First, I'd like to thank you all for coming. I'm Greg Conti.
And I'd like to talk to you about the idea of denial of information attacks.
And in one sentence, the idea is attacking humans through the computer system.
Not attacking the computer system, but attacking humans through their computer system,
and how we can counteract that.
And here's one example.
Large shark.
Currently I'm at Georgia Tech, but I'm also in the Army.
And I'm here as a free citizen, and not as a representative of the government.
So, more specifically, denial of information attacks attack you, the human,
and try and consume the limited resources that you have.
If you contrast what you can handle versus what your computer can handle,
in certain categories, you'll fall over far faster than your box will.
So, if it slows you down or alters your decision making,
then that's a denial of information attack occurring.
So, I think the best example is spam.
And I won't ask you, but just consider how many of you have deleted email
based on, say, a subject line that you shouldn't have.
Or you've opened email that you shouldn't have.
And I know, when I talked to my wife about this,
we thought it was probably... you guys are at the leading edge.
So, when spam first started coming out, you probably figured that out pretty quickly.
But who's received, and I'll ask for a show of hands,
who has received a frantic email from a family member
about some virus email that they received?
Or some, you know, if your local tech support for you or your family or friends,
who's received emails like that?
Pretty much, you know, almost the whole room.
So, I think spam is an example.
I mean, consider how much time have you wasted on spam?
And these are just examples.
So, what I'm trying to do to this problem is look at the bigger picture
and look at the structure around it.
And then, how people are defending it and defenses
to just add some structure to the domain.
I'll take one step back.
And there's some interesting statistics that just recently came out
of the University of Indiana.
I'm sorry, Indiana University.
About phishing.
And what they did is they went to social networking sites like Orkut
and found out who was friends with who.
Then they used that information to send out a phishing email to college students
and they sent them out to 500 people.
But with the return address of a friend.
The emails were just like, hey, check this site out.
It gave a generic link off campus.
That link prompted them for their credentials or user ID and password from college.
And they were 72% successful.
And the students were very mad.
But there's some interesting statistics if you take a look at the gender.
If a male sent an email to another male, only 53% of them fell for it.
You can see where we're going here.
If a female sent an email to a male, it went up from 53% to 68%.
Female to female, 76%.
And then they live in a different world than I do.
But male to female, 78% of them fell for it.
So on average it was 72%.
So male to female was the worst category.
But I thought the real insight there was using that social networking information.
So I don't want you to confuse this with denial of service attacks.
This is a recent innovation from a major operating system manufacturer.
They've evolved from the blue screen of death to the red screen of death.
This is from Longhorn. I guess it's Vista these days.
Anyway, back to the...
It's not what you consider denial of service where you're consuming system resources, RAM, hard drive space, processing power.
You're consuming the human's resources is the key difference.
And it's compounded by the idea of information growth.
If you look, information is being generated at a prodigious rate.
This study is very, very good.
And I'd also like to mention I personally hate bullet slides, so I have very, very few in here.
But on the slides on your disk, on the Con CD, I've included an extended version that has more information with links and things.
Anyway, I just wanted to highlight one of these.
This is a study coming out of Berkeley from 2003 entitled How Much Information?
It's a very good study, except it's like 150 pages, which again is information overload.
But the surface web at that time, they estimated, was about 170 terabytes.
Or 17 times the U.S. Library of Congress print collection.
So a tremendous amount of information in 2003.
And that's just the surface web, not the dynamically generated web.
So we just talked about spam attacking primarily your cognitive decision making.
Well, there's other attacks that attack your perception.
I had this on a web page. How much work can you get done with that sitting on the web page blinking?
So that was on a real estate web page. I had to slide it off to the side to be able to get any work done.
And it just makes me mad. What were they thinking? Who's going to go out and buy coffee based on that?
So we talked about cognitive resources and perceptual resources.
Then we have motor resources.
And the idea then, if you go back to the denial of information attack,
if you're slowing the human down, you're beginning to win.
If you're sending them in the wrong direction, you're beginning to win.
Motor resource attacks often slow you down.
You have to stop what you're doing, grab the mouse, click the pop-up, get back to what you were doing.
And I thought this example from hack-proofing your network, again, gives an insight into the idea of the decision making by the human versus the decision making by the computer.
