start	end	text
10640	13220	First, I'd like to thank you all for coming. I'm Greg Conti.
13220	17840	And I'd like to talk to you about the idea of denial of information attacks.
17860	23080	And in one sentence, the idea is attacking humans through the computer system.
23080	26880	Not attacking the computer system, but attacking humans through their computer system,
26880	28860	and how we can counteract that.
29200	31080	And here's one example.
31680	32860	Large shark.
33840	36860	Currently I'm at Georgia Tech, but I'm also in the Army.
36860	41280	And I'm here as a free citizen, and not as a representative of the government.
47780	53540	So, more specifically, denial of information attacks attack you, the human,
53540	57540	and try and consume the limited resources that you have.
57540	61240	If you contrast what you can handle versus what your computer can handle,
61240	67280	in certain categories, you'll fall over far faster than your box will.
67280	71400	So, if it slows you down or alters your decision making,
71400	75760	then that's a denial of information attack occurring.
76420	79220	So, I think the best example is spam.
79480	83040	And I won't ask you, but just consider how many of you have deleted email
83580	86800	based on, say, a subject line that you shouldn't have.
86860	90360	Or you've opened email that you shouldn't have.
90860	93580	And I know, when I talked to my wife about this,
93580	96320	we thought it was probably... you guys are at the leading edge.
96320	102160	So, when spam first started coming out, you probably figured that out pretty quickly.
102240	104620	But who's received, and I'll ask for a show of hands,
104620	107720	who has received a frantic email from a family member
107720	110840	about some virus email that they received?
110840	115240	Or some, you know, if your local tech support for you or your family or friends,
115240	117320	who's received emails like that?
117880	120500	Pretty much, you know, almost the whole room.
120560	123100	So, I think spam is an example.
123100	125540	I mean, consider how much time have you wasted on spam?
125540	128220	And these are just examples.
128360	131160	So, what I'm trying to do to this problem is look at the bigger picture
131160	133200	and look at the structure around it.
133200	135700	And then, how people are defending it and defenses
135700	140040	to just add some structure to the domain.
141120	142780	I'll take one step back.
142960	145760	And there's some interesting statistics that just recently came out
145760	147920	of the University of Indiana.
147920	149660	I'm sorry, Indiana University.
149960	152120	About phishing.
152120	158280	And what they did is they went to social networking sites like Orkut
158280	161040	and found out who was friends with who.
161040	166280	Then they used that information to send out a phishing email to college students
166280	168700	and they sent them out to 500 people.
169320	171720	But with the return address of a friend.
172260	175140	The emails were just like, hey, check this site out.
175140	177920	It gave a generic link off campus.
177920	184600	That link prompted them for their credentials or user ID and password from college.
185040	187900	And they were 72% successful.
188860	190940	And the students were very mad.
190940	194960	But there's some interesting statistics if you take a look at the gender.
195420	201200	If a male sent an email to another male, only 53% of them fell for it.
202340	204520	You can see where we're going here.
206940	212280	If a female sent an email to a male, it went up from 53% to 68%.
214560	218080	Female to female, 76%.
219280	221720	And then they live in a different world than I do.
221720	225640	But male to female, 78% of them fell for it.
225640	227620	So on average it was 72%.
227620	229980	So male to female was the worst category.
229980	233580	But I thought the real insight there was using that social networking information.
234980	238560	So I don't want you to confuse this with denial of service attacks.
238700	244940	This is a recent innovation from a major operating system manufacturer.
245640	249440	They've evolved from the blue screen of death to the red screen of death.
249920	252960	This is from Longhorn. I guess it's Vista these days.
252960	254960	Anyway, back to the...
254960	264460	It's not what you consider denial of service where you're consuming system resources, RAM, hard drive space, processing power.
264460	268220	You're consuming the human's resources is the key difference.
269340	272620	And it's compounded by the idea of information growth.
272620	277220	If you look, information is being generated at a prodigious rate.
277740	280000	This study is very, very good.
280000	285020	And I'd also like to mention I personally hate bullet slides, so I have very, very few in here.
285020	293360	But on the slides on your disk, on the Con CD, I've included an extended version that has more information with links and things.
293360	295660	Anyway, I just wanted to highlight one of these.
295680	302280	This is a study coming out of Berkeley from 2003 entitled How Much Information?
302460	307800	It's a very good study, except it's like 150 pages, which again is information overload.
307800	314160	But the surface web at that time, they estimated, was about 170 terabytes.
314160	319400	Or 17 times the U.S. Library of Congress print collection.
319440	323120	So a tremendous amount of information in 2003.
325420	328960	And that's just the surface web, not the dynamically generated web.
330000	341060	So we just talked about spam attacking primarily your cognitive decision making.
341320	344520	Well, there's other attacks that attack your perception.
344940	350780	I had this on a web page. How much work can you get done with that sitting on the web page blinking?
352020	357720	So that was on a real estate web page. I had to slide it off to the side to be able to get any work done.
357720	363200	And it just makes me mad. What were they thinking? Who's going to go out and buy coffee based on that?
364820	369340	So we talked about cognitive resources and perceptual resources.
369340	370960	Then we have motor resources.
371360	374720	And the idea then, if you go back to the denial of information attack,
374720	378400	if you're slowing the human down, you're beginning to win.
378400	381500	If you're sending them in the wrong direction, you're beginning to win.
381580	383880	Motor resource attacks often slow you down.
383880	389180	You have to stop what you're doing, grab the mouse, click the pop-up, get back to what you were doing.
391520	402100	And I thought this example from hack-proofing your network, again, gives an insight into the idea of the decision making by the human versus the decision making by the computer.
