represent your cognitive capability, short-term memory, long-term memory.

148
00:12:45,040 --> 00:12:48,260
And that's you in the red square, talking to your computer.

149
00:12:48,260 --> 00:12:56,740
So, the arrows you see between that, actually, along this boundary, that's your vision, your hearing, your speech, and your motor.

150
00:12:56,740 --> 00:13:05,680
So, the input-output through your computer, which also has a limited amount of resources, CPU, RAM, hard drive space, and IO.

151
00:13:06,560 --> 00:13:13,180
And it communicates, so you're the information consumer, you're consuming information from information producers.

152
00:13:13,180 --> 00:13:18,240
And you need to pull that information in, say from websites, over some sort of communication channel.

153
00:13:19,980 --> 00:13:23,020
Those are servers out there providing you the information.

154
00:13:23,060 --> 00:13:26,600
They too have limited resources.

155
00:13:27,480 --> 00:13:31,380
And often there's a human sitting there, you know, the spammer hits the send button.

156
00:13:31,380 --> 00:13:34,440
But they could be things like unattended machines, like sensors.

157
00:13:36,300 --> 00:13:40,760
So, if you take a closer look, then, you can see where these attacks take place.

158
00:13:40,800 --> 00:13:51,160
For example, if you use very small text, like in legal agreements, in EULAs, you will... that's attack against the vision of the recipient.

159
00:13:52,480 --> 00:13:57,740
Spoofing the browser, you know, some of the phishing attacks that have taken place occur along that HCI boundary.

160
00:13:57,740 --> 00:14:01,060
And I just found this useful to get a feel for where these things are occurring.

161
00:14:01,380 --> 00:14:04,640
To look at where attacks are taking place.

162
00:14:04,640 --> 00:14:06,900
Maybe where new attacks could take place.

163
00:14:06,900 --> 00:14:10,180
As well as where some defenses could be put up.

164
00:14:10,720 --> 00:14:12,880
So, if you look at defenses, there's a...

165
00:14:12,880 --> 00:14:15,900
the HCI boundary between you and your computer.

166
00:14:15,900 --> 00:14:19,480
There's been a move forward in the notion of usable security.

167
00:14:19,480 --> 00:14:24,260
Like security actually people can... it gives them the information they need.

168
00:14:24,760 --> 00:14:32,080
TCP damping on the communication channel will slow down even if a certain number of email exceed a given threshold.

169
00:14:32,080 --> 00:14:34,800
They'll slow down the network pace.

170
00:14:34,960 --> 00:14:39,680
And I believe that's actually... there's some penalties in capture the flag on that front.

171
00:14:40,660 --> 00:14:44,640
Or pushing... most of these push the problem back to the attacker.

172
00:14:44,640 --> 00:14:47,260
So you see computational puzzle solving.

173
00:14:47,260 --> 00:14:54,280
Attack requires... if you want to send this email, for example, requires a small amount of CPU space on the attacker.

174
00:14:55,520 --> 00:15:00,680
And I'm particularly intrigued by Paul Graham's idea of the Eliza spam responder.

175
00:15:00,680 --> 00:15:03,640
And who's heard of that idea for spam in Eliza?

176
00:15:04,740 --> 00:15:05,800
Okay, good.

177
00:15:05,800 --> 00:15:14,000
The idea is Eliza's early straightforward artificial intelligence program that was designed to be like a psychologist.

178
00:15:14,940 --> 00:15:17,200
So the idea then is you have a...

179
00:15:18,040 --> 00:15:20,800
listening on a given port or email address.

180
00:15:20,800 --> 00:15:21,540
The email comes in.

181
00:15:21,540 --> 00:15:29,300
If they can craft it in such a way that the spammer buys the response and people all across the internet do that, we win.

182
00:15:29,300 --> 00:15:31,100
So it's a pretty intriguing idea.

183
00:15:31,100 --> 00:15:34,160
And it shows you, again, denial of information, how little resources...

184
00:15:35,720 --> 00:15:42,920
the spammer is relying on economies of scale, 10 million email to press of a button.

185
00:15:43,240 --> 00:15:48,020
If you can, you know, 1% of those people eat up a little bit of time, you've won.

186
00:15:49,880 --> 00:15:51,980
So I thought this was Slashdot.

187
00:15:51,980 --> 00:15:53,000
I love Slashdot.

188
00:15:53,000 --> 00:15:56,640
It's like this high of mind and there's always interesting insights.

189
00:15:57,540 --> 00:16:05,400
So from Slashdot on this subject, I have a little PHP script that I use whenever I get a phishing email.

190
00:16:05,400 --> 00:16:12,400
The script generates fake credit card numbers and expiration dates and repeatedly hits the sites...

191
00:16:12,400 --> 00:16:15,620
the phishing sites form dumping in random information.

192
00:16:16,780 --> 00:16:24,140
Any halfway intelligent phisher would record the IP address and just dump all of mine when he saw they were bogus.

