WEBVTT 00:10.640 --> 00:12.480 First, I'd like to thank you all for coming. 00:12.480 --> 00:13.220 I'm Greg Conti. 00:13.220 --> 00:17.840 And I'd like to talk to you about the idea of denial of information attacks. 00:17.860 --> 00:23.080 And in one sentence, the idea is attacking humans through the computer system. 00:23.080 --> 00:28.860 Not attacking the computer system, but attacking humans through their computer system, and how we can counteract that. 00:29.200 --> 00:31.080 And here's one example. 00:31.680 --> 00:32.860 Large shark. 00:33.840 --> 00:36.860 Currently I'm at Georgia Tech, but I'm also in the Army. 00:36.860 --> 00:41.280 And I'm here as a free citizen, and not as a representative of the government. 00:47.780 --> 00:57.540 So, more specifically, denial of information attacks attack you, the human, and try and consume the limited resources that you have. 00:57.540 --> 01:07.280 If you contrast what you can handle versus what your computer can handle, in certain categories, you'll fall over far faster than your box will. 01:07.280 --> 01:15.760 So, if it slows you down or alters your decision making, then that's a denial of information attack occurring. 01:16.420 --> 01:19.220 So, I think the best example is spam. 01:19.480 --> 01:26.800 And I won't ask you, but just consider how many of you have deleted email based on, say, a subject line that you shouldn't have. 01:26.860 --> 01:30.360 Or you've opened email that you shouldn't have. 01:30.860 --> 01:36.320 And I know, when I talked to my wife about this, we thought it was probably... you guys are at the leading edge. 01:36.320 --> 01:42.160 So, when spam first started coming out, you probably figured that out pretty quickly. 01:42.240 --> 01:50.840 But who's received, and I'll ask for a show of hands, who has received a frantic email from a family member about some virus email that they received? 01:50.840 --> 01:57.320 Or some, you know, if your local tech support for you or your family or friends, who's received emails like that? 01:57.880 --> 02:00.500 Pretty much, you know, almost the whole room. 02:00.560 --> 02:03.100 So, I think spam is an example. 02:03.100 --> 02:05.540 I mean, consider how much time have you wasted on spam? 02:05.540 --> 02:08.220 And these are just examples. 02:08.360 --> 02:13.200 So, what I'm trying to do to this problem is look at the bigger picture and look at the structure around it. 02:13.200 --> 02:20.040 And then, how people are defending it and defenses to just add some structure to the domain. 02:21.120 --> 02:22.780 I'll take one step back. 02:22.960 --> 02:27.920 And there's some interesting statistics that just recently came out of the University of Indiana. 02:27.920 --> 02:29.660 I'm sorry, Indiana University. 02:29.960 --> 02:32.120 About phishing. 02:32.120 --> 02:41.040 And what they did is they went to social networking sites like Orkut and found out who was friends with who. 02:41.040 --> 02:48.700 Then they used that information to send out a phishing email to college students and they sent them out to 500 people. 02:49.320 --> 02:51.720 But with the return address of a friend. 02:52.260 --> 02:55.140 The emails were just like, hey, check this site out. 02:55.140 --> 02:57.920 It gave a generic link off campus. 02:57.920 --> 03:04.600 That link prompted them for their credentials or user ID and password from college. 03:05.040 --> 03:07.900 And they were 72% successful. 03:08.860 --> 03:10.940 And the students were very mad. 03:10.940 --> 03:14.960 But there's some interesting statistics if you take a look at the gender. 03:15.420 --> 03:21.200 If a male sent an email to another male, only 53% of them fell for it. 03:22.340 --> 03:24.520 You can see where we're going here. 03:26.940 --> 03:32.280 If a female sent an email to a male, it went up from 53% to 68%. 03:34.560 --> 03:38.080 Female to female, 76%. 03:39.280 --> 03:41.720 And then they live in a different world than I do. 03:41.720 --> 03:45.640 But male to female, 78% of them fell for it. 03:45.640 --> 03:47.620 So on average it was 72%. 03:47.620 --> 03:49.980 So male to female was the worst category. 03:49.980 --> 03:53.580 But I thought the real insight there was using that social networking information. 03:54.980 --> 03:58.560 So I don't want you to confuse this with denial of service attacks. 03:58.700 --> 04:04.940 This is a recent innovation from a major operating system manufacturer. 04:05.640 --> 04:09.440 They've evolved from the blue screen of death to the red screen of death. 04:09.920 --> 04:11.160 This is from Longhorn. 04:11.160 --> 04:12.960 I guess it's Vista these days. 04:12.960 --> 04:14.960 Anyway, back to the... 04:14.960 --> 04:24.460 It's not what you consider denial of service where you're consuming system resources, RAM, hard drive space, processing power. 04:24.460 --> 04:28.220 You're consuming the human's resources is the key difference. 04:29.340 --> 04:32.620 And it's compounded by the idea of information growth. 04:32.620 --> 04:37.220 If you look, information is being generated at a prodigious rate. 04:37.740 --> 04:40.000 This study is very, very good. 04:40.000 --> 04:45.020 And I'd also like to mention I personally hate bullet slides, so I have very, very few in here. 04:45.020 --> 04:53.360 But on the slides on your disk, on the Con CD, I've included an extended version that has more information with links and things. 04:53.360 --> 04:55.660 Anyway, I just wanted to highlight one of these. 04:55.680 --> 05:02.280 This is a study coming out of Berkeley from 2003 entitled How Much Information? 05:02.460 --> 05:07.800 It's a very good study, except it's like 150 pages, which again is information overload. 05:07.800 --> 05:14.160 But the surface web at that time, they estimated, was about 170 terabytes. 