[00:10.640 --> 00:13.220]  First, I'd like to thank you all for coming. I'm Greg Conti.
[00:13.220 --> 00:17.840]  And I'd like to talk to you about the idea of denial of information attacks.
[00:17.860 --> 00:23.080]  And in one sentence, the idea is attacking humans through the computer system.
[00:23.080 --> 00:26.880]  Not attacking the computer system, but attacking humans through their computer system,
[00:26.880 --> 00:28.860]  and how we can counteract that.
[00:29.200 --> 00:31.080]  And here's one example.
[00:31.680 --> 00:32.860]  Large shark.
[00:33.840 --> 00:36.860]  Currently I'm at Georgia Tech, but I'm also in the Army.
[00:36.860 --> 00:41.280]  And I'm here as a free citizen, and not as a representative of the government.
[00:47.780 --> 00:53.540]  So, more specifically, denial of information attacks attack you, the human,
[00:53.540 --> 00:57.540]  and try and consume the limited resources that you have.
[00:57.540 --> 01:01.240]  If you contrast what you can handle versus what your computer can handle,
[01:01.240 --> 01:07.280]  in certain categories, you'll fall over far faster than your box will.
[01:07.280 --> 01:11.400]  So, if it slows you down or alters your decision making,
[01:11.400 --> 01:15.760]  then that's a denial of information attack occurring.
[01:16.420 --> 01:19.220]  So, I think the best example is spam.
[01:19.480 --> 01:23.040]  And I won't ask you, but just consider how many of you have deleted email
[01:23.580 --> 01:26.800]  based on, say, a subject line that you shouldn't have.
[01:26.860 --> 01:30.360]  Or you've opened email that you shouldn't have.
[01:30.860 --> 01:33.580]  And I know, when I talked to my wife about this,
[01:33.580 --> 01:36.320]  we thought it was probably... you guys are at the leading edge.
[01:36.320 --> 01:42.160]  So, when spam first started coming out, you probably figured that out pretty quickly.
[01:42.240 --> 01:44.620]  But who's received, and I'll ask for a show of hands,
[01:44.620 --> 01:47.720]  who has received a frantic email from a family member
[01:47.720 --> 01:50.840]  about some virus email that they received?
[01:50.840 --> 01:55.240]  Or some, you know, if your local tech support for you or your family or friends,
[01:55.240 --> 01:57.320]  who's received emails like that?
[01:57.880 --> 02:00.500]  Pretty much, you know, almost the whole room.
[02:00.560 --> 02:03.100]  So, I think spam is an example.
[02:03.100 --> 02:05.540]  I mean, consider how much time have you wasted on spam?
[02:05.540 --> 02:08.220]  And these are just examples.
[02:08.360 --> 02:11.160]  So, what I'm trying to do to this problem is look at the bigger picture
[02:11.160 --> 02:13.200]  and look at the structure around it.
[02:13.200 --> 02:15.700]  And then, how people are defending it and defenses
[02:15.700 --> 02:20.040]  to just add some structure to the domain.
[02:21.120 --> 02:22.780]  I'll take one step back.
[02:22.960 --> 02:25.760]  And there's some interesting statistics that just recently came out
[02:25.760 --> 02:27.920]  of the University of Indiana.
[02:27.920 --> 02:29.660]  I'm sorry, Indiana University.
[02:29.960 --> 02:32.120]  About phishing.
[02:32.120 --> 02:38.280]  And what they did is they went to social networking sites like Orkut
[02:38.280 --> 02:41.040]  and found out who was friends with who.
[02:41.040 --> 02:46.280]  Then they used that information to send out a phishing email to college students
[02:46.280 --> 02:48.700]  and they sent them out to 500 people.
[02:49.320 --> 02:51.720]  But with the return address of a friend.
[02:52.260 --> 02:55.140]  The emails were just like, hey, check this site out.
[02:55.140 --> 02:57.920]  It gave a generic link off campus.
[02:57.920 --> 03:04.600]  That link prompted them for their credentials or user ID and password from college.
[03:05.040 --> 03:07.900]  And they were 72% successful.
[03:08.860 --> 03:10.940]  And the students were very mad.
[03:10.940 --> 03:14.960]  But there's some interesting statistics if you take a look at the gender.
[03:15.420 --> 03:21.200]  If a male sent an email to another male, only 53% of them fell for it.
[03:22.340 --> 03:24.520]  You can see where we're going here.
[03:26.940 --> 03:32.280]  If a female sent an email to a male, it went up from 53% to 68%.
[03:34.560 --> 03:38.080]  Female to female, 76%.
[03:39.280 --> 03:41.720]  And then they live in a different world than I do.
[03:41.720 --> 03:45.640]  But male to female, 78% of them fell for it.
[03:45.640 --> 03:47.620]  So on average it was 72%.
[03:47.620 --> 03:49.980]  So male to female was the worst category.
[03:49.980 --> 03:53.580]  But I thought the real insight there was using that social networking information.
[03:54.980 --> 03:58.560]  So I don't want you to confuse this with denial of service attacks.
[03:58.700 --> 04:04.940]  This is a recent innovation from a major operating system manufacturer.
[04:05.640 --> 04:09.440]  They've evolved from the blue screen of death to the red screen of death.
[04:09.920 --> 04:12.960]  This is from Longhorn. I guess it's Vista these days.
[04:12.960 --> 04:14.960]  Anyway, back to the...
[04:14.960 --> 04:24.460]  It's not what you consider denial of service where you're consuming system resources, RAM, hard drive space, processing power.
[04:24.460 --> 04:28.220]  You're consuming the human's resources is the key difference.
[04:29.340 --> 04:32.620]  And it's compounded by the idea of information growth.
[04:32.620 --> 04:37.220]  If you look, information is being generated at a prodigious rate.
[04:37.740 --> 04:40.000]  This study is very, very good.
[04:40.000 --> 04:45.020]  And I'd also like to mention I personally hate bullet slides, so I have very, very few in here.
[04:45.020 --> 04:53.360]  But on the slides on your disk, on the Con CD, I've included an extended version that has more information with links and things.
[04:53.360 --> 04:55.660]  Anyway, I just wanted to highlight one of these.
[04:55.680 --> 05:02.280]  This is a study coming out of Berkeley from 2003 entitled How Much Information?
[05:02.460 --> 05:07.800]  It's a very good study, except it's like 150 pages, which again is information overload.
[05:07.800 --> 05:14.160]  But the surface web at that time, they estimated, was about 170 terabytes.
[05:14.160 --> 05:19.400]  Or 17 times the U.S. Library of Congress print collection.
[05:19.440 --> 05:23.120]  So a tremendous amount of information in 2003.
[05:25.420 --> 05:28.960]  And that's just the surface web, not the dynamically generated web.
[05:30.000 --> 05:41.060]  So we just talked about spam attacking primarily your cognitive decision making.
[05:41.320 --> 05:44.520]  Well, there's other attacks that attack your perception.
[05:44.940 --> 05:50.780]  I had this on a web page. How much work can you get done with that sitting on the web page blinking?
[05:52.020 --> 05:57.720]  So that was on a real estate web page. I had to slide it off to the side to be able to get any work done.
[05:57.720 --> 06:03.200]  And it just makes me mad. What were they thinking? Who's going to go out and buy coffee based on that?
[06:04.820 --> 06:09.340]  So we talked about cognitive resources and perceptual resources.
[06:09.340 --> 06:10.960]  Then we have motor resources.
[06:11.360 --> 06:14.720]  And the idea then, if you go back to the denial of information attack,
[06:14.720 --> 06:18.400]  if you're slowing the human down, you're beginning to win.
[06:18.400 --> 06:21.500]  If you're sending them in the wrong direction, you're beginning to win.
[06:21.580 --> 06:23.880]  Motor resource attacks often slow you down.
[06:23.880 --> 06:29.180]  You have to stop what you're doing, grab the mouse, click the pop-up, get back to what you were doing.