402100	403940	And I'll read it for those in the back.
404480	412740	In the end, all the power of the intrusion detection system is ultimately controlled by a single judgment call on whether or not to take action.
412740	418140	So if you can get into that decision making cycle, you can affect major outcomes.
420670	424110	I thought it was also relevant to look at information flows.
424150	432330	So if you consider signal being what you're looking for, if you're out on the web, for example, or in any information space, you're looking for certain information.
432470	433930	That would be the signal.
434270	437310	Noise would be everything but what you're looking for.
437550	443870	So the best case would be signal is very high, and noise would be very low, so that's the best situation.
443870	447130	So what you're trying to do is increase your signal-to-noise ratio.
448270	454410	If you consider a small amount of signal and a small amount of noise, it's still manageable for a human.
454410	460070	So you can look at this list of 10 things, and even if it's 50-50, you can still pick out what you're looking for.
460110	462430	Some Google results are like that.
464990	468210	But it starts getting worse when you have low signal-to-noise.
468210	476210	And particularly, you have a lot of noise, a little bit of signal, what you're looking for, that's the domain of the denial-of-information attack.
477910	480250	And then you start getting into denial-of-service.
480250	485950	If you have lots and lots of information, then you start overcoming your computer's resources.
485950	488250	So that's more the denial-of-service attack.
489530	492970	So if you consider this webpage, and this is weather.com.
492970	497310	I started going to specific news sites, and then I thought I'd get in trouble for whatever one I chose.
497310	498990	So I thought weather would be safe.
499150	505610	So if you went to this website to get something done, and I actually tried to do this to find out Las Vegas weather.
507370	509670	Yeah, I mean hot and dry, what was I thinking?
511570	517730	Anyway, say you came to this site, and putting your signal-to-noise ratio goggles on,
517730	522570	and all you wanted was the United States weather and some basic weather information.
524030	526030	All of that is noise.
526030	528370	So just a tremendous amount.
528370	531390	And I know there's some plug-ins for various browsers that help.
531470	536170	But the idea, if you can just get down to the signal, it's a tremendously better experience.
537630	541230	So besides the idea of the signal-to-noise ratio,
541230	546850	and the keynote speaker at Black Hat was Gilman Louie, who also mentioned this.
547170	555250	He is the CEO of In-Q-Tel, which I think is a CIA startup funding venture capital company.
555250	556250	I think it's pretty interesting.
557850	559850	But anyway, he mentioned the OODA loop.
559910	564610	And the OODA loop was Observe, Orient, Decide, and Act.
564610	568150	And it was developed by Colonel John Boyd, who was in the Air Force.
568150	573030	And this came out in the 60s, about how fighter pilots make decisions.
573170	578390	And if you could make your decisions faster than the other person, you could go through this cycle, then you win.
578390	584510	So consider, if you're in a certain situation, you're even looking at a webpage or any, looking at logs,
585130	589330	you have to observe the data, or even your email is probably the best example.
589450	595830	You have to observe your email, and after you observe it and orient yourself to it,
595830	597930	then you have to decide, what do I do?
598330	603990	And if it's a puzzling subject line, you spend time, you're wasting time, you're slowing down this loop.
604690	609770	And then after you do it, you have to act, and typically action requires some physical response,
609770	611910	which is a motor response, which will slow it down.
611910	620490	So if you're slowing your opponent's OODA loop down, again, you're conducting a successful attack.
620490	625050	So you can have people go through cycles unnecessarily, or you can slow it down.
627470	633310	So, with that in mind, Observe, Orient, Decide, and Act, let's look at the webpage again.
634470	641990	And this time, if your task was to just find out your local weather, which isn't available,
641990	646870	and it took me a while, so you observe this, and orient yourself to it,
646870	651390	and find out where do you type it in, where do you get your local weather.
652370	654950	So think how long it would take.
655310	660030	Well, it turns out, it's there. Everything else is noise for the task at hand.
660030	662510	So you've slowed the person down as they go through that.
662510	666810	And granted, they've got business reasons for doing so, they want to show you ads.
668650	672110	Some of the news websites are the worst offenders of all.
673730	678650	Okay, so moving forward, let's look at then, you've seen some of these examples, big examples,
678650	682050	let's look at how people are defending against these type of attacks.
684230	688610	And I spent about, oh jeez, three years of my life reading Slashdot every day,
688610	691230	looking for denial of information attacks in the news.
691230	693610	And certain trends came out of it.
693610	696250	And clearly, there were legal responses.
696530	701150	And you can consider the anti-telemarketer legislation, for example.
701450	703150	As well as regulatory.
703310	706490	There were moral responses, public relation campaigns,
707040	709870	from the Motion Picture Association of America, for example,
709870	714500	like you'll put our employees out of their jobs if you pirate movies.
717720	721580	And I was particularly intrigued by the use of violence.
721580	724660	Violence is, if people are receiving information they don't want,
724660	728340	violence has been a proven countermeasure in certain instances.
728600	732600	And I was particularly intrigued by the, let's see, Charles Bauer,
732600	736940	Charles Bauer case, where he received one spam too many,
736940	740520	and snapped, and started sending death threats back to the spammers.
740680	742840	And he was arrested for his troubles.
746300	750800	So, I want to take a harder look at, alright, you've got these limited resources,
750800	752440	how do they all interplay?
752440	755120	So, this is you.
755220	758420	And I've modeled it, and it's hard, many of you may not be able to see it,
758420	764840	but those boxes represent your cognitive capability, short-term memory, long-term memory.
765040	768260	And that's you in the red square, talking to your computer.