193
00:16:24,380 --> 00:16:28,000
But it makes me feel good that I at least wasted some of his time.

194
00:16:28,340 --> 00:16:30,080
So again, you know, you push that back.

195
00:16:30,080 --> 00:16:31,900
If a lot of people did... and I'm not encouraging...

196
00:16:31,900 --> 00:16:33,760
I don't want to get drug off in shackles.

197
00:16:33,920 --> 00:16:38,880
But it is intriguing, the idea of pushing the problem back to the spammer.

198
00:16:41,560 --> 00:16:43,200
So I've looked at this...

199
00:16:43,200 --> 00:16:45,400
well, honestly, entirely too much, this problem.

200
00:16:45,420 --> 00:16:51,100
But I have... there are several papers on it that are on my website that I'll give you the link at the end and it's on the CD.

201
00:16:51,360 --> 00:17:02,400
But if you're interested, you know, on any of the papers, on the website that are like pre-publication, you can send me an email and I'll send you a private copy for review or something like that.

202
00:17:02,400 --> 00:17:04,700
And most of the others are available if you're interested in more.

203
00:17:04,700 --> 00:17:07,660
I just tried to hit some highlights I thought you'd find entertaining.

204
00:17:08,980 --> 00:17:14,300
So given that big problem, I wanted to look at a specific domain.

205
00:17:14,300 --> 00:17:16,480
And there are a lot of people working in spam.

206
00:17:16,480 --> 00:17:19,120
So I've looked specifically at network security.

207
00:17:21,160 --> 00:17:28,980
And in particular, the idea of using information visualization as a way to deal with that problem of denial of information attacks.

208
00:17:28,980 --> 00:17:40,380
Because there's this battle and you see it during Capture the Flag of hiding your activities from the human who's monitoring the system or the intrusion detection systems or the defenders.

209
00:17:40,380 --> 00:17:43,320
So I was looking at information visualization to do that.

210
00:17:44,280 --> 00:17:57,160
So I came up with a tool that's a PVR and it monitors network traffic and will load historical data sets and provides different specially crafted windows to hopefully provide you insight.

211
00:17:58,060 --> 00:18:08,300
At Interzone, I had a friend who said they thought they might have to change the rules of Capture the Flag if all of a sudden you could see network activity in useful ways.

212
00:18:08,300 --> 00:18:09,180
So that's the idea.

213
00:18:09,180 --> 00:18:11,900
I mean, the space we're in, everything's one-upmanship.

214
00:18:11,900 --> 00:18:16,080
So I thought, okay, we have these windows and that's useful.

215
00:18:16,080 --> 00:18:18,580
Well, how can we attack them?

216
00:18:19,000 --> 00:18:32,000
Kind of take it one step forward and look at how can we look at the traffic in ways that are useful, then take it another step and say, okay, knowing how we all think, okay, this is in place, this is cool, how can we attack it?

217
00:18:32,960 --> 00:18:41,600
So this is what the tool looked like and this is just a quick snapshot and it's using the Microsoft Virtual Desktop to show a few different panes at the same time.

218
00:18:41,600 --> 00:18:43,120
I'll demo this at the end.

219
00:18:45,960 --> 00:18:53,040
Okay, so last year at DEF CON, I gave a talk on a related subject and the first question was, how do we attack it?

220
00:18:53,220 --> 00:18:58,940
So combined with my interest and your interest, I thought it would be an interesting space to look at.

221
00:18:59,140 --> 00:19:02,400
And you'll find in academia, not many...

222
00:19:02,400 --> 00:19:06,640
I mean, if you're not in the security field, generally you're not in the security field.

223
00:19:06,640 --> 00:19:12,020
So you can make a lot of progress just by looking at their stuff and breaking it for them.

224
00:19:12,420 --> 00:19:13,400
It's pretty fun.

225
00:19:13,400 --> 00:19:17,080
So that led to the work on malicious visualizations.

226
00:19:18,580 --> 00:19:26,180
And then the idea was attacking the human through their computer, through their system that presents information to them in some way.

227
00:19:26,680 --> 00:19:33,260
So ideally, you can understand how these attacks occur, then you can design better ways to protect yourself.

228
00:19:34,320 --> 00:19:36,700
Ah, I was motivated by Pokemon.

229
00:19:36,880 --> 00:19:41,580
Now I know at a normal academic conference, people wouldn't know the answer to this.

230
00:19:41,580 --> 00:19:48,740
But why was I motivated about Pokemon as far as attacking people through information technology?

231
00:19:50,200 --> 00:19:51,280
Seizures.

232
00:19:51,280 --> 00:19:52,940
Okay, very good.

233
00:19:52,940 --> 00:20:05,460
In the late 1990s, there was a specific Pokemon episode that had rapid flashing red lights in 20 to 30 hertz.