[06:31.520 --> 06:42.100]  And I thought this example from hack-proofing your network, again, gives an insight into the idea of the decision making by the human versus the decision making by the computer.
[06:42.100 --> 06:43.940]  And I'll read it for those in the back.
[06:44.480 --> 06:52.740]  In the end, all the power of the intrusion detection system is ultimately controlled by a single judgment call on whether or not to take action.
[06:52.740 --> 06:58.140]  So if you can get into that decision making cycle, you can affect major outcomes.
[07:00.670 --> 07:04.110]  I thought it was also relevant to look at information flows.
[07:04.150 --> 07:12.330]  So if you consider signal being what you're looking for, if you're out on the web, for example, or in any information space, you're looking for certain information.
[07:12.470 --> 07:13.930]  That would be the signal.
[07:14.270 --> 07:17.310]  Noise would be everything but what you're looking for.
[07:17.550 --> 07:23.870]  So the best case would be signal is very high, and noise would be very low, so that's the best situation.
[07:23.870 --> 07:27.130]  So what you're trying to do is increase your signal-to-noise ratio.
[07:28.270 --> 07:34.410]  If you consider a small amount of signal and a small amount of noise, it's still manageable for a human.
[07:34.410 --> 07:40.070]  So you can look at this list of 10 things, and even if it's 50-50, you can still pick out what you're looking for.
[07:40.110 --> 07:42.430]  Some Google results are like that.
[07:44.990 --> 07:48.210]  But it starts getting worse when you have low signal-to-noise.
[07:48.210 --> 07:56.210]  And particularly, you have a lot of noise, a little bit of signal, what you're looking for, that's the domain of the denial-of-information attack.
[07:57.910 --> 08:00.250]  And then you start getting into denial-of-service.
[08:00.250 --> 08:05.950]  If you have lots and lots of information, then you start overcoming your computer's resources.
[08:05.950 --> 08:08.250]  So that's more the denial-of-service attack.
[08:09.530 --> 08:12.970]  So if you consider this webpage, and this is weather.com.
[08:12.970 --> 08:17.310]  I started going to specific news sites, and then I thought I'd get in trouble for whatever one I chose.
[08:17.310 --> 08:18.990]  So I thought weather would be safe.
[08:19.150 --> 08:25.610]  So if you went to this website to get something done, and I actually tried to do this to find out Las Vegas weather.
[08:27.370 --> 08:29.670]  Yeah, I mean hot and dry, what was I thinking?
[08:31.570 --> 08:37.730]  Anyway, say you came to this site, and putting your signal-to-noise ratio goggles on,
[08:37.730 --> 08:42.570]  and all you wanted was the United States weather and some basic weather information.
[08:44.030 --> 08:46.030]  All of that is noise.
[08:46.030 --> 08:48.370]  So just a tremendous amount.
[08:48.370 --> 08:51.390]  And I know there's some plug-ins for various browsers that help.
[08:51.470 --> 08:56.170]  But the idea, if you can just get down to the signal, it's a tremendously better experience.
[08:57.630 --> 09:01.230]  So besides the idea of the signal-to-noise ratio,
[09:01.230 --> 09:06.850]  and the keynote speaker at Black Hat was Gilman Louie, who also mentioned this.
[09:07.170 --> 09:15.250]  He is the CEO of In-Q-Tel, which I think is a CIA startup funding venture capital company.
[09:15.250 --> 09:16.250]  I think it's pretty interesting.
[09:17.850 --> 09:19.850]  But anyway, he mentioned the OODA loop.
[09:19.910 --> 09:24.610]  And the OODA loop was Observe, Orient, Decide, and Act.
[09:24.610 --> 09:28.150]  And it was developed by Colonel John Boyd, who was in the Air Force.
[09:28.150 --> 09:33.030]  And this came out in the 60s, about how fighter pilots make decisions.
[09:33.170 --> 09:38.390]  And if you could make your decisions faster than the other person, you could go through this cycle, then you win.
[09:38.390 --> 09:44.510]  So consider, if you're in a certain situation, you're even looking at a webpage or any, looking at logs,
[09:45.130 --> 09:49.330]  you have to observe the data, or even your email is probably the best example.
[09:49.450 --> 09:55.830]  You have to observe your email, and after you observe it and orient yourself to it,
[09:55.830 --> 09:57.930]  then you have to decide, what do I do?
[09:58.330 --> 10:03.990]  And if it's a puzzling subject line, you spend time, you're wasting time, you're slowing down this loop.
[10:04.690 --> 10:09.770]  And then after you do it, you have to act, and typically action requires some physical response,
[10:09.770 --> 10:11.910]  which is a motor response, which will slow it down.
[10:11.910 --> 10:20.490]  So if you're slowing your opponent's OODA loop down, again, you're conducting a successful attack.
[10:20.490 --> 10:25.050]  So you can have people go through cycles unnecessarily, or you can slow it down.
[10:27.470 --> 10:33.310]  So, with that in mind, Observe, Orient, Decide, and Act, let's look at the webpage again.
[10:34.470 --> 10:41.990]  And this time, if your task was to just find out your local weather, which isn't available,
[10:41.990 --> 10:46.870]  and it took me a while, so you observe this, and orient yourself to it,
[10:46.870 --> 10:51.390]  and find out where do you type it in, where do you get your local weather.
[10:52.370 --> 10:54.950]  So think how long it would take.
[10:55.310 --> 11:00.030]  Well, it turns out, it's there. Everything else is noise for the task at hand.
[11:00.030 --> 11:02.510]  So you've slowed the person down as they go through that.
[11:02.510 --> 11:06.810]  And granted, they've got business reasons for doing so, they want to show you ads.
[11:08.650 --> 11:12.110]  Some of the news websites are the worst offenders of all.
[11:13.730 --> 11:18.650]  Okay, so moving forward, let's look at then, you've seen some of these examples, big examples,
[11:18.650 --> 11:22.050]  let's look at how people are defending against these type of attacks.
[11:24.230 --> 11:28.610]  And I spent about, oh jeez, three years of my life reading Slashdot every day,
[11:28.610 --> 11:31.230]  looking for denial of information attacks in the news.
[11:31.230 --> 11:33.610]  And certain trends came out of it.
[11:33.610 --> 11:36.250]  And clearly, there were legal responses.
[11:36.530 --> 11:41.150]  And you can consider the anti-telemarketer legislation, for example.
[11:41.450 --> 11:43.150]  As well as regulatory.
[11:43.310 --> 11:46.490]  There were moral responses, public relation campaigns,
[11:47.040 --> 11:49.870]  from the Motion Picture Association of America, for example,
[11:49.870 --> 11:54.500]  like you'll put our employees out of their jobs if you pirate movies.
[11:57.720 --> 12:01.580]  And I was particularly intrigued by the use of violence.
[12:01.580 --> 12:04.660]  Violence is, if people are receiving information they don't want,
[12:04.660 --> 12:08.340]  violence has been a proven countermeasure in certain instances.
[12:08.600 --> 12:12.600]  And I was particularly intrigued by the, let's see, Charles Bauer,
[12:12.600 --> 12:16.940]  Charles Bauer case, where he received one spam too many,
[12:16.940 --> 12:20.520]  and snapped, and started sending death threats back to the spammers.
[12:20.680 --> 12:22.840]  And he was arrested for his troubles.
[12:26.300 --> 12:30.800]  So, I want to take a harder look at, alright, you've got these limited resources,
[12:30.800 --> 12:32.440]  how do they all interplay?
[12:32.440 --> 12:35.120]  So, this is you.
[12:35.220 --> 12:38.420]  And I've modeled it, and it's hard, many of you may not be able to see it,
[12:38.420 --> 12:44.840]  but those boxes represent your cognitive capability, short-term memory, long-term memory.
[12:45.040 --> 12:48.260]  And that's you in the red square, talking to your computer.
[12:48.260 --> 12:53.340]  So, the arrows you see between that, actually, along this boundary,
[12:53.340 --> 12:56.740]  that's your vision, your hearing, your speech, and your motor.