768260	773340	So, the arrows you see between that, actually, along this boundary,
773340	776740	that's your vision, your hearing, your speech, and your motor.
776740	779300	So, the input-output through your computer,
779300	782180	which also has a limited amount of resources,
782440	785680	CPU, RAM, hard drive space, and IO.
786560	788960	And it communicates, so you're the information consumer,
788960	793180	you're consuming information from information producers.
793180	795920	And you need to pull that information in, say from websites,
795920	798240	over some sort of communication channel.
799980	803020	Those are servers out there providing you the information.
803060	806600	They too have limited resources.
807480	811380	And often there's a human sitting there, you know, the spammer hits the send button.
811380	814440	But they could be things like unattended machines, like sensors.
816300	820760	So, if you take a closer look, then, you can see where these attacks take place.
820800	826570	For example, if you use very small text, like in legal agreements, in EULAs,
827960	831160	you will... that's attack against the vision of the recipient.
832480	835020	Spoofing the browser, you know, some of the phishing attacks
835020	837740	that have taken place occur along that HCI boundary.
837740	841060	And I just found this useful to get a feel for where these things are occurring.
841380	844640	To look at where attacks are taking place.
844640	846900	Maybe where new attacks could take place.
846900	850180	As well as where some defenses could be put up.
850720	852880	So, if you look at defenses, there's a...
852880	855900	the HCI boundary between you and your computer.
855900	859480	There's been a move forward in the notion of usable security.
859480	864260	Like security actually people can... it gives them the information they need.
864760	868200	TCP damping on the communication channel will slow down
868200	872080	even if a certain number of email exceed a given threshold.
872080	874800	They'll slow down the network pace.
874960	879680	And I believe that's actually... there's some penalties in capture the flag on that front.
880660	884640	Or pushing... most of these push the problem back to the attacker.
884640	887260	So you see computational puzzle solving.
887260	890320	Attack requires... if you want to send this email, for example,
890320	894280	requires a small amount of CPU space on the attacker.
895520	897700	And I'm particularly intrigued by Paul Graham's idea
898200	900680	of the Eliza spam responder.
900680	903640	And who's heard of that idea for spam in Eliza?
904740	905800	Okay, good.
905800	911200	The idea is Eliza's early straightforward artificial intelligence program
911200	914000	that was designed to be like a psychologist.
914940	917200	So the idea then is you have a...
918040	920800	listening on a given port or email address.
920800	924300	The email comes in. If they can craft it in such a way
924300	926160	that the spammer buys the response
926160	929300	and people all across the internet do that, we win.
929300	931100	So it's a pretty intriguing idea.
931100	933280	And it shows you, again, denial of information,
933280	934160	how little resources...
935720	940800	the spammer is relying on economies of scale,
940800	942920	10 million email to press of a button.
943240	945560	If you can, you know, 1% of those people
946080	948020	eat up a little bit of time, you've won.
949880	951980	So I thought this was Slashdot.
951980	954380	I love Slashdot. It's like this high of mind
954380	956640	and there's always interesting insights.
957540	960360	So from Slashdot on this subject,
960360	965400	I have a little PHP script that I use whenever I get a phishing email.
965400	968620	The script generates fake credit card numbers and expiration dates
969700	972400	and repeatedly hits the sites...
972400	975620	the phishing sites form dumping in random information.
976780	981120	Any halfway intelligent phisher would record the IP address
981120	984140	and just dump all of mine when he saw they were bogus.
984380	988000	But it makes me feel good that I at least wasted some of his time.
988340	990080	So again, you know, you push that back.
990080	991900	If a lot of people did... and I'm not encouraging...
991900	993760	I don't want to get drug off in shackles.
993920	998880	But it is intriguing, the idea of pushing the problem back to the spammer.
1001560	1003200	So I've looked at this...
1003200	1005400	well, honestly, entirely too much, this problem.
1005420	1008140	But I have... there are several papers on it that are on my website
1008140	1011100	that I'll give you the link at the end and it's on the CD.
1011360	1014160	But if you're interested, you know, on any of the papers,
1014380	1017420	on the website that are like pre-publication,
1017420	1021000	you can send me an email and I'll send you a private copy for review
1021000	1022400	or something like that.
1022400	1024700	And most of the others are available if you're interested in more.
1024700	1027660	I just tried to hit some highlights I thought you'd find entertaining.
1028980	1034300	So given that big problem, I wanted to look at a specific domain.
1034300	1036480	And there are a lot of people working in spam.
1036480	1039120	So I've looked specifically at network security.
1041160	1044480	And in particular, the idea of using information visualization
1045080	1048980	as a way to deal with that problem of denial of information attacks.
1048980	1051640	Because there's this battle and you see it during Capture the Flag
1051640	1055540	of hiding your activities from the human who's monitoring the system
1055540	1060380	or the intrusion detection systems or the defenders.
1060380	1063320	So I was looking at information visualization to do that.
1064280	1068140	So I came up with a tool that's a PVR
1068140	1072220	and it monitors network traffic and will load historical data sets
1072220	1074540	and provides different specially crafted windows
1074980	1077160	to hopefully provide you insight.
1078060	1081140	At Interzone, I had a friend who said
1081140	1083980	they thought they might have to change the rules of Capture the Flag
1083980	1088300	if all of a sudden you could see network activity in useful ways.
1088300	1091900	So that's the idea. I mean, the space we're in, everything's one-upmanship.
1091900	1096080	So I thought, okay, we have these windows and that's useful.
1096080	1098580	Well, how can we attack them?