And I'll read it for those in the back.
In the end, all the power of the intrusion detection system is ultimately controlled by a single judgment call on whether or not to take action.
So if you can get into that decision making cycle, you can affect major outcomes.
I thought it was also relevant to look at information flows.
So if you consider signal being what you're looking for, if you're out on the web, for example, or in any information space, you're looking for certain information.
That would be the signal.
Noise would be everything but what you're looking for.
So the best case would be signal is very high, and noise would be very low, so that's the best situation.
So what you're trying to do is increase your signal-to-noise ratio.
If you consider a small amount of signal and a small amount of noise, it's still manageable for a human.
So you can look at this list of 10 things, and even if it's 50-50, you can still pick out what you're looking for.
Some Google results are like that.
But it starts getting worse when you have low signal-to-noise.
And particularly, you have a lot of noise, a little bit of signal, what you're looking for, that's the domain of the denial-of-information attack.
And then you start getting into denial-of-service.
If you have lots and lots of information, then you start overcoming your computer's resources.
So that's more the denial-of-service attack.
So if you consider this webpage, and this is weather.com.
I started going to specific news sites, and then I thought I'd get in trouble for whatever one I chose.
So I thought weather would be safe.
So if you went to this website to get something done, and I actually tried to do this to find out Las Vegas weather.
Yeah, I mean hot and dry, what was I thinking?
Anyway, say you came to this site, and putting your signal-to-noise ratio goggles on,
and all you wanted was the United States weather and some basic weather information.
All of that is noise.
So just a tremendous amount.
And I know there's some plug-ins for various browsers that help.
But the idea, if you can just get down to the signal, it's a tremendously better experience.
So besides the idea of the signal-to-noise ratio,
and the keynote speaker at Black Hat was Gilman Louie, who also mentioned this.
He is the CEO of In-Q-Tel, which I think is a CIA startup funding venture capital company.
I think it's pretty interesting.
But anyway, he mentioned the OODA loop.
And the OODA loop was Observe, Orient, Decide, and Act.
And it was developed by Colonel John Boyd, who was in the Air Force.
And this came out in the 60s, about how fighter pilots make decisions.
And if you could make your decisions faster than the other person, you could go through this cycle, then you win.
So consider, if you're in a certain situation, you're even looking at a webpage or any, looking at logs,
you have to observe the data, or even your email is probably the best example.
You have to observe your email, and after you observe it and orient yourself to it,
then you have to decide, what do I do?
And if it's a puzzling subject line, you spend time, you're wasting time, you're slowing down this loop.
And then after you do it, you have to act, and typically action requires some physical response,
which is a motor response, which will slow it down.
So if you're slowing your opponent's OODA loop down, again, you're conducting a successful attack.
So you can have people go through cycles unnecessarily, or you can slow it down.
So, with that in mind, Observe, Orient, Decide, and Act, let's look at the webpage again.
And this time, if your task was to just find out your local weather, which isn't available,
and it took me a while, so you observe this, and orient yourself to it,
and find out where do you type it in, where do you get your local weather.
So think how long it would take.
Well, it turns out, it's there. Everything else is noise for the task at hand.
So you've slowed the person down as they go through that.
And granted, they've got business reasons for doing so, they want to show you ads.
Some of the news websites are the worst offenders of all.
Okay, so moving forward, let's look at then, you've seen some of these examples, big examples,
let's look at how people are defending against these type of attacks.
And I spent about, oh jeez, three years of my life reading Slashdot every day,
looking for denial of information attacks in the news.
And certain trends came out of it.
And clearly, there were legal responses.
And you can consider the anti-telemarketer legislation, for example.
As well as regulatory.
There were moral responses, public relation campaigns,
from the Motion Picture Association of America, for example,
like you'll put our employees out of their jobs if you pirate movies.
And I was particularly intrigued by the use of violence.
Violence is, if people are receiving information they don't want,
violence has been a proven countermeasure in certain instances.
And I was particularly intrigued by the, let's see, Charles Bauer,
Charles Bauer case, where he received one spam too many,
and snapped, and started sending death threats back to the spammers.
And he was arrested for his troubles.
So, I want to take a harder look at, alright, you've got these limited resources,
how do they all interplay?