[12:56.740 --> 12:59.300]  So, the input-output through your computer,
[12:59.300 --> 13:02.180]  which also has a limited amount of resources,
[13:02.440 --> 13:05.680]  CPU, RAM, hard drive space, and IO.
[13:06.560 --> 13:08.960]  And it communicates, so you're the information consumer,
[13:08.960 --> 13:13.180]  you're consuming information from information producers.
[13:13.180 --> 13:15.920]  And you need to pull that information in, say from websites,
[13:15.920 --> 13:18.240]  over some sort of communication channel.
[13:19.980 --> 13:23.020]  Those are servers out there providing you the information.
[13:23.060 --> 13:26.600]  They too have limited resources.
[13:27.480 --> 13:31.380]  And often there's a human sitting there, you know, the spammer hits the send button.
[13:31.380 --> 13:34.440]  But they could be things like unattended machines, like sensors.
[13:36.300 --> 13:40.760]  So, if you take a closer look, then, you can see where these attacks take place.
[13:40.800 --> 13:46.570]  For example, if you use very small text, like in legal agreements, in EULAs,
[13:47.960 --> 13:51.160]  you will... that's attack against the vision of the recipient.
[13:52.480 --> 13:55.020]  Spoofing the browser, you know, some of the phishing attacks
[13:55.020 --> 13:57.740]  that have taken place occur along that HCI boundary.
[13:57.740 --> 14:01.060]  And I just found this useful to get a feel for where these things are occurring.
[14:01.380 --> 14:04.640]  To look at where attacks are taking place.
[14:04.640 --> 14:06.900]  Maybe where new attacks could take place.
[14:06.900 --> 14:10.180]  As well as where some defenses could be put up.
[14:10.720 --> 14:12.880]  So, if you look at defenses, there's a...
[14:12.880 --> 14:15.900]  the HCI boundary between you and your computer.
[14:15.900 --> 14:19.480]  There's been a move forward in the notion of usable security.
[14:19.480 --> 14:24.260]  Like security actually people can... it gives them the information they need.
[14:24.760 --> 14:28.200]  TCP damping on the communication channel will slow down
[14:28.200 --> 14:32.080]  even if a certain number of email exceed a given threshold.
[14:32.080 --> 14:34.800]  They'll slow down the network pace.
[14:34.960 --> 14:39.680]  And I believe that's actually... there's some penalties in capture the flag on that front.
[14:40.660 --> 14:44.640]  Or pushing... most of these push the problem back to the attacker.
[14:44.640 --> 14:47.260]  So you see computational puzzle solving.
[14:47.260 --> 14:50.320]  Attack requires... if you want to send this email, for example,
[14:50.320 --> 14:54.280]  requires a small amount of CPU space on the attacker.
[14:55.520 --> 14:57.700]  And I'm particularly intrigued by Paul Graham's idea
[14:58.200 --> 15:00.680]  of the Eliza spam responder.
[15:00.680 --> 15:03.640]  And who's heard of that idea for spam in Eliza?
[15:04.740 --> 15:05.800]  Okay, good.
[15:05.800 --> 15:11.200]  The idea is Eliza's early straightforward artificial intelligence program
[15:11.200 --> 15:14.000]  that was designed to be like a psychologist.
[15:14.940 --> 15:17.200]  So the idea then is you have a...
[15:18.040 --> 15:20.800]  listening on a given port or email address.
[15:20.800 --> 15:24.300]  The email comes in. If they can craft it in such a way
[15:24.300 --> 15:26.160]  that the spammer buys the response
[15:26.160 --> 15:29.300]  and people all across the internet do that, we win.
[15:29.300 --> 15:31.100]  So it's a pretty intriguing idea.
[15:31.100 --> 15:33.280]  And it shows you, again, denial of information,
[15:33.280 --> 15:34.160]  how little resources...
[15:35.720 --> 15:40.800]  the spammer is relying on economies of scale,
[15:40.800 --> 15:42.920]  10 million email to press of a button.
[15:43.240 --> 15:45.560]  If you can, you know, 1% of those people
[15:46.080 --> 15:48.020]  eat up a little bit of time, you've won.
[15:49.880 --> 15:51.980]  So I thought this was Slashdot.
[15:51.980 --> 15:54.380]  I love Slashdot. It's like this high of mind
[15:54.380 --> 15:56.640]  and there's always interesting insights.
[15:57.540 --> 16:00.360]  So from Slashdot on this subject,
[16:00.360 --> 16:05.400]  I have a little PHP script that I use whenever I get a phishing email.
[16:05.400 --> 16:08.620]  The script generates fake credit card numbers and expiration dates
[16:09.700 --> 16:12.400]  and repeatedly hits the sites...
[16:12.400 --> 16:15.620]  the phishing sites form dumping in random information.
[16:16.780 --> 16:21.120]  Any halfway intelligent phisher would record the IP address
[16:21.120 --> 16:24.140]  and just dump all of mine when he saw they were bogus.
[16:24.380 --> 16:28.000]  But it makes me feel good that I at least wasted some of his time.
[16:28.340 --> 16:30.080]  So again, you know, you push that back.
[16:30.080 --> 16:31.900]  If a lot of people did... and I'm not encouraging...
[16:31.900 --> 16:33.760]  I don't want to get drug off in shackles.
[16:33.920 --> 16:38.880]  But it is intriguing, the idea of pushing the problem back to the spammer.
[16:41.560 --> 16:43.200]  So I've looked at this...
[16:43.200 --> 16:45.400]  well, honestly, entirely too much, this problem.
[16:45.420 --> 16:48.140]  But I have... there are several papers on it that are on my website
[16:48.140 --> 16:51.100]  that I'll give you the link at the end and it's on the CD.
[16:51.360 --> 16:54.160]  But if you're interested, you know, on any of the papers,
[16:54.380 --> 16:57.420]  on the website that are like pre-publication,
[16:57.420 --> 17:01.000]  you can send me an email and I'll send you a private copy for review
[17:01.000 --> 17:02.400]  or something like that.
[17:02.400 --> 17:04.700]  And most of the others are available if you're interested in more.
[17:04.700 --> 17:07.660]  I just tried to hit some highlights I thought you'd find entertaining.
[17:08.980 --> 17:14.300]  So given that big problem, I wanted to look at a specific domain.
[17:14.300 --> 17:16.480]  And there are a lot of people working in spam.
[17:16.480 --> 17:19.120]  So I've looked specifically at network security.
[17:21.160 --> 17:24.480]  And in particular, the idea of using information visualization
[17:25.080 --> 17:28.980]  as a way to deal with that problem of denial of information attacks.
[17:28.980 --> 17:31.640]  Because there's this battle and you see it during Capture the Flag
[17:31.640 --> 17:35.540]  of hiding your activities from the human who's monitoring the system
[17:35.540 --> 17:40.380]  or the intrusion detection systems or the defenders.
[17:40.380 --> 17:43.320]  So I was looking at information visualization to do that.
[17:44.280 --> 17:48.140]  So I came up with a tool that's a PVR
[17:48.140 --> 17:52.220]  and it monitors network traffic and will load historical data sets
[17:52.220 --> 17:54.540]  and provides different specially crafted windows
[17:54.980 --> 17:57.160]  to hopefully provide you insight.
[17:58.060 --> 18:01.140]  At Interzone, I had a friend who said
[18:01.140 --> 18:03.980]  they thought they might have to change the rules of Capture the Flag
[18:03.980 --> 18:08.300]  if all of a sudden you could see network activity in useful ways.
[18:08.300 --> 18:11.900]  So that's the idea. I mean, the space we're in, everything's one-upmanship.
[18:11.900 --> 18:16.080]  So I thought, okay, we have these windows and that's useful.
[18:16.080 --> 18:18.580]  Well, how can we attack them?
[18:19.000 --> 18:22.220]  Kind of take it one step forward and look at how can we look at the traffic
[18:22.220 --> 18:25.360]  in ways that are useful, then take it another step and say,
[18:25.360 --> 18:29.200]  okay, knowing how we all think,
[18:29.200 --> 18:32.000]  okay, this is in place, this is cool, how can we attack it?