1099000	1102220	Kind of take it one step forward and look at how can we look at the traffic
1102220	1105360	in ways that are useful, then take it another step and say,
1105360	1109200	okay, knowing how we all think,
1109200	1112000	okay, this is in place, this is cool, how can we attack it?
1112960	1114980	So this is what the tool looked like
1114980	1116380	and this is just a quick snapshot
1116380	1118520	and it's using the Microsoft Virtual Desktop
1118520	1121600	to show a few different panes at the same time.
1121600	1123120	I'll demo this at the end.
1125960	1130020	Okay, so last year at DEF CON, I gave a talk on a related subject
1130020	1133040	and the first question was, how do we attack it?
1133220	1136660	So combined with my interest and your interest,
1136660	1138940	I thought it would be an interesting space to look at.
1139140	1142400	And you'll find in academia, not many...
1142400	1144760	I mean, if you're not in the security field,
1144760	1146640	generally you're not in the security field.
1146640	1150560	So you can make a lot of progress just by looking at their stuff
1150560	1153400	and breaking it for them. It's pretty fun.
1153400	1157080	So that led to the work on malicious visualizations.
1158580	1161840	And then the idea was attacking the human through their computer,
1161840	1166180	through their system that presents information to them in some way.
1166680	1170000	So ideally, you can understand how these attacks occur,
1170000	1173260	then you can design better ways to protect yourself.
1174320	1176700	Ah, I was motivated by Pokemon.
1176880	1179660	Now I know at a normal academic conference,
1179660	1181580	people wouldn't know the answer to this.
1181580	1184240	But why was I motivated about Pokemon
1184240	1188740	as far as attacking people through information technology?
1190200	1192940	Seizures. Okay, very good.
1192940	1198980	In the late 1990s, there was a specific Pokemon episode
1198980	1205460	that had rapid flashing red lights in 20 to 30 hertz.
1205940	1209920	Well, it turns out that people who have photosensitive epilepsy,
1209920	1212740	that's just the right frequency to trigger a seizure.
1213160	1218860	And reports vary, but thousands of people went to the hospital with nausea,
1218860	1223120	and several hundred went to the hospital because of seizures.
1223140	1226140	So it got me thinking about reaching...
1226140	1227660	I know that's a very specific case,
1227660	1230580	but I think the prevalence in the US population
1230580	1233660	is about 2% through the lifetime for epilepsy.
1234020	1236060	So it's non-zero.
1236060	1240360	But it got me thinking about attacking people through computers.
1241660	1243640	But then I wanted to be realistic.
1243920	1247620	So, yeah, I mean, you just want theoretic attacks that never occur.
1247680	1251160	I wanted to look at, well, where can you really insert information
1251160	1254680	into what people see, and how can that little bit of information
1254680	1258960	impact a lot of information, or the display of the information.
1259580	1261380	So I made some assumptions.
1261580	1264700	I'm not dossing the system, I'm just adding a little bit of information,
1264700	1268200	trying to skew the results as much as possible and trick people.
1269260	1272540	As well as, in some cases, I think it's reasonable to assume
1272540	1274820	you could alter the timing of the data,
1274820	1277040	particularly if you had access to the sensor or something,
1277040	1280120	or the network, somewhere in between, you might be able to slow it down.
1280280	1283140	But I really focused on adding a little bit of information.
1283440	1286120	And I did not assume that you'd compromise their computer
1286120	1289140	and you'd have full access to the database to do whatever you want with it.
1289140	1291540	I wanted some places where you could really do it.
1293180	1297720	So, you know, network traffic is where I spent most of my time.
1297900	1299700	Particularly in this area.
1299720	1302800	Because, I mean, clearly you can spoof packets, you can inject things.
1302800	1307400	I mean, you're constrained in some ways by protocols or upstream network devices.
1307400	1311080	But still, the network, you can insert information pretty much at random.
1311280	1313580	As well as some of these other domains.
1313580	1316660	Any place where you can insert some amount of information,
1316660	1318580	then there can be a problem.
1321340	1325600	So, going back to the model, I assumed that anywhere in that space,
1325600	1328960	along the communication channel, or the information producer,
1328960	1331100	could insert a little bit of information.
1331960	1334560	And then the timing attack would occur.
1334580	1340040	Even on the sensor itself, but I was looking more at the network in between.
1340840	1343440	So how do these things manifest themselves?
1343900	1347740	I looked at all the different places where they could manifest themselves,
1347740	1352940	but I've chosen some highlights here I think would be best just to show you the idea.
1353440	1355340	So I focused on your computer.
1355340	1358380	How people can send a little bit of malicious information to your computer
1358380	1365060	so that it will present you a lot of malicious information in a visual display.
1367060	1369580	So what really got me thinking is just some tools,
1369580	1372500	and this is a $10,000 visualization tool.
1372500	1376120	It labels things, only puts 20 labels on the display.
1376120	1381800	So if you hit a threshold above 20 labels, labels start disappearing.
1381800	1386580	So I thought, if you can exceed limits of the program,
1387060	1389640	then you're gaining ground, you're slowing people down,
1389640	1395040	they may miss what you want them to miss, or see what you want them to see.
1395580	1398520	And even better in displaying information,
1398520	1401420	oftentimes labeling algorithms are used,
1401420	1404040	and you can see here that it doesn't take much
1404040	1407600	to start filling up a display with labels.
1408400	1411500	And, you know, it dropped out here, and they're not even sorted in this one.
1411500	1414720	So perhaps just a little bit, you can start hitting the threshold.