234
00:20:05,940 --> 00:20:12,740
Well, it turns out that people who have photosensitive epilepsy, that's just the right frequency to trigger a seizure.

235
00:20:13,160 --> 00:20:23,120
And reports vary, but thousands of people went to the hospital with nausea, and several hundred went to the hospital because of seizures.

236
00:20:23,140 --> 00:20:26,140
So it got me thinking about reaching...

237
00:20:26,140 --> 00:20:33,660
I know that's a very specific case, but I think the prevalence in the US population is about 2% through the lifetime for epilepsy.

238
00:20:34,020 --> 00:20:36,060
So it's non-zero.

239
00:20:36,060 --> 00:20:40,360
But it got me thinking about attacking people through computers.

240
00:20:41,660 --> 00:20:43,640
But then I wanted to be realistic.

241
00:20:43,920 --> 00:20:47,620
So, yeah, I mean, you just want theoretic attacks that never occur.

242
00:20:47,680 --> 00:20:58,960
I wanted to look at, well, where can you really insert information into what people see, and how can that little bit of information impact a lot of information, or the display of the information.

243
00:20:59,580 --> 00:21:01,380
So I made some assumptions.

244
00:21:01,580 --> 00:21:08,200
I'm not dossing the system, I'm just adding a little bit of information, trying to skew the results as much as possible and trick people.

245
00:21:09,260 --> 00:21:20,120
As well as, in some cases, I think it's reasonable to assume you could alter the timing of the data, particularly if you had access to the sensor or something, or the network, somewhere in between, you might be able to slow it down.

246
00:21:20,280 --> 00:21:23,140
But I really focused on adding a little bit of information.

247
00:21:23,440 --> 00:21:29,140
And I did not assume that you'd compromise their computer and you'd have full access to the database to do whatever you want with it.

248
00:21:29,140 --> 00:21:31,540
I wanted some places where you could really do it.

249
00:21:33,180 --> 00:21:37,720
So, you know, network traffic is where I spent most of my time.

250
00:21:37,900 --> 00:21:39,700
Particularly in this area.

251
00:21:39,720 --> 00:21:42,800
Because, I mean, clearly you can spoof packets, you can inject things.

252
00:21:42,800 --> 00:21:47,400
I mean, you're constrained in some ways by protocols or upstream network devices.

253
00:21:47,400 --> 00:21:51,080
But still, the network, you can insert information pretty much at random.

254
00:21:51,280 --> 00:21:53,580
As well as some of these other domains.

255
00:21:53,580 --> 00:21:58,580
Any place where you can insert some amount of information, then there can be a problem.

256
00:22:01,340 --> 00:22:11,100
So, going back to the model, I assumed that anywhere in that space, along the communication channel, or the information producer, could insert a little bit of information.

257
00:22:11,960 --> 00:22:14,560
And then the timing attack would occur.

258
00:22:14,580 --> 00:22:20,040
Even on the sensor itself, but I was looking more at the network in between.

259
00:22:20,840 --> 00:22:23,440
So how do these things manifest themselves?

260
00:22:23,900 --> 00:22:32,940
I looked at all the different places where they could manifest themselves, but I've chosen some highlights here I think would be best just to show you the idea.

261
00:22:33,440 --> 00:22:35,340
So I focused on your computer.

262
00:22:35,340 --> 00:22:45,060
How people can send a little bit of malicious information to your computer so that it will present you a lot of malicious information in a visual display.

263
00:22:47,060 --> 00:22:52,500
So what really got me thinking is just some tools, and this is a $10,000 visualization tool.

264
00:22:52,500 --> 00:22:56,120
It labels things, only puts 20 labels on the display.

265
00:22:56,120 --> 00:23:01,800
So if you hit a threshold above 20 labels, labels start disappearing.

266
00:23:01,800 --> 00:23:15,040
So I thought, if you can exceed limits of the program, then you're gaining ground, you're slowing people down, they may miss what you want them to miss, or see what you want them to see.

267
00:23:15,580 --> 00:23:27,600
And even better in displaying information, oftentimes labeling algorithms are used, and you can see here that it doesn't take much to start filling up a display with labels.

268
00:23:28,400 --> 00:23:31,500
And, you know, it dropped out here, and they're not even sorted in this one.

269
00:23:31,500 --> 00:23:34,720
So perhaps just a little bit, you can start hitting the threshold.

270
00:23:35,920 --> 00:23:52,300
And even better, I think, is you see auto-scaling algorithms, where this graphic, the left-hand side, shows ports on external computers that are talking, and on the right-hand side are ports on your computer.

271
00:23:52,300 --> 00:23:56,840
So it connects the dots between one to the other, what port to what port.

272
00:23:57,420 --> 00:24:08,400
And if you look at the little detail, you have a great deal, that was the initial display, it was like 1 to 135, but this tool auto-scaled.

273
00:24:08,400 --> 00:24:11,820
So initially, I saw exactly what I wanted to see.