[18:32.960 --> 18:34.980]  So this is what the tool looked like
[18:34.980 --> 18:36.380]  and this is just a quick snapshot
[18:36.380 --> 18:38.520]  and it's using the Microsoft Virtual Desktop
[18:38.520 --> 18:41.600]  to show a few different panes at the same time.
[18:41.600 --> 18:43.120]  I'll demo this at the end.
[18:45.960 --> 18:50.020]  Okay, so last year at DEF CON, I gave a talk on a related subject
[18:50.020 --> 18:53.040]  and the first question was, how do we attack it?
[18:53.220 --> 18:56.660]  So combined with my interest and your interest,
[18:56.660 --> 18:58.940]  I thought it would be an interesting space to look at.
[18:59.140 --> 19:02.400]  And you'll find in academia, not many...
[19:02.400 --> 19:04.760]  I mean, if you're not in the security field,
[19:04.760 --> 19:06.640]  generally you're not in the security field.
[19:06.640 --> 19:10.560]  So you can make a lot of progress just by looking at their stuff
[19:10.560 --> 19:13.400]  and breaking it for them. It's pretty fun.
[19:13.400 --> 19:17.080]  So that led to the work on malicious visualizations.
[19:18.580 --> 19:21.840]  And then the idea was attacking the human through their computer,
[19:21.840 --> 19:26.180]  through their system that presents information to them in some way.
[19:26.680 --> 19:30.000]  So ideally, you can understand how these attacks occur,
[19:30.000 --> 19:33.260]  then you can design better ways to protect yourself.
[19:34.320 --> 19:36.700]  Ah, I was motivated by Pokemon.
[19:36.880 --> 19:39.660]  Now I know at a normal academic conference,
[19:39.660 --> 19:41.580]  people wouldn't know the answer to this.
[19:41.580 --> 19:44.240]  But why was I motivated about Pokemon
[19:44.240 --> 19:48.740]  as far as attacking people through information technology?
[19:50.200 --> 19:52.940]  Seizures. Okay, very good.
[19:52.940 --> 19:58.980]  In the late 1990s, there was a specific Pokemon episode
[19:58.980 --> 20:05.460]  that had rapid flashing red lights in 20 to 30 hertz.
[20:05.940 --> 20:09.920]  Well, it turns out that people who have photosensitive epilepsy,
[20:09.920 --> 20:12.740]  that's just the right frequency to trigger a seizure.
[20:13.160 --> 20:18.860]  And reports vary, but thousands of people went to the hospital with nausea,
[20:18.860 --> 20:23.120]  and several hundred went to the hospital because of seizures.
[20:23.140 --> 20:26.140]  So it got me thinking about reaching...
[20:26.140 --> 20:27.660]  I know that's a very specific case,
[20:27.660 --> 20:30.580]  but I think the prevalence in the US population
[20:30.580 --> 20:33.660]  is about 2% through the lifetime for epilepsy.
[20:34.020 --> 20:36.060]  So it's non-zero.
[20:36.060 --> 20:40.360]  But it got me thinking about attacking people through computers.
[20:41.660 --> 20:43.640]  But then I wanted to be realistic.
[20:43.920 --> 20:47.620]  So, yeah, I mean, you just want theoretic attacks that never occur.
[20:47.680 --> 20:51.160]  I wanted to look at, well, where can you really insert information
[20:51.160 --> 20:54.680]  into what people see, and how can that little bit of information
[20:54.680 --> 20:58.960]  impact a lot of information, or the display of the information.
[20:59.580 --> 21:01.380]  So I made some assumptions.
[21:01.580 --> 21:04.700]  I'm not dossing the system, I'm just adding a little bit of information,
[21:04.700 --> 21:08.200]  trying to skew the results as much as possible and trick people.
[21:09.260 --> 21:12.540]  As well as, in some cases, I think it's reasonable to assume
[21:12.540 --> 21:14.820]  you could alter the timing of the data,
[21:14.820 --> 21:17.040]  particularly if you had access to the sensor or something,
[21:17.040 --> 21:20.120]  or the network, somewhere in between, you might be able to slow it down.
[21:20.280 --> 21:23.140]  But I really focused on adding a little bit of information.
[21:23.440 --> 21:26.120]  And I did not assume that you'd compromise their computer
[21:26.120 --> 21:29.140]  and you'd have full access to the database to do whatever you want with it.
[21:29.140 --> 21:31.540]  I wanted some places where you could really do it.
[21:33.180 --> 21:37.720]  So, you know, network traffic is where I spent most of my time.
[21:37.900 --> 21:39.700]  Particularly in this area.
[21:39.720 --> 21:42.800]  Because, I mean, clearly you can spoof packets, you can inject things.
[21:42.800 --> 21:47.400]  I mean, you're constrained in some ways by protocols or upstream network devices.
[21:47.400 --> 21:51.080]  But still, the network, you can insert information pretty much at random.
[21:51.280 --> 21:53.580]  As well as some of these other domains.
[21:53.580 --> 21:56.660]  Any place where you can insert some amount of information,
[21:56.660 --> 21:58.580]  then there can be a problem.
[22:01.340 --> 22:05.600]  So, going back to the model, I assumed that anywhere in that space,
[22:05.600 --> 22:08.960]  along the communication channel, or the information producer,
[22:08.960 --> 22:11.100]  could insert a little bit of information.
[22:11.960 --> 22:14.560]  And then the timing attack would occur.
[22:14.580 --> 22:20.040]  Even on the sensor itself, but I was looking more at the network in between.
[22:20.840 --> 22:23.440]  So how do these things manifest themselves?
[22:23.900 --> 22:27.740]  I looked at all the different places where they could manifest themselves,
[22:27.740 --> 22:32.940]  but I've chosen some highlights here I think would be best just to show you the idea.
[22:33.440 --> 22:35.340]  So I focused on your computer.
[22:35.340 --> 22:38.380]  How people can send a little bit of malicious information to your computer
[22:38.380 --> 22:45.060]  so that it will present you a lot of malicious information in a visual display.
[22:47.060 --> 22:49.580]  So what really got me thinking is just some tools,
[22:49.580 --> 22:52.500]  and this is a $10,000 visualization tool.
[22:52.500 --> 22:56.120]  It labels things, only puts 20 labels on the display.
[22:56.120 --> 23:01.800]  So if you hit a threshold above 20 labels, labels start disappearing.
[23:01.800 --> 23:06.580]  So I thought, if you can exceed limits of the program,
[23:07.060 --> 23:09.640]  then you're gaining ground, you're slowing people down,
[23:09.640 --> 23:15.040]  they may miss what you want them to miss, or see what you want them to see.
[23:15.580 --> 23:18.520]  And even better in displaying information,
[23:18.520 --> 23:21.420]  oftentimes labeling algorithms are used,
[23:21.420 --> 23:24.040]  and you can see here that it doesn't take much
[23:24.040 --> 23:27.600]  to start filling up a display with labels.
[23:28.400 --> 23:31.500]  And, you know, it dropped out here, and they're not even sorted in this one.
[23:31.500 --> 23:34.720]  So perhaps just a little bit, you can start hitting the threshold.
[23:35.920 --> 23:40.860]  And even better, I think, is you see auto-scaling algorithms,
[23:40.860 --> 23:46.480]  where this graphic, the left-hand side,
[23:46.480 --> 23:49.960]  shows ports on external computers that are talking,
[23:49.960 --> 23:52.300]  and on the right-hand side are ports on your computer.
[23:52.300 --> 23:55.240]  So it connects the dots between one to the other,
[23:55.240 --> 23:56.840]  what port to what port.
[23:57.420 --> 23:59.400]  And if you look at the little detail,
[24:00.840 --> 24:03.840]  you have a great deal, that was the initial display,
[24:03.840 --> 24:08.400]  it was like 1 to 135, but this tool auto-scaled.
[24:08.400 --> 24:11.820]  So initially, I saw exactly what I wanted to see.