1415920	1420860	And even better, I think, is you see auto-scaling algorithms,
1420860	1426480	where this graphic, the left-hand side,
1426480	1429960	shows ports on external computers that are talking,
1429960	1432300	and on the right-hand side are ports on your computer.
1432300	1435240	So it connects the dots between one to the other,
1435240	1436840	what port to what port.
1437420	1439400	And if you look at the little detail,
1440840	1443840	you have a great deal, that was the initial display,
1443840	1448400	it was like 1 to 135, but this tool auto-scaled.
1448400	1451820	So initially, I saw exactly what I wanted to see.
1451820	1456460	I winged one packet to a high port, it auto-scaled it,
1456460	1459460	reduced all that relevant information down to one pixel.
1459580	1461500	So then you have to waste time, grab the mouse,
1462300	1465840	zoom in, zoom out, just by winging one packet high.
1465900	1468160	Now you may think this is just arbitrary,
1468160	1470120	but you see this in real life.
1470120	1476720	This is a very common web log analysis program.
1476840	1480340	So here, and this is from the Netty at Home project,
1480340	1483340	you see a spike of activity,
1483340	1486240	and actually this was a site being slashed out.
1486240	1489640	So yes, it's more akin to the Nile service attack,
1489640	1493020	but it does illustrate that you can impact,
1493020	1495660	I mean, web logs, you can enter information in,
1495660	1497860	I mean, you probably send ASCII art into web logs,
1497860	1501200	if you are so inclined,
1501200	1502900	but that input in the logs,
1502900	1505780	and then you can alter how the information is displayed.
1505800	1509240	So you see that on the day of the slash dotting,
1509240	1511300	it flat-lined everything else.
1511300	1512980	So, you know, everything else is gone.
1515900	1518940	Also, this is the spinning cube of potential doom,
1518940	1520080	which you may have heard about.
1521300	1527220	And the idea is it shows network flows in 3D space.
1528440	1530280	And in the foreground, though,
1530280	1533420	if you look at how information is rounded down,
1533420	1537160	then this is a whole class B network mapped
1537160	1539860	to the 2 to the 16th bits,
1539860	1543600	mapped along about 500 or 800 pixels.
1543860	1547820	And the entire internet is on the green line,
1547820	1550960	so you are mapping 2 to the 32nd, more or less,
1550960	1553700	along the vertical axis,
1553700	1555740	so you are losing a great deal of information.
1556160	1558200	And then the Z axis, blue,
1558200	1560580	they are mapping the target port.
1560660	1562220	And it turns out that an attacker,
1562220	1564320	if you are using this to watch your network,
1564320	1567060	the attacker would be able to operate
1567060	1569300	with tens of thousands of degrees of freedom
1569300	1572080	as far as destination port,
1573140	1575520	destination IP, and source IP,
1575520	1577680	and illuminate only a single pixel.
1578040	1580380	So again, looking at the scaling in place
1580960	1581800	is significant.
1582780	1584720	And of course, just using a little bit,
1584720	1586620	you put something on the screen,
1586620	1589320	it is easy often to put something on top of it.
1590120	1593600	Some types are more susceptible than others.
1594040	1596680	As well as just inserting some random noise
1596680	1598600	or carefully crafted noise.
1599860	1602020	So how do you protect people,
1602020	1603680	how do you protect your users
1603680	1606460	from small amounts of information
1606460	1609240	having a major impact on what they see?
1609240	1612480	Well, the first thing, and there is no cure-all,
1612480	1615720	in systems where there is some degree of authentication,
1615720	1618400	then that is better than no authentication,
1618400	1620640	or limited where you just basically have to click on an email
1620640	1622720	to verify your identity or something.
1625120	1627080	And I think it is not appropriate,
1627080	1628680	for you, I am just telling you,
1628680	1630800	for entertainment purposes, this next one.
1631200	1634420	I am telling the other people this line
1634420	1635940	because they need to do it.
1636180	1638000	That you need to design systems
1638000	1640020	with malicious data in mind.
1640020	1641980	Often times they live in a utopian world
1641980	1644000	in design systems where they just think
1644000	1646080	only happy data will arrive.
1647380	1649900	But to design systems with malicious data,
1649900	1652960	as well as to train users to be alert for them,
1652960	1656100	and you train people not to give away
1656100	1658960	their passwords over the phone or whatever,
1658960	1661580	that you train users to be aware of the weaknesses,
1661580	1664640	as well as to allow them to customize the system.
1666060	1667980	So again, there is more on this.
1668000	1669920	This paper is on your CD,
1669920	1671900	if you are interested in some more detail.
1674640	1675980	And as well on the CD,
1675980	1677720	I have got some other links you can go to
1677720	1679040	for more information.
1682220	1683100	One moment...
1704190	1707430	So this is a tool I released at Black Hat.
1707430	1709790	And the idea is it is a network PVR.
1709910	1711670	And each of these windows,
1711670	1713630	each of these black squares is a thumbnail
1713630	1715550	that shows you your network traffic.
1724500	1727660	So let me go ahead and load a packet capture data set.
1728060	1730120	And this data set is a packet capture
1730120	1731760	from HoneyNet Scan of the Month.
1732000	1733760	And you can see it is loading the packets.
1734420	1736240	And there is 3,300 packets.
1736520	1737620	So this is what I was working on.
1737620	1739200	Remember, I am going back to what I said before.
1739200	1741620	I wanted to build tools that would raise the bar
1741620	1744020	on how visible attacks are
1744020	1746000	to the people watching the networks.
1746140	1747540	Then I wanted to take a further step
1747540	1749640	and look at, well, how could that be subverted?
1749880	1752300	So I will point you toward my Black Hat slides.