274
00:24:11,820 --> 00:24:19,460
I winged one packet to a high port, it auto-scaled it, reduced all that relevant information down to one pixel.

275
00:24:19,580 --> 00:24:25,840
So then you have to waste time, grab the mouse, zoom in, zoom out, just by winging one packet high.

276
00:24:25,900 --> 00:24:30,120
Now you may think this is just arbitrary, but you see this in real life.

277
00:24:30,120 --> 00:24:36,720
This is a very common web log analysis program.

278
00:24:36,840 --> 00:24:46,240
So here, and this is from the Netty at Home project, you see a spike of activity, and actually this was a site being slashed out.

279
00:24:46,240 --> 00:25:05,780
So yes, it's more akin to the Nile service attack, but it does illustrate that you can impact, I mean, web logs, you can enter information in, I mean, you probably send ASCII art into web logs, if you are so inclined, but that input in the logs, and then you can alter how the information is displayed.

280
00:25:05,800 --> 00:25:11,300
So you see that on the day of the slash dotting, it flat-lined everything else.

281
00:25:11,300 --> 00:25:12,980
So, you know, everything else is gone.

282
00:25:15,900 --> 00:25:20,080
Also, this is the spinning cube of potential doom, which you may have heard about.

283
00:25:21,300 --> 00:25:27,220
And the idea is it shows network flows in 3D space.

284
00:25:28,440 --> 00:25:43,600
And in the foreground, though, if you look at how information is rounded down, then this is a whole class B network mapped to the 2 to the 16th bits, mapped along about 500 or 800 pixels.

285
00:25:43,860 --> 00:25:55,740
And the entire internet is on the green line, so you are mapping 2 to the 32nd, more or less, along the vertical axis, so you are losing a great deal of information.

286
00:25:56,160 --> 00:26:00,580
And then the Z axis, blue, they are mapping the target port.

287
00:26:00,660 --> 00:26:17,680
And it turns out that an attacker, if you are using this to watch your network, the attacker would be able to operate with tens of thousands of degrees of freedom as far as destination port, destination IP, and source IP, and illuminate only a single pixel.

288
00:26:18,040 --> 00:26:21,800
So again, looking at the scaling in place is significant.

289
00:26:22,780 --> 00:26:29,320
And of course, just using a little bit, you put something on the screen, it is easy often to put something on top of it.

290
00:26:30,120 --> 00:26:33,600
Some types are more susceptible than others.

291
00:26:34,040 --> 00:26:38,600
As well as just inserting some random noise or carefully crafted noise.

292
00:26:39,860 --> 00:26:49,240
So how do you protect people, how do you protect your users from small amounts of information having a major impact on what they see?

293
00:26:49,240 --> 00:27:02,720
Well, the first thing, and there is no cure-all, in systems where there is some degree of authentication, then that is better than no authentication, or limited where you just basically have to click on an email to verify your identity or something.

294
00:27:05,120 --> 00:27:10,800
And I think it is not appropriate, for you, I am just telling you, for entertainment purposes, this next one.

295
00:27:11,200 --> 00:27:15,940
I am telling the other people this line because they need to do it.

296
00:27:16,180 --> 00:27:20,020
That you need to design systems with malicious data in mind.

297
00:27:20,020 --> 00:27:26,080
Often times they live in a utopian world in design systems where they just think only happy data will arrive.

298
00:27:27,380 --> 00:27:44,640
But to design systems with malicious data, as well as to train users to be alert for them, and you train people not to give away their passwords over the phone or whatever, that you train users to be aware of the weaknesses, as well as to allow them to customize the system.

299
00:27:46,060 --> 00:27:47,980
So again, there is more on this.

300
00:27:48,000 --> 00:27:51,900
This paper is on your CD, if you are interested in some more detail.

301
00:27:54,640 --> 00:27:59,040
And as well on the CD, I have got some other links you can go to for more information.

302
00:28:02,220 --> 00:28:03,100
One moment...

303
00:28:24,190 --> 00:28:27,430
So this is a tool I released at Black Hat.

304
00:28:27,430 --> 00:28:29,790
And the idea is it is a network PVR.

305
00:28:29,910 --> 00:28:35,550
And each of these windows, each of these black squares is a thumbnail that shows you your network traffic.

306
00:28:44,500 --> 00:28:47,660
So let me go ahead and load a packet capture data set.

307
00:28:48,060 --> 00:28:51,760
And this data set is a packet capture from HoneyNet Scan of the Month.

308
00:28:52,000 --> 00:28:53,760
And you can see it is loading the packets.

309
00:28:54,420 --> 00:28:56,240
And there is 3,300 packets.

310
00:28:56,520 --> 00:28:57,620
So this is what I was working on.

311
00:28:57,620 --> 00:28:59,200
Remember, I am going back to what I said before.

312
00:28:59,200 --> 00:29:06,000
I wanted to build tools that would raise the bar on how visible attacks are to the people watching the networks.