[24:11.820 --> 24:16.460]  I winged one packet to a high port, it auto-scaled it,
[24:16.460 --> 24:19.460]  reduced all that relevant information down to one pixel.
[24:19.580 --> 24:21.500]  So then you have to waste time, grab the mouse,
[24:22.300 --> 24:25.840]  zoom in, zoom out, just by winging one packet high.
[24:25.900 --> 24:28.160]  Now you may think this is just arbitrary,
[24:28.160 --> 24:30.120]  but you see this in real life.
[24:30.120 --> 24:36.720]  This is a very common web log analysis program.
[24:36.840 --> 24:40.340]  So here, and this is from the Netty at Home project,
[24:40.340 --> 24:43.340]  you see a spike of activity,
[24:43.340 --> 24:46.240]  and actually this was a site being slashed out.
[24:46.240 --> 24:49.640]  So yes, it's more akin to the Nile service attack,
[24:49.640 --> 24:53.020]  but it does illustrate that you can impact,
[24:53.020 --> 24:55.660]  I mean, web logs, you can enter information in,
[24:55.660 --> 24:57.860]  I mean, you probably send ASCII art into web logs,
[24:57.860 --> 25:01.200]  if you are so inclined,
[25:01.200 --> 25:02.900]  but that input in the logs,
[25:02.900 --> 25:05.780]  and then you can alter how the information is displayed.
[25:05.800 --> 25:09.240]  So you see that on the day of the slash dotting,
[25:09.240 --> 25:11.300]  it flat-lined everything else.
[25:11.300 --> 25:12.980]  So, you know, everything else is gone.
[25:15.900 --> 25:18.940]  Also, this is the spinning cube of potential doom,
[25:18.940 --> 25:20.080]  which you may have heard about.
[25:21.300 --> 25:27.220]  And the idea is it shows network flows in 3D space.
[25:28.440 --> 25:30.280]  And in the foreground, though,
[25:30.280 --> 25:33.420]  if you look at how information is rounded down,
[25:33.420 --> 25:37.160]  then this is a whole class B network mapped
[25:37.160 --> 25:39.860]  to the 2 to the 16th bits,
[25:39.860 --> 25:43.600]  mapped along about 500 or 800 pixels.
[25:43.860 --> 25:47.820]  And the entire internet is on the green line,
[25:47.820 --> 25:50.960]  so you are mapping 2 to the 32nd, more or less,
[25:50.960 --> 25:53.700]  along the vertical axis,
[25:53.700 --> 25:55.740]  so you are losing a great deal of information.
[25:56.160 --> 25:58.200]  And then the Z axis, blue,
[25:58.200 --> 26:00.580]  they are mapping the target port.
[26:00.660 --> 26:02.220]  And it turns out that an attacker,
[26:02.220 --> 26:04.320]  if you are using this to watch your network,
[26:04.320 --> 26:07.060]  the attacker would be able to operate
[26:07.060 --> 26:09.300]  with tens of thousands of degrees of freedom
[26:09.300 --> 26:12.080]  as far as destination port,
[26:13.140 --> 26:15.520]  destination IP, and source IP,
[26:15.520 --> 26:17.680]  and illuminate only a single pixel.
[26:18.040 --> 26:20.380]  So again, looking at the scaling in place
[26:20.960 --> 26:21.800]  is significant.
[26:22.780 --> 26:24.720]  And of course, just using a little bit,
[26:24.720 --> 26:26.620]  you put something on the screen,
[26:26.620 --> 26:29.320]  it is easy often to put something on top of it.
[26:30.120 --> 26:33.600]  Some types are more susceptible than others.
[26:34.040 --> 26:36.680]  As well as just inserting some random noise
[26:36.680 --> 26:38.600]  or carefully crafted noise.
[26:39.860 --> 26:42.020]  So how do you protect people,
[26:42.020 --> 26:43.680]  how do you protect your users
[26:43.680 --> 26:46.460]  from small amounts of information
[26:46.460 --> 26:49.240]  having a major impact on what they see?
[26:49.240 --> 26:52.480]  Well, the first thing, and there is no cure-all,
[26:52.480 --> 26:55.720]  in systems where there is some degree of authentication,
[26:55.720 --> 26:58.400]  then that is better than no authentication,
[26:58.400 --> 27:00.640]  or limited where you just basically have to click on an email
[27:00.640 --> 27:02.720]  to verify your identity or something.
[27:05.120 --> 27:07.080]  And I think it is not appropriate,
[27:07.080 --> 27:08.680]  for you, I am just telling you,
[27:08.680 --> 27:10.800]  for entertainment purposes, this next one.
[27:11.200 --> 27:14.420]  I am telling the other people this line
[27:14.420 --> 27:15.940]  because they need to do it.
[27:16.180 --> 27:18.000]  That you need to design systems
[27:18.000 --> 27:20.020]  with malicious data in mind.
[27:20.020 --> 27:21.980]  Often times they live in a utopian world
[27:21.980 --> 27:24.000]  in design systems where they just think
[27:24.000 --> 27:26.080]  only happy data will arrive.
[27:27.380 --> 27:29.900]  But to design systems with malicious data,
[27:29.900 --> 27:32.960]  as well as to train users to be alert for them,
[27:32.960 --> 27:36.100]  and you train people not to give away
[27:36.100 --> 27:38.960]  their passwords over the phone or whatever,
[27:38.960 --> 27:41.580]  that you train users to be aware of the weaknesses,
[27:41.580 --> 27:44.640]  as well as to allow them to customize the system.
[27:46.060 --> 27:47.980]  So again, there is more on this.
[27:48.000 --> 27:49.920]  This paper is on your CD,
[27:49.920 --> 27:51.900]  if you are interested in some more detail.
[27:54.640 --> 27:55.980]  And as well on the CD,
[27:55.980 --> 27:57.720]  I have got some other links you can go to
[27:57.720 --> 27:59.040]  for more information.
[28:02.220 --> 28:03.100]  One moment...
[28:24.190 --> 28:27.430]  So this is a tool I released at Black Hat.
[28:27.430 --> 28:29.790]  And the idea is it is a network PVR.
[28:29.910 --> 28:31.670]  And each of these windows,
[28:31.670 --> 28:33.630]  each of these black squares is a thumbnail
[28:33.630 --> 28:35.550]  that shows you your network traffic.
[28:44.500 --> 28:47.660]  So let me go ahead and load a packet capture data set.
[28:48.060 --> 28:50.120]  And this data set is a packet capture
[28:50.120 --> 28:51.760]  from HoneyNet Scan of the Month.
[28:52.000 --> 28:53.760]  And you can see it is loading the packets.
[28:54.420 --> 28:56.240]  And there is 3,300 packets.
[28:56.520 --> 28:57.620]  So this is what I was working on.
[28:57.620 --> 28:59.200]  Remember, I am going back to what I said before.
[28:59.200 --> 29:01.620]  I wanted to build tools that would raise the bar
[29:01.620 --> 29:04.020]  on how visible attacks are
[29:04.020 --> 29:06.000]  to the people watching the networks.
[29:06.140 --> 29:07.540]  Then I wanted to take a further step
[29:07.540 --> 29:09.640]  and look at, well, how could that be subverted?
[29:09.880 --> 29:12.300]  So I will point you toward my Black Hat slides.
[29:12.300 --> 29:14.020]  And I will be posting those in a little while
[29:14.020 --> 29:16.720]  where it goes into more detail on how this works.
[29:16.720 --> 29:18.920]  But I will give you a quick tour.
[29:18.920 --> 29:20.560]  And this is also on your CD.
[29:22.880 --> 29:24.680]  The idea is there are different views
[29:24.680 --> 29:26.100]  that show you your data.
[29:29.620 --> 29:30.720]  Most straightforward.
[29:30.720 --> 29:32.260]  And they all operate in tandem.
[29:32.260 --> 29:35.360]  So what you see in one occurs in another.