1752300	1754020	And I will be posting those in a little while
1754020	1756720	where it goes into more detail on how this works.
1756720	1758920	But I will give you a quick tour.
1758920	1760560	And this is also on your CD.
1762880	1764680	The idea is there are different views
1764680	1766100	that show you your data.
1769620	1770720	Most straightforward.
1770720	1772260	And they all operate in tandem.
1772260	1775360	So what you see in one occurs in another.
1775660	1777300	So if we play it,
1777300	1778780	you start seeing the data,
1778780	1781540	different views are all operating in lockstep.
1781540	1782800	So the most straightforward one
1782800	1784620	is showing you the text in the packets.
1784620	1786100	This is a text view.
1786360	1787680	It will go and show you
1787680	1790580	the hex view
1790580	1794180	as well as a decimal view.
1794660	1795680	But anyway,
1795680	1796960	things like it has
1796960	1799360	the strings command built in.
1799360	1800620	So you can filter
1800620	1804080	just for the text,
1804080	1805160	strings of a given length
1805160	1806420	in the packets.
1811120	1812540	This view shows
1812540	1814500	one packet per line.
1814500	1816280	And you can see
1816280	1819120	it illuminates the pixel on that line
1819120	1822460	if that hex value exists.
1822460	1823180	So for example,
1823180	1825580	in this region here,
1825580	1827280	that's the printable ASCII range.
1827280	1828860	So if I hover over it,
1828860	1832280	you can see that that's a B,
1833600	1834720	a J, and so on.
1834720	1835320	So you can see
1835320	1838580	the characteristics of it.
1838660	1839900	It will also do the frequency
1839900	1841560	of the bytes per packet.
1842700	1844020	And you can set a threshold
1848350	1848770	for that.
1848770	1849950	Anything above a certain threshold
1849950	1850790	will be hot,
1850790	1852290	so we can move the threshold down
1852290	1855290	until we start finding the tipping point.
1859240	1861180	It looks relative to each packet
1861180	1862560	in that case.
1862900	1864700	I don't pad anything.
1868850	1870510	Yeah, this is very straightforward.
1870510	1871690	It's kind of like an initial step.
1871690	1872490	I mean, there's all sorts of
1872490	1874130	entropy algorithms I could use
1874130	1876430	to do all sorts of cool things
1876430	1877730	with this type of view.
1880430	1881210	You can see the bytes occurring
1881210	1882430	in each packet,
1882430	1884730	but changing with a regular consistency
1884730	1886850	so you can look at the slope.
1888290	1891150	So that's the byte frequency view.
1891410	1892750	I think you'll find this one
1892750	1894250	particularly entertaining.
1894250	1896750	This is called a parallel coordinate plot,
1896750	1897970	and essentially you're connecting
1897970	1899930	the dots on these axes.
1900690	1901910	Where I'm going with it
1901910	1903250	is it's connecting the dots
1903250	1907390	between every header field
1907390	1908070	that's possible.
1908070	1908830	That's my goal.
1908830	1910770	I've got 17 fields in it now.
1914330	1917070	So if I go like this,
1917070	1919690	it shows the fields.
1919950	1920610	Keep going.
1922170	1923190	The idea, then,
1923190	1924570	is you can go through one at a time
1925490	1926470	and see each packet
1926470	1927370	and see its values
1927370	1928790	for every header field.
1930250	1931850	Or you can play it.
1933270	1934910	And what you see growing on the right,
1934910	1937410	that's the IP identification field.
1937410	1938530	You can see the distribution
1939730	1940130	of packets.
1941110	1942450	And the idea, then,
1942450	1944210	is you can take 5,000 packets,
1944210	1945090	roll them through this,
1945090	1947190	and at least watch them unfold
1947190	1948930	and get a feel for what happens.
1948930	1950710	So you can see random activity
1950710	1951970	for a given field.
1951970	1953990	You can see sequential activity.
1954090	1956650	You can see things that don't change,
1956650	1957610	things that change a lot,
1957610	1958490	and so on.
1960150	1961450	I'm going for a whole model
1961450	1962370	of interaction here,
1962370	1963150	like a mixing board
1972060	1972760	Let me open this tool.
1972760	1974100	Let me show you one or two more windows
1974100	1976000	and then I'll show you how to attack it.
1976560	1978220	They're using it for capture the flag, too,
1978220	1979080	to show the network,
1979080	1980600	on occasion.
1981840	1983260	So you can have some fun.
1984460	1986360	This is more of a matrix view.
1987960	1989520	It does have some uses
1989520	1991160	other than just looking cool,
1991160	1994100	but we're kind of tight for time
1994100	1996080	and I don't want to blather on about it.
1996880	1998920	But this is one packet per line
1998920	2000220	and it's showing you the bits
2002060	2003840	if the pixel is on,
2003840	2005420	if there's a one on the wire.
2005420	2007380	So you can see different types of packets.
2007660	2008920	And you can see at a glance
2008920	2010520	the length of the packet,
2010520	2012480	as well as I've played around with such things
2012480	2015860	as, well, show me the printable ASCII values in there.
2015880	2016700	So when I do that,
2016700	2019280	it greys out everything that's not printable ASCII.
2019420	2021660	And this is, the blue is printable ASCII.
2021660	2022560	So you can see at a glance
2022560	2025120	what packets, after you've filtered things,
2025120	2026600	contain printable ASCII.
2027260	2030560	I've also played around with the idea of no-ops.
2030560	2036040	I like the idea of disassembling code on the fly.