313
00:29:06,140 --> 00:29:09,640
Then I wanted to take a further step and look at, well, how could that be subverted?

314
00:29:09,880 --> 00:29:12,300
So I will point you toward my Black Hat slides.

315
00:29:12,300 --> 00:29:16,720
And I will be posting those in a little while where it goes into more detail on how this works.

316
00:29:16,720 --> 00:29:18,920
But I will give you a quick tour.

317
00:29:18,920 --> 00:29:20,560
And this is also on your CD.

318
00:29:22,880 --> 00:29:26,100
The idea is there are different views that show you your data.

319
00:29:29,620 --> 00:29:30,720
Most straightforward.

320
00:29:30,720 --> 00:29:32,260
And they all operate in tandem.

321
00:29:32,260 --> 00:29:35,360
So what you see in one occurs in another.

322
00:29:35,660 --> 00:29:41,540
So if we play it, you start seeing the data, different views are all operating in lockstep.

323
00:29:41,540 --> 00:29:44,620
So the most straightforward one is showing you the text in the packets.

324
00:29:44,620 --> 00:29:46,100
This is a text view.

325
00:29:46,360 --> 00:29:54,180
It will go and show you the hex view as well as a decimal view.

326
00:29:54,660 --> 00:29:59,360
But anyway, things like it has the strings command built in.

327
00:29:59,360 --> 00:30:06,420
So you can filter just for the text, strings of a given length in the packets.

328
00:30:11,120 --> 00:30:14,500
This view shows one packet per line.

329
00:30:14,500 --> 00:30:22,460
And you can see it illuminates the pixel on that line if that hex value exists.

330
00:30:22,460 --> 00:30:27,280
So for example, in this region here, that's the printable ASCII range.

331
00:30:27,280 --> 00:30:34,720
So if I hover over it, you can see that that's a B, a J, and so on.

332
00:30:34,720 --> 00:30:38,580
So you can see the characteristics of it.

333
00:30:38,660 --> 00:30:41,560
It will also do the frequency of the bytes per packet.

334
00:30:42,700 --> 00:30:44,020
And you can set a threshold

335
00:30:48,350 --> 00:30:48,770
for that.

336
00:30:48,770 --> 00:30:55,290
Anything above a certain threshold will be hot, so we can move the threshold down until we start finding the tipping point.

337
00:30:59,240 --> 00:31:02,560
It looks relative to each packet in that case.

338
00:31:02,900 --> 00:31:04,700
I don't pad anything.

339
00:31:08,850 --> 00:31:10,510
Yeah, this is very straightforward.

340
00:31:10,510 --> 00:31:11,690
It's kind of like an initial step.

341
00:31:11,690 --> 00:31:17,730
I mean, there's all sorts of entropy algorithms I could use to do all sorts of cool things with this type of view.

342
00:31:20,430 --> 00:31:26,850
You can see the bytes occurring in each packet, but changing with a regular consistency so you can look at the slope.

343
00:31:28,290 --> 00:31:31,150
So that's the byte frequency view.

344
00:31:31,410 --> 00:31:34,250
I think you'll find this one particularly entertaining.

345
00:31:34,250 --> 00:31:39,930
This is called a parallel coordinate plot, and essentially you're connecting the dots on these axes.

346
00:31:40,690 --> 00:31:48,070
Where I'm going with it is it's connecting the dots between every header field that's possible.

347
00:31:48,070 --> 00:31:48,830
That's my goal.

348
00:31:48,830 --> 00:31:50,770
I've got 17 fields in it now.

349
00:31:54,330 --> 00:31:59,690
So if I go like this, it shows the fields.

350
00:31:59,950 --> 00:32:00,610
Keep going.

351
00:32:02,170 --> 00:32:08,790
The idea, then, is you can go through one at a time and see each packet and see its values for every header field.

352
00:32:10,250 --> 00:32:11,850
Or you can play it.

353
00:32:13,270 --> 00:32:17,410
And what you see growing on the right, that's the IP identification field.

354
00:32:17,410 --> 00:32:20,130
You can see the distribution of packets .

355
00:32:21,110 --> 00:32:28,930
And the idea, then, is you can take 5,000 packets, roll them through this, and at least watch them unfold and get a feel for what happens.

356
00:32:28,930 --> 00:32:31,970
So you can see random activity for a given field.

357
00:32:31,970 --> 00:32:33,990
You can see sequential activity.

358
00:32:34,090 --> 00:32:38,490
You can see things that don't change, things that change a lot, and so on.

359
00:32:40,150 --> 00:32:43,150
I'm going for a whole model of interaction here, like a mixing board

360
00:32:52,060 --> 00:32:52,760
Let me open this tool.

361
00:32:52,760 --> 00:32:56,000
Let me show you one or two more windows and then I'll show you how to attack it.