So, this is you.
And I've modeled it, and it's hard, many of you may not be able to see it,
but those boxes represent your cognitive capability, short-term memory, long-term memory.
And that's you in the red square, talking to your computer.
So, the arrows you see between that, actually, along this boundary,
that's your vision, your hearing, your speech, and your motor.
So, the input-output through your computer,
which also has a limited amount of resources,
CPU, RAM, hard drive space, and IO.
And it communicates, so you're the information consumer,
you're consuming information from information producers.
And you need to pull that information in, say from websites,
over some sort of communication channel.
Those are servers out there providing you the information.
They too have limited resources.
And often there's a human sitting there, you know, the spammer hits the send button.
But they could be things like unattended machines, like sensors.
So, if you take a closer look, then, you can see where these attacks take place.
For example, if you use very small text, like in legal agreements, in EULAs,
you will... that's attack against the vision of the recipient.
Spoofing the browser, you know, some of the phishing attacks
that have taken place occur along that HCI boundary.
And I just found this useful to get a feel for where these things are occurring.
To look at where attacks are taking place.
Maybe where new attacks could take place.
As well as where some defenses could be put up.
So, if you look at defenses, there's a...
the HCI boundary between you and your computer.
There's been a move forward in the notion of usable security.
Like security actually people can... it gives them the information they need.
TCP damping on the communication channel will slow down
even if a certain number of email exceed a given threshold.
They'll slow down the network pace.
And I believe that's actually... there's some penalties in capture the flag on that front.
Or pushing... most of these push the problem back to the attacker.
So you see computational puzzle solving.
Attack requires... if you want to send this email, for example,
requires a small amount of CPU space on the attacker.
And I'm particularly intrigued by Paul Graham's idea
of the Eliza spam responder.
And who's heard of that idea for spam in Eliza?
Okay, good.
The idea is Eliza's early straightforward artificial intelligence program
that was designed to be like a psychologist.
So the idea then is you have a...
listening on a given port or email address.
The email comes in. If they can craft it in such a way
that the spammer buys the response
and people all across the internet do that, we win.
So it's a pretty intriguing idea.
And it shows you, again, denial of information,
how little resources...
the spammer is relying on economies of scale,
10 million email to press of a button.
If you can, you know, 1% of those people
eat up a little bit of time, you've won.
So I thought this was Slashdot.
I love Slashdot. It's like this high of mind
and there's always interesting insights.
So from Slashdot on this subject,
I have a little PHP script that I use whenever I get a phishing email.
The script generates fake credit card numbers and expiration dates
and repeatedly hits the sites...
the phishing sites form dumping in random information.
Any halfway intelligent phisher would record the IP address
and just dump all of mine when he saw they were bogus.
But it makes me feel good that I at least wasted some of his time.
So again, you know, you push that back.
If a lot of people did... and I'm not encouraging...
I don't want to get drug off in shackles.
But it is intriguing, the idea of pushing the problem back to the spammer.
So I've looked at this...
well, honestly, entirely too much, this problem.
But I have... there are several papers on it that are on my website
that I'll give you the link at the end and it's on the CD.
But if you're interested, you know, on any of the papers,
on the website that are like pre-publication,
you can send me an email and I'll send you a private copy for review
or something like that.
And most of the others are available if you're interested in more.
I just tried to hit some highlights I thought you'd find entertaining.
So given that big problem, I wanted to look at a specific domain.
And there are a lot of people working in spam.
So I've looked specifically at network security.
And in particular, the idea of using information visualization
as a way to deal with that problem of denial of information attacks.
Because there's this battle and you see it during Capture the Flag
of hiding your activities from the human who's monitoring the system
or the intrusion detection systems or the defenders.
So I was looking at information visualization to do that.
So I came up with a tool that's a PVR
and it monitors network traffic and will load historical data sets
and provides different specially crafted windows
to hopefully provide you insight.
At Interzone, I had a friend who said
they thought they might have to change the rules of Capture the Flag
if all of a sudden you could see network activity in useful ways.
So that's the idea. I mean, the space we're in, everything's one-upmanship.
So I thought, okay, we have these windows and that's useful.
Well, how can we attack them?