[29:35.660 --> 29:37.300]  So if we play it,
[29:37.300 --> 29:38.780]  you start seeing the data,
[29:38.780 --> 29:41.540]  different views are all operating in lockstep.
[29:41.540 --> 29:42.800]  So the most straightforward one
[29:42.800 --> 29:44.620]  is showing you the text in the packets.
[29:44.620 --> 29:46.100]  This is a text view.
[29:46.360 --> 29:47.680]  It will go and show you
[29:47.680 --> 29:50.580]  the hex view
[29:50.580 --> 29:54.180]  as well as a decimal view.
[29:54.660 --> 29:55.680]  But anyway,
[29:55.680 --> 29:56.960]  things like it has
[29:56.960 --> 29:59.360]  the strings command built in.
[29:59.360 --> 30:00.620]  So you can filter
[30:00.620 --> 30:04.080]  just for the text,
[30:04.080 --> 30:05.160]  strings of a given length
[30:05.160 --> 30:06.420]  in the packets.
[30:11.120 --> 30:12.540]  This view shows
[30:12.540 --> 30:14.500]  one packet per line.
[30:14.500 --> 30:16.280]  And you can see
[30:16.280 --> 30:19.120]  it illuminates the pixel on that line
[30:19.120 --> 30:22.460]  if that hex value exists.
[30:22.460 --> 30:23.180]  So for example,
[30:23.180 --> 30:25.580]  in this region here,
[30:25.580 --> 30:27.280]  that's the printable ASCII range.
[30:27.280 --> 30:28.860]  So if I hover over it,
[30:28.860 --> 30:32.280]  you can see that that's a B,
[30:33.600 --> 30:34.720]  a J, and so on.
[30:34.720 --> 30:35.320]  So you can see
[30:35.320 --> 30:38.580]  the characteristics of it.
[30:38.660 --> 30:39.900]  It will also do the frequency
[30:39.900 --> 30:41.560]  of the bytes per packet.
[30:42.700 --> 30:44.020]  And you can set a threshold
[30:48.350 --> 30:48.770]  for that.
[30:48.770 --> 30:49.950]  Anything above a certain threshold
[30:49.950 --> 30:50.790]  will be hot,
[30:50.790 --> 30:52.290]  so we can move the threshold down
[30:52.290 --> 30:55.290]  until we start finding the tipping point.
[30:59.240 --> 31:01.180]  It looks relative to each packet
[31:01.180 --> 31:02.560]  in that case.
[31:02.900 --> 31:04.700]  I don't pad anything.
[31:08.850 --> 31:10.510]  Yeah, this is very straightforward.
[31:10.510 --> 31:11.690]  It's kind of like an initial step.
[31:11.690 --> 31:12.490]  I mean, there's all sorts of
[31:12.490 --> 31:14.130]  entropy algorithms I could use
[31:14.130 --> 31:16.430]  to do all sorts of cool things
[31:16.430 --> 31:17.730]  with this type of view.
[31:20.430 --> 31:21.210]  You can see the bytes occurring
[31:21.210 --> 31:22.430]  in each packet,
[31:22.430 --> 31:24.730]  but changing with a regular consistency
[31:24.730 --> 31:26.850]  so you can look at the slope.
[31:28.290 --> 31:31.150]  So that's the byte frequency view.
[31:31.410 --> 31:32.750]  I think you'll find this one
[31:32.750 --> 31:34.250]  particularly entertaining.
[31:34.250 --> 31:36.750]  This is called a parallel coordinate plot,
[31:36.750 --> 31:37.970]  and essentially you're connecting
[31:37.970 --> 31:39.930]  the dots on these axes.
[31:40.690 --> 31:41.910]  Where I'm going with it
[31:41.910 --> 31:43.250]  is it's connecting the dots
[31:43.250 --> 31:47.390]  between every header field
[31:47.390 --> 31:48.070]  that's possible.
[31:48.070 --> 31:48.830]  That's my goal.
[31:48.830 --> 31:50.770]  I've got 17 fields in it now.
[31:54.330 --> 31:57.070]  So if I go like this,
[31:57.070 --> 31:59.690]  it shows the fields.
[31:59.950 --> 32:00.610]  Keep going.
[32:02.170 --> 32:03.190]  The idea, then,
[32:03.190 --> 32:04.570]  is you can go through one at a time
[32:05.490 --> 32:06.470]  and see each packet
[32:06.470 --> 32:07.370]  and see its values
[32:07.370 --> 32:08.790]  for every header field.
[32:10.250 --> 32:11.850]  Or you can play it.
[32:13.270 --> 32:14.910]  And what you see growing on the right,
[32:14.910 --> 32:17.410]  that's the IP identification field.
[32:17.410 --> 32:18.530]  You can see the distribution
[32:19.730 --> 32:20.130]  of packets.
[32:21.110 --> 32:22.450]  And the idea, then,
[32:22.450 --> 32:24.210]  is you can take 5,000 packets,
[32:24.210 --> 32:25.090]  roll them through this,
[32:25.090 --> 32:27.190]  and at least watch them unfold
[32:27.190 --> 32:28.930]  and get a feel for what happens.
[32:28.930 --> 32:30.710]  So you can see random activity
[32:30.710 --> 32:31.970]  for a given field.
[32:31.970 --> 32:33.990]  You can see sequential activity.
[32:34.090 --> 32:36.650]  You can see things that don't change,
[32:36.650 --> 32:37.610]  things that change a lot,
[32:37.610 --> 32:38.490]  and so on.
[32:40.150 --> 32:41.450]  I'm going for a whole model
[32:41.450 --> 32:42.370]  of interaction here,
[32:42.370 --> 32:43.150]  like a mixing board
[32:52.060 --> 32:52.760]  Let me open this tool.
[32:52.760 --> 32:54.100]  Let me show you one or two more windows
[32:54.100 --> 32:56.000]  and then I'll show you how to attack it.
[32:56.560 --> 32:58.220]  They're using it for capture the flag, too,
[32:58.220 --> 32:59.080]  to show the network,
[32:59.080 --> 33:00.600]  on occasion.
[33:01.840 --> 33:03.260]  So you can have some fun.
[33:04.460 --> 33:06.360]  This is more of a matrix view.
[33:07.960 --> 33:09.520]  It does have some uses
[33:09.520 --> 33:11.160]  other than just looking cool,
[33:11.160 --> 33:14.100]  but we're kind of tight for time
[33:14.100 --> 33:16.080]  and I don't want to blather on about it.
[33:16.880 --> 33:18.920]  But this is one packet per line
[33:18.920 --> 33:20.220]  and it's showing you the bits
[33:22.060 --> 33:23.840]  if the pixel is on,
[33:23.840 --> 33:25.420]  if there's a one on the wire.
[33:25.420 --> 33:27.380]  So you can see different types of packets.
[33:27.660 --> 33:28.920]  And you can see at a glance
[33:28.920 --> 33:30.520]  the length of the packet,
[33:30.520 --> 33:32.480]  as well as I've played around with such things
[33:32.480 --> 33:35.860]  as, well, show me the printable ASCII values in there.
[33:35.880 --> 33:36.700]  So when I do that,
[33:36.700 --> 33:39.280]  it greys out everything that's not printable ASCII.
[33:39.420 --> 33:41.660]  And this is, the blue is printable ASCII.
[33:41.660 --> 33:42.560]  So you can see at a glance
[33:42.560 --> 33:45.120]  what packets, after you've filtered things,
[33:45.120 --> 33:46.600]  contain printable ASCII.
[33:47.260 --> 33:50.560]  I've also played around with the idea of no-ops.
[33:50.560 --> 33:56.040]  I like the idea of disassembling code on the fly.
[33:56.040 --> 33:58.060]  Looking at things as if they are executables
[33:58.060 --> 34:00.240]  and perhaps you as an analyst,
[34:00.240 --> 34:03.040]  if it's color-coded by common opcodes or something,
[34:03.040 --> 34:05.820]  will be able to look at the flow or the packets
[34:05.820 --> 34:08.220]  and say, that looks like an executable
[34:08.220 --> 34:09.340]  going across the wire
[34:09.340 --> 34:11.220]  and it's not supposed to be there.