362
00:32:56,560 --> 00:33:00,600
They're using it for capture the flag, too, to show the network, on occasion.

363
00:33:01,840 --> 00:33:03,260
So you can have some fun.

364
00:33:04,460 --> 00:33:06,360
This is more of a matrix view.

365
00:33:07,960 --> 00:33:16,080
It does have some uses other than just looking cool, but we're kind of tight for time and I don't want to blather on about it.

366
00:33:16,880 --> 00:33:25,420
But this is one packet per line and it's showing you the bits if the pixel is on, if there's a one on the wire.

367
00:33:25,420 --> 00:33:27,380
So you can see different types of packets.

368
00:33:27,660 --> 00:33:35,860
And you can see at a glance the length of the packet, as well as I've played around with such things as, well, show me the printable ASCII values in there.

369
00:33:35,880 --> 00:33:39,280
So when I do that, it greys out everything that's not printable ASCII.

370
00:33:39,420 --> 00:33:41,660
And this is, the blue is printable ASCII.

371
00:33:41,660 --> 00:33:46,600
So you can see at a glance what packets, after you've filtered things, contain printable ASCII.

372
00:33:47,260 --> 00:33:50,560
I've also played around with the idea of no-ops.

373
00:33:50,560 --> 00:33:56,040
I like the idea of disassembling code on the fly.

374
00:33:56,040 --> 00:34:11,220
Looking at things as if they are executables and perhaps you as an analyst, if it's color-coded by common opcodes or something, will be able to look at the flow or the packets and say, that looks like an executable going across the wire and it's not supposed to be there.

375
00:34:11,220 --> 00:34:15,900
Perhaps you'll see something your intrusion detection systems or anomaly detection systems won't.

376
00:34:23,650 --> 00:34:28,290
And the final one, and this is the final zone for networks.

377
00:34:28,870 --> 00:34:30,890
It's connecting the dots between any fields.

378
00:34:30,890 --> 00:34:49,750
I don't know if you can quite see it in the back, but it's connecting the dots and then pixels fly off and slide off the screen based on what, and this is showing source IP to destination port, TCP port, but as it happens, they fly off the screen.

379
00:34:49,750 --> 00:34:52,610
So you can see a variety of activities.

380
00:34:52,950 --> 00:34:55,390
And the way it's set up is you can compare anything to anything.

381
00:34:56,690 --> 00:34:58,670
You can look at combinations that might be of use to you.

382
00:34:59,250 --> 00:35:06,950
And if you have the different windows open, all at the same time, running lockstep, you might be able to find things you wouldn't be able to find using today's tools.

383
00:35:07,270 --> 00:35:08,810
So anyway, this is on your CD.

384
00:35:09,430 --> 00:35:14,270
I'd encourage you, and I'll give you the link to go to the website where you can download the latest version.

385
00:35:14,270 --> 00:35:16,110
I made a little bit of a fix.

386
00:35:16,430 --> 00:35:19,130
It crashes on a certain header condition.

387
00:35:20,290 --> 00:35:22,970
But I'll post that when I get back from DEF CON.

388
00:35:23,850 --> 00:35:25,230
Anyway, going back to the topic.

389
00:35:26,530 --> 00:35:28,290
And I thought, how can I attack it?

390
00:35:33,010 --> 00:35:34,930
So let's look at some basic attacks.

391
00:35:35,530 --> 00:35:40,890
It really doesn't take much to bring down a visualization system if you're so inclined.

392
00:35:47,050 --> 00:35:49,770
So I showed you what normal looked like.

393
00:35:51,650 --> 00:35:53,570
Something odd happened here.

394
00:35:59,010 --> 00:36:01,510
So let's go ahead and see what the attack looked like.

395
00:36:07,050 --> 00:36:09,030
Now this is only 203 packets.

396
00:36:09,030 --> 00:36:20,670
So if you were displaying information, looking at a data set, watching capture the flag, I'm using random IPs, and we're only at 30, and it's already becoming crowded.

397
00:36:21,650 --> 00:36:24,550
And look what's going on on the UDP.

398
00:36:24,550 --> 00:36:27,570
This is color-coded, so orange is UDP traffic.

399
00:36:27,690 --> 00:36:30,930
You can see that it's filling up the display pretty quickly.

400
00:36:30,930 --> 00:36:35,470
With only 180 packets, it's already a windshield wiper effect.

401
00:36:35,470 --> 00:36:38,290
Well, as it turns out, you don't need to hit every single port.

402
00:36:40,590 --> 00:36:41,790
You can see how it's scaled.

403
00:36:41,970 --> 00:36:49,370
So I only need to hit every 60th port with a packet to draw the line and create that solid effect.

404
00:36:50,950 --> 00:36:54,210
So let's look at another example that totally melts it down.

405
00:37:23,940 --> 00:37:28,660
So again, just a small amount of information can generate a lot of noise for the human.