Kind of take it one step forward and look at how can we look at the traffic
in ways that are useful, then take it another step and say,
okay, knowing how we all think,
okay, this is in place, this is cool, how can we attack it?
So this is what the tool looked like
and this is just a quick snapshot
and it's using the Microsoft Virtual Desktop
to show a few different panes at the same time.
I'll demo this at the end.
Okay, so last year at DEF CON, I gave a talk on a related subject
and the first question was, how do we attack it?
So combined with my interest and your interest,
I thought it would be an interesting space to look at.
And you'll find in academia, not many...
I mean, if you're not in the security field,
generally you're not in the security field.
So you can make a lot of progress just by looking at their stuff
and breaking it for them. It's pretty fun.
So that led to the work on malicious visualizations.
And then the idea was attacking the human through their computer,
through their system that presents information to them in some way.
So ideally, you can understand how these attacks occur,
then you can design better ways to protect yourself.
Ah, I was motivated by Pokemon.
Now I know at a normal academic conference,
people wouldn't know the answer to this.
But why was I motivated about Pokemon
as far as attacking people through information technology?
Seizures. Okay, very good.
In the late 1990s, there was a specific Pokemon episode
that had rapid flashing red lights in 20 to 30 hertz.
Well, it turns out that people who have photosensitive epilepsy,
that's just the right frequency to trigger a seizure.
And reports vary, but thousands of people went to the hospital with nausea,
and several hundred went to the hospital because of seizures.
So it got me thinking about reaching...
I know that's a very specific case,
but I think the prevalence in the US population
is about 2% through the lifetime for epilepsy.
So it's non-zero.
But it got me thinking about attacking people through computers.
But then I wanted to be realistic.
So, yeah, I mean, you just want theoretic attacks that never occur.
I wanted to look at, well, where can you really insert information
into what people see, and how can that little bit of information
impact a lot of information, or the display of the information.
So I made some assumptions.
I'm not dossing the system, I'm just adding a little bit of information,
trying to skew the results as much as possible and trick people.
As well as, in some cases, I think it's reasonable to assume
you could alter the timing of the data,
particularly if you had access to the sensor or something,
or the network, somewhere in between, you might be able to slow it down.
But I really focused on adding a little bit of information.
And I did not assume that you'd compromise their computer
and you'd have full access to the database to do whatever you want with it.
I wanted some places where you could really do it.
So, you know, network traffic is where I spent most of my time.
Particularly in this area.
Because, I mean, clearly you can spoof packets, you can inject things.
I mean, you're constrained in some ways by protocols or upstream network devices.
But still, the network, you can insert information pretty much at random.
As well as some of these other domains.
Any place where you can insert some amount of information,
then there can be a problem.
So, going back to the model, I assumed that anywhere in that space,
along the communication channel, or the information producer,
could insert a little bit of information.
And then the timing attack would occur.
Even on the sensor itself, but I was looking more at the network in between.
So how do these things manifest themselves?
I looked at all the different places where they could manifest themselves,
but I've chosen some highlights here I think would be best just to show you the idea.
So I focused on your computer.
How people can send a little bit of malicious information to your computer
so that it will present you a lot of malicious information in a visual display.
So what really got me thinking is just some tools,
and this is a $10,000 visualization tool.
It labels things, only puts 20 labels on the display.
So if you hit a threshold above 20 labels, labels start disappearing.
So I thought, if you can exceed limits of the program,
then you're gaining ground, you're slowing people down,
they may miss what you want them to miss, or see what you want them to see.
And even better in displaying information,
oftentimes labeling algorithms are used,
and you can see here that it doesn't take much
to start filling up a display with labels.
And, you know, it dropped out here, and they're not even sorted in this one.
So perhaps just a little bit, you can start hitting the threshold.
And even better, I think, is you see auto-scaling algorithms,
where this graphic, the left-hand side,
shows ports on external computers that are talking,
and on the right-hand side are ports on your computer.
So it connects the dots between one to the other,
what port to what port.
And if you look at the little detail,
you have a great deal, that was the initial display,
it was like 1 to 135, but this tool auto-scaled.
So initially, I saw exactly what I wanted to see.
I winged one packet to a high port, it auto-scaled it,
reduced all that relevant information down to one pixel.