2036040	2038060	Looking at things as if they are executables
2038060	2040240	and perhaps you as an analyst,
2040240	2043040	if it's color-coded by common opcodes or something,
2043040	2045820	will be able to look at the flow or the packets
2045820	2048220	and say, that looks like an executable
2048220	2049340	going across the wire
2049340	2051220	and it's not supposed to be there.
2051220	2052140	Perhaps you'll see something
2052140	2053760	your intrusion detection systems
2053760	2055900	or anomaly detection systems won't.
2063650	2065530	And the final one,
2066530	2068290	and this is the final zone for networks.
2068870	2070890	It's connecting the dots between any fields.
2070890	2073110	I don't know if you can quite see it in the back,
2073110	2074910	but it's connecting the dots
2074910	2077290	and then pixels fly off
2077290	2079130	and slide off the screen
2079130	2081030	based on what, and this is showing
2081890	2085030	source IP to destination port,
2085030	2086830	TCP port,
2086830	2088390	but as it happens,
2088390	2089750	they fly off the screen.
2089750	2092610	So you can see a variety of activities.
2092950	2093630	And the way it's set up
2093630	2095390	is you can compare anything to anything.
2096690	2097050	You can look at combinations
2097050	2098670	that might be of use to you.
2099250	2101390	And if you have the different windows open,
2101390	2103470	all at the same time, running lockstep,
2103470	2104790	you might be able to find things
2104790	2106950	you wouldn't be able to find using today's tools.
2107270	2108810	So anyway, this is on your CD.
2109430	2110950	I'd encourage you, and I'll give you the link
2110950	2112650	to go to the website
2112650	2114270	where you can download the latest version.
2114270	2116110	I made a little bit of a fix.
2116430	2119130	It crashes on a certain header condition.
2120290	2121610	But I'll post that
2121610	2122970	when I get back from DEF CON.
2123850	2125230	Anyway, going back to the topic.
2126530	2128290	And I thought, how can I attack it?
2133010	2134930	So let's look at some basic attacks.
2135530	2137130	It really doesn't take much
2137130	2139310	to bring down a visualization system
2139310	2140890	if you're so inclined.
2147050	2149770	So I showed you what normal looked like.
2151650	2153570	Something odd happened here.
2159010	2159850	So let's go ahead
2159850	2161510	and see what the attack looked like.
2167050	2169030	Now this is only 203 packets.
2169030	2170590	So if you were displaying information,
2170590	2171870	looking at a data set,
2171870	2174050	watching capture the flag,
2175610	2177210	I'm using random IPs,
2177210	2178530	and we're only at 30,
2178530	2180670	and it's already becoming crowded.
2181650	2184550	And look what's going on on the UDP.
2184550	2185670	This is color-coded,
2185670	2187570	so orange is UDP traffic.
2187690	2189490	You can see that it's filling up
2189490	2190930	the display pretty quickly.
2190930	2193170	With only 180 packets,
2193170	2195470	it's already a windshield wiper effect.
2195470	2196230	Well, as it turns out,
2196230	2198290	you don't need to hit every single port.
2200590	2201790	You can see how it's scaled.
2201970	2204950	So I only need to hit every 60th port
2205570	2207510	with a packet to draw the line
2207510	2209370	and create that solid effect.
2210950	2212430	So let's look at another example
2212430	2214210	that totally melts it down.
2243940	2246140	So again, just a small amount of information
2246140	2248660	can generate a lot of noise for the human.
2254630	2257250	So this is 1,300 packets.
2257930	2259990	This is pretty much a nuclear meltdown.
2260270	2261790	Now you can change the speed as well,
2261790	2263490	so I'll change the speed to max.
2264470	2267250	And look what's happened on the IP address space.
2270010	2271990	But you can also see what I haven't messed with,
2271990	2273450	so perhaps something is constant
2273450	2275750	and maybe they have a consistent time to live
2275750	2277710	or something that you can grab ahold of
2277710	2279850	and create a filter to counter this.
2280490	2282050	So again, I tried to create the tool
2282050	2283570	and then think about how it would be attacked
2283570	2285610	and then how we can defend and it never ends,
2285610	2287690	but I think this is worth looking at.
2287750	2289430	So that's a meltdown.
2290510	2292310	There are other interesting uses.
2292530	2294830	Who saw the talk at Black Hat?
2295670	2297230	Okay, if you saw the talk at Black Hat,
2297230	2298130	don't give this away.
2298130	2299670	But there are other interesting uses.
2308020	2309840	So this is 600 packets.
2313240	2314480	And if you look at it, say,
2314480	2317140	in the parallel coordinate plot display,
2317140	2318780	you can get the 600 packets.
2318780	2321280	You can look and see a quick overview of what happened.
2325150	2325770	Okay.
2326190	2328070	And again, you can run through them.
2328850	2333030	Well, it really just looks like a lot of source ports were in use,
2333030	2335730	but other than that, not the same IPs were used.
2337930	2340310	So let's play it again, though, with a different view.
2344840	2347760	So if we look at the frequency of the packets, then,
2347760	2349820	you notice odd clouds of packets,
2352460	2354140	of groupings of bytes.
2356860	2358660	Then if we look at it as a rainfall,
2358660	2361960	remember, this is one packet per line.
2362280	2363380	And the way this is,
2363380	2365840	it takes each byte on the wire,
2365840	2366900	maps it to a pixel,
2366900	2368600	is a grayscale.
2368960	2371200	So you can see the rainfall effect
2371200	2374540	of the bytes on the wire is grayscale.
2388670	2390810	It's have I or could you?
2392910	2394890	Right now, the idea is that
2394890	2397230	there's a degree of flexibility built in.
2397230	2400790	The question was, how much can I change the mapping of colors?