406
00:37:34,630 --> 00:37:37,250
So this is 1,300 packets.

407
00:37:37,930 --> 00:37:39,990
This is pretty much a nuclear meltdown.

408
00:37:40,270 --> 00:37:43,490
Now you can change the speed as well, so I'll change the speed to max.

409
00:37:44,470 --> 00:37:47,250
And look what's happened on the IP address space.

410
00:37:50,010 --> 00:37:59,850
But you can also see what I haven't messed with, so perhaps something is constant and maybe they have a consistent time to live or something that you can grab ahold of and create a filter to counter this.

411
00:38:00,490 --> 00:38:07,690
So again, I tried to create the tool and then think about how it would be attacked and then how we can defend and it never ends, but I think this is worth looking at.

412
00:38:07,750 --> 00:38:09,430
So that's a meltdown.

413
00:38:10,510 --> 00:38:12,310
There are other interesting uses.

414
00:38:12,530 --> 00:38:14,830
Who saw the talk at Black Hat?

415
00:38:15,670 --> 00:38:18,130
Okay, if you saw the talk at Black Hat, don't give this away.

416
00:38:18,130 --> 00:38:19,670
But there are other interesting uses.

417
00:38:28,020 --> 00:38:29,840
So this is 600 packets.

418
00:38:33,240 --> 00:38:38,780
And if you look at it, say, in the parallel coordinate plot display, you can get the 600 packets.

419
00:38:38,780 --> 00:38:41,280
You can look and see a quick overview of what happened.

420
00:38:45,150 --> 00:38:45,770
Okay.

421
00:38:46,190 --> 00:38:48,070
And again, you can run through them.

422
00:38:48,850 --> 00:38:55,730
Well, it really just looks like a lot of source ports were in use, but other than that, not the same IPs were used.

423
00:38:57,930 --> 00:39:00,310
So let's play it again, though, with a different view.

424
00:39:04,840 --> 00:39:14,140
So if we look at the frequency of the packets, then, you notice odd clouds of packets, of groupings of bytes.

425
00:39:16,860 --> 00:39:21,960
Then if we look at it as a rainfall, remember, this is one packet per line.

426
00:39:22,280 --> 00:39:28,600
And the way this is, it takes each byte on the wire, maps it to a pixel, is a grayscale.

427
00:39:28,960 --> 00:39:34,540
So you can see the rainfall effect of the bytes on the wire is grayscale.

428
00:39:48,670 --> 00:39:50,810
It's have I or could you?

429
00:39:52,910 --> 00:39:57,230
Right now, the idea is that there's a degree of flexibility built in.

430
00:39:57,230 --> 00:40:00,790
The question was, how much can I change the mapping of colors?

431
00:40:08,320 --> 00:40:12,020
Well, the extent as it stands, there's no technical reason you couldn't do that.

432
00:40:12,020 --> 00:40:15,400
As far as what it's coded, I have filters built in.

433
00:40:15,400 --> 00:40:16,600
Right now, they're straightforward.

434
00:40:16,600 --> 00:40:23,280
I want to go to greater complexity, but they'll filter certain streams of TCP, UDP, ICMP.

435
00:40:23,280 --> 00:40:27,140
And you can change the colors by clicking on there, and that'll change it.

436
00:40:27,140 --> 00:40:29,940
But the degree of customizability isn't there yet.

437
00:40:30,480 --> 00:40:33,200
But it's certain there's no technical reason that couldn't occur.

438
00:40:39,900 --> 00:40:44,580
So just to wrap up, again, on your CD, you've got the talk slides.

439
00:40:44,860 --> 00:40:47,780
The roommate tool itself is on the CD.

440
00:40:48,660 --> 00:40:51,800
The malicious visualization paper is on the CD.

441
00:40:51,920 --> 00:40:56,060
And there's a hacker convention article I want to point you toward.

442
00:40:56,600 --> 00:41:02,220
Because I know some of you have difficulty explaining why it's of value to come here.

443
00:41:02,600 --> 00:41:03,820
Or is it just me?

444
00:41:04,620 --> 00:41:05,460
Right?

445
00:41:06,600 --> 00:41:16,740
So I was able to get into the communications of the ACM, which is like the Professional Computer Society's lead journal on why computer sciences should attend hacker conventions.

446
00:41:16,960 --> 00:41:20,820
So hopefully, we can change some perceptions out there.

447
00:41:20,820 --> 00:41:25,680
And you can wave this around in front of your husband, wife, or boss.

448
00:41:25,940 --> 00:41:27,380
Or parent.

449
00:41:30,100 --> 00:41:31,760
And that's on the CD as well.

450
00:41:35,860 --> 00:41:39,640
I'm looking for anyone who could give me feedback on the tool.

451
00:41:40,580 --> 00:41:42,220
It's at roommate.org.

452
00:41:42,220 --> 00:41:43,720
Again, it's there.