So then you have to waste time, grab the mouse,
zoom in, zoom out, just by winging one packet high.
Now you may think this is just arbitrary,
but you see this in real life.
This is a very common web log analysis program.
So here, and this is from the Netty at Home project,
you see a spike of activity,
and actually this was a site being slashed out.
So yes, it's more akin to the Nile service attack,
but it does illustrate that you can impact,
I mean, web logs, you can enter information in,
I mean, you probably send ASCII art into web logs,
if you are so inclined,
but that input in the logs,
and then you can alter how the information is displayed.
So you see that on the day of the slash dotting,
it flat-lined everything else.
So, you know, everything else is gone.
Also, this is the spinning cube of potential doom,
which you may have heard about.
And the idea is it shows network flows in 3D space.
And in the foreground, though,
if you look at how information is rounded down,
then this is a whole class B network mapped
to the 2 to the 16th bits,
mapped along about 500 or 800 pixels.
And the entire internet is on the green line,
so you are mapping 2 to the 32nd, more or less,
along the vertical axis,
so you are losing a great deal of information.
And then the Z axis, blue,
they are mapping the target port.
And it turns out that an attacker,
if you are using this to watch your network,
the attacker would be able to operate
with tens of thousands of degrees of freedom
as far as destination port,
destination IP, and source IP,
and illuminate only a single pixel.
So again, looking at the scaling in place
is significant.
And of course, just using a little bit,
you put something on the screen,
it is easy often to put something on top of it.
Some types are more susceptible than others.
As well as just inserting some random noise
or carefully crafted noise.
So how do you protect people,
how do you protect your users
from small amounts of information
having a major impact on what they see?
Well, the first thing, and there is no cure-all,
in systems where there is some degree of authentication,
then that is better than no authentication,
or limited where you just basically have to click on an email
to verify your identity or something.
And I think it is not appropriate,
for you, I am just telling you,
for entertainment purposes, this next one.
I am telling the other people this line
because they need to do it.
That you need to design systems
with malicious data in mind.
Often times they live in a utopian world
in design systems where they just think
only happy data will arrive.
But to design systems with malicious data,
as well as to train users to be alert for them,
and you train people not to give away
their passwords over the phone or whatever,
that you train users to be aware of the weaknesses,
as well as to allow them to customize the system.
So again, there is more on this.
This paper is on your CD,
if you are interested in some more detail.
And as well on the CD,
I have got some other links you can go to
for more information.
One moment...
So this is a tool I released at Black Hat.
And the idea is it is a network PVR.
And each of these windows,
each of these black squares is a thumbnail
that shows you your network traffic.
So let me go ahead and load a packet capture data set.
And this data set is a packet capture
from HoneyNet Scan of the Month.
And you can see it is loading the packets.
And there is 3,300 packets.
So this is what I was working on.
Remember, I am going back to what I said before.
I wanted to build tools that would raise the bar
on how visible attacks are
to the people watching the networks.
Then I wanted to take a further step
and look at, well, how could that be subverted?
So I will point you toward my Black Hat slides.
And I will be posting those in a little while
where it goes into more detail on how this works.
But I will give you a quick tour.
And this is also on your CD.
The idea is there are different views
that show you your data.
Most straightforward.
And they all operate in tandem.
So what you see in one occurs in another.
So if we play it,
you start seeing the data,
different views are all operating in lockstep.
So the most straightforward one
is showing you the text in the packets.
This is a text view.
It will go and show you
the hex view
as well as a decimal view.
But anyway,
things like it has
the strings command built in.
So you can filter
just for the text,
strings of a given length
in the packets.
This view shows
one packet per line.
And you can see
it illuminates the pixel on that line
if that hex value exists.
So for example,
in this region here,
that's the printable ASCII range.
So if I hover over it,
you can see that that's a B,
a J, and so on.
So you can see
the characteristics of it.
It will also do the frequency
of the bytes per packet.
And you can set a threshold
for that.
Anything above a certain threshold
will be hot,
so we can move the threshold down
until we start finding the tipping point.
It looks relative to each packet
in that case.
I don't pad anything.
Yeah, this is very straightforward.
It's kind of like an initial step.
I mean, there's all sorts of
entropy algorithms I could use
to do all sorts of cool things
with this type of view.