[34:11.220 --> 34:12.140]  Perhaps you'll see something
[34:12.140 --> 34:13.760]  your intrusion detection systems
[34:13.760 --> 34:15.900]  or anomaly detection systems won't.
[34:23.650 --> 34:25.530]  And the final one,
[34:26.530 --> 34:28.290]  and this is the final zone for networks.
[34:28.870 --> 34:30.890]  It's connecting the dots between any fields.
[34:30.890 --> 34:33.110]  I don't know if you can quite see it in the back,
[34:33.110 --> 34:34.910]  but it's connecting the dots
[34:34.910 --> 34:37.290]  and then pixels fly off
[34:37.290 --> 34:39.130]  and slide off the screen
[34:39.130 --> 34:41.030]  based on what, and this is showing
[34:41.890 --> 34:45.030]  source IP to destination port,
[34:45.030 --> 34:46.830]  TCP port,
[34:46.830 --> 34:48.390]  but as it happens,
[34:48.390 --> 34:49.750]  they fly off the screen.
[34:49.750 --> 34:52.610]  So you can see a variety of activities.
[34:52.950 --> 34:53.630]  And the way it's set up
[34:53.630 --> 34:55.390]  is you can compare anything to anything.
[34:56.690 --> 34:57.050]  You can look at combinations
[34:57.050 --> 34:58.670]  that might be of use to you.
[34:59.250 --> 35:01.390]  And if you have the different windows open,
[35:01.390 --> 35:03.470]  all at the same time, running lockstep,
[35:03.470 --> 35:04.790]  you might be able to find things
[35:04.790 --> 35:06.950]  you wouldn't be able to find using today's tools.
[35:07.270 --> 35:08.810]  So anyway, this is on your CD.
[35:09.430 --> 35:10.950]  I'd encourage you, and I'll give you the link
[35:10.950 --> 35:12.650]  to go to the website
[35:12.650 --> 35:14.270]  where you can download the latest version.
[35:14.270 --> 35:16.110]  I made a little bit of a fix.
[35:16.430 --> 35:19.130]  It crashes on a certain header condition.
[35:20.290 --> 35:21.610]  But I'll post that
[35:21.610 --> 35:22.970]  when I get back from DEF CON.
[35:23.850 --> 35:25.230]  Anyway, going back to the topic.
[35:26.530 --> 35:28.290]  And I thought, how can I attack it?
[35:33.010 --> 35:34.930]  So let's look at some basic attacks.
[35:35.530 --> 35:37.130]  It really doesn't take much
[35:37.130 --> 35:39.310]  to bring down a visualization system
[35:39.310 --> 35:40.890]  if you're so inclined.
[35:47.050 --> 35:49.770]  So I showed you what normal looked like.
[35:51.650 --> 35:53.570]  Something odd happened here.
[35:59.010 --> 35:59.850]  So let's go ahead
[35:59.850 --> 36:01.510]  and see what the attack looked like.
[36:07.050 --> 36:09.030]  Now this is only 203 packets.
[36:09.030 --> 36:10.590]  So if you were displaying information,
[36:10.590 --> 36:11.870]  looking at a data set,
[36:11.870 --> 36:14.050]  watching capture the flag,
[36:15.610 --> 36:17.210]  I'm using random IPs,
[36:17.210 --> 36:18.530]  and we're only at 30,
[36:18.530 --> 36:20.670]  and it's already becoming crowded.
[36:21.650 --> 36:24.550]  And look what's going on on the UDP.
[36:24.550 --> 36:25.670]  This is color-coded,
[36:25.670 --> 36:27.570]  so orange is UDP traffic.
[36:27.690 --> 36:29.490]  You can see that it's filling up
[36:29.490 --> 36:30.930]  the display pretty quickly.
[36:30.930 --> 36:33.170]  With only 180 packets,
[36:33.170 --> 36:35.470]  it's already a windshield wiper effect.
[36:35.470 --> 36:36.230]  Well, as it turns out,
[36:36.230 --> 36:38.290]  you don't need to hit every single port.
[36:40.590 --> 36:41.790]  You can see how it's scaled.
[36:41.970 --> 36:44.950]  So I only need to hit every 60th port
[36:45.570 --> 36:47.510]  with a packet to draw the line
[36:47.510 --> 36:49.370]  and create that solid effect.
[36:50.950 --> 36:52.430]  So let's look at another example
[36:52.430 --> 36:54.210]  that totally melts it down.
[37:23.940 --> 37:26.140]  So again, just a small amount of information
[37:26.140 --> 37:28.660]  can generate a lot of noise for the human.
[37:34.630 --> 37:37.250]  So this is 1,300 packets.
[37:37.930 --> 37:39.990]  This is pretty much a nuclear meltdown.
[37:40.270 --> 37:41.790]  Now you can change the speed as well,
[37:41.790 --> 37:43.490]  so I'll change the speed to max.
[37:44.470 --> 37:47.250]  And look what's happened on the IP address space.
[37:50.010 --> 37:51.990]  But you can also see what I haven't messed with,
[37:51.990 --> 37:53.450]  so perhaps something is constant
[37:53.450 --> 37:55.750]  and maybe they have a consistent time to live
[37:55.750 --> 37:57.710]  or something that you can grab ahold of
[37:57.710 --> 37:59.850]  and create a filter to counter this.
[38:00.490 --> 38:02.050]  So again, I tried to create the tool
[38:02.050 --> 38:03.570]  and then think about how it would be attacked
[38:03.570 --> 38:05.610]  and then how we can defend and it never ends,
[38:05.610 --> 38:07.690]  but I think this is worth looking at.
[38:07.750 --> 38:09.430]  So that's a meltdown.
[38:10.510 --> 38:12.310]  There are other interesting uses.
[38:12.530 --> 38:14.830]  Who saw the talk at Black Hat?
[38:15.670 --> 38:17.230]  Okay, if you saw the talk at Black Hat,
[38:17.230 --> 38:18.130]  don't give this away.
[38:18.130 --> 38:19.670]  But there are other interesting uses.
[38:28.020 --> 38:29.840]  So this is 600 packets.
[38:33.240 --> 38:34.480]  And if you look at it, say,
[38:34.480 --> 38:37.140]  in the parallel coordinate plot display,
[38:37.140 --> 38:38.780]  you can get the 600 packets.
[38:38.780 --> 38:41.280]  You can look and see a quick overview of what happened.
[38:45.150 --> 38:45.770]  Okay.
[38:46.190 --> 38:48.070]  And again, you can run through them.
[38:48.850 --> 38:53.030]  Well, it really just looks like a lot of source ports were in use,
[38:53.030 --> 38:55.730]  but other than that, not the same IPs were used.
[38:57.930 --> 39:00.310]  So let's play it again, though, with a different view.
[39:04.840 --> 39:07.760]  So if we look at the frequency of the packets, then,
[39:07.760 --> 39:09.820]  you notice odd clouds of packets,
[39:12.460 --> 39:14.140]  of groupings of bytes.
[39:16.860 --> 39:18.660]  Then if we look at it as a rainfall,
[39:18.660 --> 39:21.960]  remember, this is one packet per line.
[39:22.280 --> 39:23.380]  And the way this is,
[39:23.380 --> 39:25.840]  it takes each byte on the wire,
[39:25.840 --> 39:26.900]  maps it to a pixel,
[39:26.900 --> 39:28.600]  is a grayscale.
[39:28.960 --> 39:31.200]  So you can see the rainfall effect
[39:31.200 --> 39:34.540]  of the bytes on the wire is grayscale.
[39:48.670 --> 39:50.810]  It's have I or could you?
[39:52.910 --> 39:54.890]  Right now, the idea is that
[39:54.890 --> 39:57.230]  there's a degree of flexibility built in.
[39:57.230 --> 40:00.790]  The question was, how much can I change the mapping of colors?