2408320	2409980	Well, the extent as it stands,
2409980	2412020	there's no technical reason you couldn't do that.
2412020	2415400	As far as what it's coded, I have filters built in.
2415400	2416600	Right now, they're straightforward.
2416600	2418420	I want to go to greater complexity,
2418420	2423280	but they'll filter certain streams of TCP, UDP, ICMP.
2423280	2425800	And you can change the colors by clicking on there,
2425800	2427140	and that'll change it.
2427140	2429940	But the degree of customizability isn't there yet.
2430480	2432100	But it's certain there's no technical reason
2432100	2433200	that couldn't occur.
2439900	2442100	So just to wrap up,
2442100	2444580	again, on your CD, you've got the talk slides.
2444860	2447780	The roommate tool itself is on the CD.
2448660	2451800	The malicious visualization paper is on the CD.
2451920	2453880	And there's a hacker convention article
2453880	2456060	I want to point you toward.
2456600	2458480	Because I know some of you have difficulty
2459540	2462220	explaining why it's of value to come here.
2462600	2463820	Or is it just me?
2464620	2465460	Right?
2466600	2469640	So I was able to get into the communications of the ACM,
2469640	2472140	which is like the Professional Computer Society's
2472140	2474760	lead journal on why computer sciences
2474760	2476740	should attend hacker conventions.
2476960	2480820	So hopefully, we can change some perceptions out there.
2480820	2482500	And you can wave this around
2482500	2485680	in front of your husband, wife, or boss.
2485940	2487380	Or parent.
2490100	2491760	And that's on the CD as well.
2495860	2498180	I'm looking for anyone who could give me feedback
2498180	2499640	on the tool.
2500580	2502220	It's at roommate.org.
2502220	2505200	Again, it's there. It's on your CD as well.
2505500	2507640	I'm in school, and I'm trying to graduate.
2507640	2509640	So I need feedback to make it better.
2509920	2512900	And right now, I've got a two-page, five-minute survey.
2512940	2516440	If anybody would be kind and see Julian,
2516440	2519300	I'd be permanently indebted to you
2519300	2520940	if you could take five minutes of your time
2520940	2522320	and fill that out. It would help.
2522740	2524340	And basically, if you're an Ethereal user
2525860	2526940	I'd love to see some quick questions on
2526940	2528760	how can people mess with your minds
2528760	2530660	if you are using that tool.
2530660	2531660	Or how they happen.
2535420	2536840	Lots of people to thank.
2536840	2538360	I've been iterating through this
2538360	2540500	in small groups.
2540560	2541740	And I've gotten a lot of feedback
2541740	2542720	from a lot of people.
2542720	2544480	So too many to thank at one time.
2545840	2547760	Finally, I wanted to end with...
2547760	2549400	I've had a good experience at Georgia Tech.
2549400	2550880	A very positive experience.
2551060	2552100	And I've enjoyed the...
2552100	2553820	They've got an undergrad and grad
2553820	2556440	or master's and PhD programs in InfoSec.
2556460	2557720	So if you're interested in that
2557720	2558620	you can send me an email
2558620	2560460	and I'd be happy to answer your questions
2560460	2562020	or point you to someone who could.
2562200	2564580	As well as they're looking to partner with industry.
2564680	2566280	Again, this is part of my business case
2566280	2567320	for coming out here.
2568660	2570760	They're looking to partner with industry and government.
2570760	2571840	So if you're looking to kind of like
2571840	2574160	outsourced R&D,
2574160	2575920	they're very much up for that.
2576000	2578040	And the website or I could point you
2578040	2579100	to more information.
2583640	2584520	Yes.
2590030	2593230	The website is outdated as of now.
2593250	2594810	So I wanted to release it at Black Hat.
2594810	2596770	So when I get back, the version on the CD
2596770	2598550	is like 1.7 something.
2598550	2600750	And I have 1.8 something that I will release
2600750	2602130	as soon as I get back.
2602130	2603250	It'll function.
2603510	2605470	It's IP header length.
2605710	2608330	If it's not 5, it'll crash.
2609350	2610790	Which is 5 is the normal value.
2610790	2612490	But if you get other things,
2612490	2613990	then it'll crash.
2615490	2616410	This is a sample file.
2616410	2618670	And a key point is it doesn't load PCAP natively.
2618670	2619850	So I have a little conversion tool
2619850	2621970	that converts it to the file format.
2621970	2623770	So the tool's on the CD.
2623770	2624990	It runs on XP.
2625310	2627710	And I have a sample data file on there
2627710	2629690	for you to take a look at and play with.
2634280	2635080	Yes.
2639780	2640800	I have not.
2640800	2642440	But I don't see any reason why not.
2642440	2644880	I mean, I want to show like the picture
2644880	2646600	of what it looked like or whatever
2646600	2648440	with the PCAP file
2648440	2650660	and the file format for my tool.
2651580	2653120	I mean, they're not sensitive or anything.
2653120	2654840	So yeah, absolutely, I want to share them.
2655260	2656120	But I haven't.
2656200	2657880	It's one of those things like the week I get back,
2657880	2658920	I'll be working that.
2664390	2666550	Well, I'd like to thank you all for coming.
2666550	2667930	Julian's in the yellow shirt.
2668210	2670850	If any of you could fill out the survey,
2670850	2672110	if you've worked with Ethereal
2672110	2673910	and always wondered how you can mess with people
2673910	2675870	through it or work with Snort,
2675870	2677050	I would appreciate it.
2677050	2678810	And if anybody's interested, I'll be outside.
2678810	2679150	Thank you.