You can see the bytes occurring
in each packet,
but changing with a regular consistency
so you can look at the slope.
So that's the byte frequency view.
I think you'll find this one
particularly entertaining.
This is called a parallel coordinate plot,
and essentially you're connecting
the dots on these axes.
Where I'm going with it
is it's connecting the dots
between every header field
that's possible.
That's my goal.
I've got 17 fields in it now.
So if I go like this,
it shows the fields.
Keep going.
The idea, then,
is you can go through one at a time
and see each packet
and see its values
for every header field.
Or you can play it.
And what you see growing on the right,
that's the IP identification field.
You can see the distribution
of packets.
And the idea, then,
is you can take 5,000 packets,
roll them through this,
and at least watch them unfold
and get a feel for what happens.
So you can see random activity
for a given field.
You can see sequential activity.
You can see things that don't change,
things that change a lot,
and so on.
I'm going for a whole model
of interaction here,
like a mixing board
Let me open this tool.
Let me show you one or two more windows
and then I'll show you how to attack it.
They're using it for capture the flag, too,
to show the network,
on occasion.
So you can have some fun.
This is more of a matrix view.
It does have some uses
other than just looking cool,
but we're kind of tight for time
and I don't want to blather on about it.
But this is one packet per line
and it's showing you the bits
if the pixel is on,
if there's a one on the wire.
So you can see different types of packets.
And you can see at a glance
the length of the packet,
as well as I've played around with such things
as, well, show me the printable ASCII values in there.
So when I do that,
it greys out everything that's not printable ASCII.
And this is, the blue is printable ASCII.
So you can see at a glance
what packets, after you've filtered things,
contain printable ASCII.
I've also played around with the idea of no-ops.
I like the idea of disassembling code on the fly.
Looking at things as if they are executables
and perhaps you as an analyst,
if it's color-coded by common opcodes or something,
will be able to look at the flow or the packets
and say, that looks like an executable
going across the wire
and it's not supposed to be there.
Perhaps you'll see something
your intrusion detection systems
or anomaly detection systems won't.
And the final one,
and this is the final zone for networks.
It's connecting the dots between any fields.
I don't know if you can quite see it in the back,
but it's connecting the dots
and then pixels fly off
and slide off the screen
based on what, and this is showing
source IP to destination port,
TCP port,
but as it happens,
they fly off the screen.
So you can see a variety of activities.
And the way it's set up
is you can compare anything to anything.
You can look at combinations
that might be of use to you.
And if you have the different windows open,
all at the same time, running lockstep,
you might be able to find things
you wouldn't be able to find using today's tools.
So anyway, this is on your CD.
I'd encourage you, and I'll give you the link
to go to the website
where you can download the latest version.
I made a little bit of a fix.
It crashes on a certain header condition.
But I'll post that
when I get back from DEF CON.
Anyway, going back to the topic.
And I thought, how can I attack it?
So let's look at some basic attacks.
It really doesn't take much
to bring down a visualization system
if you're so inclined.
So I showed you what normal looked like.
Something odd happened here.
So let's go ahead
and see what the attack looked like.
Now this is only 203 packets.
So if you were displaying information,
looking at a data set,
watching capture the flag,
I'm using random IPs,
and we're only at 30,
and it's already becoming crowded.
And look what's going on on the UDP.
This is color-coded,
so orange is UDP traffic.
You can see that it's filling up
the display pretty quickly.
With only 180 packets,
it's already a windshield wiper effect.
Well, as it turns out,
you don't need to hit every single port.
You can see how it's scaled.
So I only need to hit every 60th port
with a packet to draw the line
and create that solid effect.
So let's look at another example
that totally melts it down.
So again, just a small amount of information
can generate a lot of noise for the human.
So this is 1,300 packets.
This is pretty much a nuclear meltdown.
Now you can change the speed as well,
so I'll change the speed to max.
And look what's happened on the IP address space.
But you can also see what I haven't messed with,
so perhaps something is constant
and maybe they have a consistent time to live
or something that you can grab ahold of
and create a filter to counter this.
So again, I tried to create the tool
and then think about how it would be attacked
and then how we can defend and it never ends,
but I think this is worth looking at.
So that's a meltdown.
There are other interesting uses.