453
00:41:43,720 --> 00:41:45,200
It's on your CD as well.

454
00:41:45,500 --> 00:41:47,640
I'm in school, and I'm trying to graduate.

455
00:41:47,640 --> 00:41:49,640
So I need feedback to make it better.

456
00:41:49,920 --> 00:41:52,900
And right now, I've got a two-page, five-minute survey.

457
00:41:52,940 --> 00:42:01,580
If anybody would be kind and see Julian, I'd be permanently indebted to you if you could take five minutes of your time and fill that out.

458
00:42:01,580 --> 00:42:02,320
It would help.

459
00:42:02,740 --> 00:42:10,660
And basically, if you're an Ethereal user I'd love to see some quick questions on how can people mess with your minds if you are using that tool.

460
00:42:10,660 --> 00:42:11,660
Or how they happen.

461
00:42:15,420 --> 00:42:16,840
Lots of people to thank.

462
00:42:16,840 --> 00:42:20,500
I've been iterating through this in small groups.

463
00:42:20,560 --> 00:42:22,720
And I've gotten a lot of feedback from a lot of people.

464
00:42:22,720 --> 00:42:24,480
So too many to thank at one time.

465
00:42:25,840 --> 00:42:27,760
Finally, I wanted to end with...

466
00:42:27,760 --> 00:42:29,400
I've had a good experience at Georgia Tech.

467
00:42:29,400 --> 00:42:30,880
A very positive experience.

468
00:42:31,060 --> 00:42:32,100
And I've enjoyed the...

469
00:42:32,100 --> 00:42:36,440
They've got an undergrad and grad or master's and PhD programs in InfoSec.

470
00:42:36,460 --> 00:42:42,020
So if you're interested in that you can send me an email and I'd be happy to answer your questions or point you to someone who could.

471
00:42:42,200 --> 00:42:44,580
As well as they're looking to partner with industry.

472
00:42:44,680 --> 00:42:47,320
Again, this is part of my business case for coming out here.

473
00:42:48,660 --> 00:42:50,760
They're looking to partner with industry and government.

474
00:42:50,760 --> 00:42:55,920
So if you're looking to kind of like outsourced R&D, they're very much up for that.

475
00:42:56,000 --> 00:42:59,100
And the website or I could point you to more information.

476
00:43:03,640 --> 00:43:04,520
Yes.

477
00:43:10,030 --> 00:43:13,230
The website is outdated as of now.

478
00:43:13,250 --> 00:43:14,810
So I wanted to release it at Black Hat.

479
00:43:14,810 --> 00:43:18,550
So when I get back, the version on the CD is like 1.7 something.

480
00:43:18,550 --> 00:43:22,130
And I have 1.8 something that I will release as soon as I get back.

481
00:43:22,130 --> 00:43:23,250
It'll function.

482
00:43:23,510 --> 00:43:25,470
It's IP header length.

483
00:43:25,710 --> 00:43:28,330
If it's not 5, it'll crash.

484
00:43:29,350 --> 00:43:30,790
Which is 5 is the normal value.

485
00:43:30,790 --> 00:43:33,990
But if you get other things, then it'll crash.

486
00:43:35,490 --> 00:43:36,410
This is a sample file.

487
00:43:36,410 --> 00:43:38,670
And a key point is it doesn't load PCAP natively.

488
00:43:38,670 --> 00:43:41,970
So I have a little conversion tool that converts it to the file format.

489
00:43:41,970 --> 00:43:43,770
So the tool's on the CD.

490
00:43:43,770 --> 00:43:44,990
It runs on XP.

491
00:43:45,310 --> 00:43:49,690
And I have a sample data file on there for you to take a look at and play with.

492
00:43:54,280 --> 00:43:55,080
Yes.

493
00:43:59,780 --> 00:44:00,800
I have not.

494
00:44:00,800 --> 00:44:02,440
But I don't see any reason why not.

495
00:44:02,440 --> 00:44:10,660
I mean, I want to show like the picture of what it looked like or whatever with the PCAP file and the file format for my tool.

496
00:44:11,580 --> 00:44:13,120
I mean, they're not sensitive or anything.

497
00:44:13,120 --> 00:44:14,840
So yeah, absolutely, I want to share them.

498
00:44:15,260 --> 00:44:16,120
But I haven't.

499
00:44:16,200 --> 00:44:18,920
It's one of those things like the week I get back, I'll be working that.

500
00:44:24,390 --> 00:44:26,550
Well, I'd like to thank you all for coming.

501
00:44:26,550 --> 00:44:27,930
Julian's in the yellow shirt.

502
00:44:28,210 --> 00:44:37,050
If any of you could fill out the survey, if you've worked with Ethereal and always wondered how you can mess with people through it or work with Snort, I would appreciate it.

503
00:44:37,050 --> 00:44:38,810
And if anybody's interested, I'll be outside.

504
00:44:38,810 --> 00:44:39,150
Thank you.