[40:08.320 --> 40:09.980]  Well, the extent as it stands,
[40:09.980 --> 40:12.020]  there's no technical reason you couldn't do that.
[40:12.020 --> 40:15.400]  As far as what it's coded, I have filters built in.
[40:15.400 --> 40:16.600]  Right now, they're straightforward.
[40:16.600 --> 40:18.420]  I want to go to greater complexity,
[40:18.420 --> 40:23.280]  but they'll filter certain streams of TCP, UDP, ICMP.
[40:23.280 --> 40:25.800]  And you can change the colors by clicking on there,
[40:25.800 --> 40:27.140]  and that'll change it.
[40:27.140 --> 40:29.940]  But the degree of customizability isn't there yet.
[40:30.480 --> 40:32.100]  But it's certain there's no technical reason
[40:32.100 --> 40:33.200]  that couldn't occur.
[40:39.900 --> 40:42.100]  So just to wrap up,
[40:42.100 --> 40:44.580]  again, on your CD, you've got the talk slides.
[40:44.860 --> 40:47.780]  The roommate tool itself is on the CD.
[40:48.660 --> 40:51.800]  The malicious visualization paper is on the CD.
[40:51.920 --> 40:53.880]  And there's a hacker convention article
[40:53.880 --> 40:56.060]  I want to point you toward.
[40:56.600 --> 40:58.480]  Because I know some of you have difficulty
[40:59.540 --> 41:02.220]  explaining why it's of value to come here.
[41:02.600 --> 41:03.820]  Or is it just me?
[41:04.620 --> 41:05.460]  Right?
[41:06.600 --> 41:09.640]  So I was able to get into the communications of the ACM,
[41:09.640 --> 41:12.140]  which is like the Professional Computer Society's
[41:12.140 --> 41:14.760]  lead journal on why computer sciences
[41:14.760 --> 41:16.740]  should attend hacker conventions.
[41:16.960 --> 41:20.820]  So hopefully, we can change some perceptions out there.
[41:20.820 --> 41:22.500]  And you can wave this around
[41:22.500 --> 41:25.680]  in front of your husband, wife, or boss.
[41:25.940 --> 41:27.380]  Or parent.
[41:30.100 --> 41:31.760]  And that's on the CD as well.
[41:35.860 --> 41:38.180]  I'm looking for anyone who could give me feedback
[41:38.180 --> 41:39.640]  on the tool.
[41:40.580 --> 41:42.220]  It's at roommate.org.
[41:42.220 --> 41:45.200]  Again, it's there. It's on your CD as well.
[41:45.500 --> 41:47.640]  I'm in school, and I'm trying to graduate.
[41:47.640 --> 41:49.640]  So I need feedback to make it better.
[41:49.920 --> 41:52.900]  And right now, I've got a two-page, five-minute survey.
[41:52.940 --> 41:56.440]  If anybody would be kind and see Julian,
[41:56.440 --> 41:59.300]  I'd be permanently indebted to you
[41:59.300 --> 42:00.940]  if you could take five minutes of your time
[42:00.940 --> 42:02.320]  and fill that out. It would help.
[42:02.740 --> 42:04.340]  And basically, if you're an Ethereal user
[42:05.860 --> 42:06.940]  I'd love to see some quick questions on
[42:06.940 --> 42:08.760]  how can people mess with your minds
[42:08.760 --> 42:10.660]  if you are using that tool.
[42:10.660 --> 42:11.660]  Or how they happen.
[42:15.420 --> 42:16.840]  Lots of people to thank.
[42:16.840 --> 42:18.360]  I've been iterating through this
[42:18.360 --> 42:20.500]  in small groups.
[42:20.560 --> 42:21.740]  And I've gotten a lot of feedback
[42:21.740 --> 42:22.720]  from a lot of people.
[42:22.720 --> 42:24.480]  So too many to thank at one time.
[42:25.840 --> 42:27.760]  Finally, I wanted to end with...
[42:27.760 --> 42:29.400]  I've had a good experience at Georgia Tech.
[42:29.400 --> 42:30.880]  A very positive experience.
[42:31.060 --> 42:32.100]  And I've enjoyed the...
[42:32.100 --> 42:33.820]  They've got an undergrad and grad
[42:33.820 --> 42:36.440]  or master's and PhD programs in InfoSec.
[42:36.460 --> 42:37.720]  So if you're interested in that
[42:37.720 --> 42:38.620]  you can send me an email
[42:38.620 --> 42:40.460]  and I'd be happy to answer your questions
[42:40.460 --> 42:42.020]  or point you to someone who could.
[42:42.200 --> 42:44.580]  As well as they're looking to partner with industry.
[42:44.680 --> 42:46.280]  Again, this is part of my business case
[42:46.280 --> 42:47.320]  for coming out here.
[42:48.660 --> 42:50.760]  They're looking to partner with industry and government.
[42:50.760 --> 42:51.840]  So if you're looking to kind of like
[42:51.840 --> 42:54.160]  outsourced R&D,
[42:54.160 --> 42:55.920]  they're very much up for that.
[42:56.000 --> 42:58.040]  And the website or I could point you
[42:58.040 --> 42:59.100]  to more information.
[43:03.640 --> 43:04.520]  Yes.
[43:10.030 --> 43:13.230]  The website is outdated as of now.
[43:13.250 --> 43:14.810]  So I wanted to release it at Black Hat.
[43:14.810 --> 43:16.770]  So when I get back, the version on the CD
[43:16.770 --> 43:18.550]  is like 1.7 something.
[43:18.550 --> 43:20.750]  And I have 1.8 something that I will release
[43:20.750 --> 43:22.130]  as soon as I get back.
[43:22.130 --> 43:23.250]  It'll function.
[43:23.510 --> 43:25.470]  It's IP header length.
[43:25.710 --> 43:28.330]  If it's not 5, it'll crash.
[43:29.350 --> 43:30.790]  Which is 5 is the normal value.
[43:30.790 --> 43:32.490]  But if you get other things,
[43:32.490 --> 43:33.990]  then it'll crash.
[43:35.490 --> 43:36.410]  This is a sample file.
[43:36.410 --> 43:38.670]  And a key point is it doesn't load PCAP natively.
[43:38.670 --> 43:39.850]  So I have a little conversion tool
[43:39.850 --> 43:41.970]  that converts it to the file format.
[43:41.970 --> 43:43.770]  So the tool's on the CD.
[43:43.770 --> 43:44.990]  It runs on XP.
[43:45.310 --> 43:47.710]  And I have a sample data file on there
[43:47.710 --> 43:49.690]  for you to take a look at and play with.
[43:54.280 --> 43:55.080]  Yes.
[43:59.780 --> 44:00.800]  I have not.
[44:00.800 --> 44:02.440]  But I don't see any reason why not.
[44:02.440 --> 44:04.880]  I mean, I want to show like the picture
[44:04.880 --> 44:06.600]  of what it looked like or whatever
[44:06.600 --> 44:08.440]  with the PCAP file
[44:08.440 --> 44:10.660]  and the file format for my tool.
[44:11.580 --> 44:13.120]  I mean, they're not sensitive or anything.
[44:13.120 --> 44:14.840]  So yeah, absolutely, I want to share them.
[44:15.260 --> 44:16.120]  But I haven't.
[44:16.200 --> 44:17.880]  It's one of those things like the week I get back,
[44:17.880 --> 44:18.920]  I'll be working that.
[44:24.390 --> 44:26.550]  Well, I'd like to thank you all for coming.
[44:26.550 --> 44:27.930]  Julian's in the yellow shirt.
[44:28.210 --> 44:30.850]  If any of you could fill out the survey,
[44:30.850 --> 44:32.110]  if you've worked with Ethereal
[44:32.110 --> 44:33.910]  and always wondered how you can mess with people
[44:33.910 --> 44:35.870]  through it or work with Snort,
[44:35.870 --> 44:37.050]  I would appreciate it.
[44:37.050 --> 44:38.810]  And if anybody's interested, I'll be outside.
[44:38.810 --> 44:39.150]  Thank you.