Who saw the talk at Black Hat?
Okay, if you saw the talk at Black Hat,
don't give this away.
But there are other interesting uses.
So this is 600 packets.
And if you look at it, say,
in the parallel coordinate plot display,
you can get the 600 packets.
You can look and see a quick overview of what happened.
Okay.
And again, you can run through them.
Well, it really just looks like a lot of source ports were in use,
but other than that, not the same IPs were used.
So let's play it again, though, with a different view.
So if we look at the frequency of the packets, then,
you notice odd clouds of packets,
of groupings of bytes.
Then if we look at it as a rainfall,
remember, this is one packet per line.
And the way this is,
it takes each byte on the wire,
maps it to a pixel,
is a grayscale.
So you can see the rainfall effect
of the bytes on the wire is grayscale.
It's have I or could you?
Right now, the idea is that
there's a degree of flexibility built in.
The question was, how much can I change the mapping of colors?
Well, the extent as it stands,
there's no technical reason you couldn't do that.
As far as what it's coded, I have filters built in.
Right now, they're straightforward.
I want to go to greater complexity,
but they'll filter certain streams of TCP, UDP, ICMP.
And you can change the colors by clicking on there,
and that'll change it.
But the degree of customizability isn't there yet.
But it's certain there's no technical reason
that couldn't occur.
So just to wrap up,
again, on your CD, you've got the talk slides.
The roommate tool itself is on the CD.
The malicious visualization paper is on the CD.
And there's a hacker convention article
I want to point you toward.
Because I know some of you have difficulty
explaining why it's of value to come here.
Or is it just me?
Right?
So I was able to get into the communications of the ACM,
which is like the Professional Computer Society's
lead journal on why computer sciences
should attend hacker conventions.
So hopefully, we can change some perceptions out there.
And you can wave this around
in front of your husband, wife, or boss.
Or parent.
And that's on the CD as well.
I'm looking for anyone who could give me feedback
on the tool.
It's at roommate.org.
Again, it's there. It's on your CD as well.
I'm in school, and I'm trying to graduate.
So I need feedback to make it better.
And right now, I've got a two-page, five-minute survey.
If anybody would be kind and see Julian,
I'd be permanently indebted to you
if you could take five minutes of your time
and fill that out. It would help.
And basically, if you're an Ethereal user
I'd love to see some quick questions on
how can people mess with your minds
if you are using that tool.
Or how they happen.
Lots of people to thank.
I've been iterating through this
in small groups.
And I've gotten a lot of feedback
from a lot of people.
So too many to thank at one time.
Finally, I wanted to end with...
I've had a good experience at Georgia Tech.
A very positive experience.
And I've enjoyed the...
They've got an undergrad and grad
or master's and PhD programs in InfoSec.
So if you're interested in that
you can send me an email
and I'd be happy to answer your questions
or point you to someone who could.
As well as they're looking to partner with industry.
Again, this is part of my business case
for coming out here.
They're looking to partner with industry and government.
So if you're looking to kind of like
outsourced R&D,
they're very much up for that.
And the website or I could point you
to more information.
Yes.
The website is outdated as of now.
So I wanted to release it at Black Hat.
So when I get back, the version on the CD
is like 1.7 something.
And I have 1.8 something that I will release
as soon as I get back.
It'll function.
It's IP header length.
If it's not 5, it'll crash.
Which is 5 is the normal value.
But if you get other things,
then it'll crash.
This is a sample file.
And a key point is it doesn't load PCAP natively.
So I have a little conversion tool
that converts it to the file format.
So the tool's on the CD.
It runs on XP.
And I have a sample data file on there
for you to take a look at and play with.
Yes.
I have not.
But I don't see any reason why not.
I mean, I want to show like the picture
of what it looked like or whatever
with the PCAP file
and the file format for my tool.
I mean, they're not sensitive or anything.
So yeah, absolutely, I want to share them.
But I haven't.
It's one of those things like the week I get back,
I'll be working that.
Well, I'd like to thank you all for coming.
Julian's in the yellow shirt.
If any of you could fill out the survey,
if you've worked with Ethereal
and always wondered how you can mess with people
through it or work with Snort,
I would appreciate it.
And if anybody's interested, I'll be outside.
Thank you.