05:14.160 --> 05:16.680 Or 17 times the U.S. 05:16.680 --> 05:19.400 Library of Congress print collection. 05:19.440 --> 05:23.120 So a tremendous amount of information in 2003. 05:25.420 --> 05:28.960 And that's just the surface web, not the dynamically generated web. 05:30.000 --> 05:41.060 So we just talked about spam attacking primarily your cognitive decision making. 05:41.320 --> 05:44.520 Well, there's other attacks that attack your perception. 05:44.940 --> 05:46.840 I had this on a web page. 05:47.160 --> 05:50.780 How much work can you get done with that sitting on the web page blinking? 05:52.020 --> 05:53.940 So that was on a real estate web page. 05:53.940 --> 05:57.720 I had to slide it off to the side to be able to get any work done. 05:57.720 --> 05:59.200 And it just makes me mad. 05:59.200 --> 06:00.960 What were they thinking? 06:00.960 --> 06:03.200 Who's going to go out and buy coffee based on that? 06:04.820 --> 06:09.340 So we talked about cognitive resources and perceptual resources. 06:09.340 --> 06:10.960 Then we have motor resources. 06:11.360 --> 06:18.400 And the idea then, if you go back to the denial of information attack, if you're slowing the human down, you're beginning to win. 06:18.400 --> 06:21.500 If you're sending them in the wrong direction, you're beginning to win. 06:21.580 --> 06:23.880 Motor resource attacks often slow you down. 06:23.880 --> 06:29.180 You have to stop what you're doing, grab the mouse, click the pop-up, get back to what you were doing. 06:31.520 --> 06:42.100 And I thought this example from hack-proofing your network, again, gives an insight into the idea of the decision making by the human versus the decision making by the computer. 06:42.100 --> 06:43.940 And I'll read it for those in the back. 06:44.480 --> 06:52.740 In the end, all the power of the intrusion detection system is ultimately controlled by a single judgment call on whether or not to take action. 06:52.740 --> 06:58.140 So if you can get into that decision making cycle, you can affect major outcomes. 07:00.670 --> 07:04.110 I thought it was also relevant to look at information flows. 07:04.150 --> 07:12.330 So if you consider signal being what you're looking for, if you're out on the web, for example, or in any information space, you're looking for certain information. 07:12.470 --> 07:13.930 That would be the signal. 07:14.270 --> 07:17.310 Noise would be everything but what you're looking for. 07:17.550 --> 07:23.870 So the best case would be signal is very high, and noise would be very low, so that's the best situation. 07:23.870 --> 07:27.130 So what you're trying to do is increase your signal-to-noise ratio. 07:28.270 --> 07:34.410 If you consider a small amount of signal and a small amount of noise, it's still manageable for a human. 07:34.410 --> 07:40.070 So you can look at this list of 10 things, and even if it's 50-50, you can still pick out what you're looking for. 07:40.110 --> 07:42.430 Some Google results are like that. 07:44.990 --> 07:48.210 But it starts getting worse when you have low signal-to-noise. 07:48.210 --> 07:56.210 And particularly, you have a lot of noise, a little bit of signal, what you're looking for, that's the domain of the denial-of-information attack. 07:57.910 --> 08:00.250 And then you start getting into denial-of-service. 08:00.250 --> 08:05.950 If you have lots and lots of information, then you start overcoming your computer's resources. 08:05.950 --> 08:08.250 So that's more the denial-of-service attack. 08:09.530 --> 08:12.970 So if you consider this webpage, and this is weather.com. 08:12.970 --> 08:17.310 I started going to specific news sites, and then I thought I'd get in trouble for whatever one I chose. 08:17.310 --> 08:18.990 So I thought weather would be safe. 08:19.150 --> 08:25.610 So if you went to this website to get something done, and I actually tried to do this to find out Las Vegas weather. 08:27.370 --> 08:29.670 Yeah, I mean hot and dry, what was I thinking? 08:31.570 --> 08:42.570 Anyway, say you came to this site, and putting your signal-to-noise ratio goggles on, and all you wanted was the United States weather and some basic weather information. 08:44.030 --> 08:46.030 All of that is noise. 08:46.030 --> 08:48.370 So just a tremendous amount. 08:48.370 --> 08:51.390 And I know there's some plug-ins for various browsers that help. 08:51.470 --> 08:56.170 But the idea, if you can just get down to the signal, it's a tremendously better experience. 08:57.630 --> 09:06.850 So besides the idea of the signal-to-noise ratio, and the keynote speaker at Black Hat was Gilman Louie, who also mentioned this. 09:07.170 --> 09:15.250 He is the CEO of In-Q-Tel, which I think is a CIA startup funding venture capital company. 09:15.250 --> 09:16.250 I think it's pretty interesting. 09:17.850 --> 09:19.850 But anyway, he mentioned the OODA loop. 09:19.910 --> 09:24.610 And the OODA loop was Observe, Orient, Decide, and Act. 09:24.610 --> 09:28.150 And it was developed by Colonel John Boyd, who was in the Air Force. 09:28.150 --> 09:33.030 And this came out in the 60s, about how fighter pilots make decisions. 09:33.170 --> 09:38.390 And if you could make your decisions faster than the other person, you could go through this cycle, then you win. 09:38.390 --> 09:49.330 So consider, if you're in a certain situation, you're even looking at a webpage or any, looking at logs, you have to observe the data, or even your email is probably the best example. 09:49.450 --> 09:57.930 You have to observe your email, and after you observe it and orient yourself to it, then you have to decide, what do I do? 09:58.330 --> 10:03.990 And if it's a puzzling subject line, you spend time, you're wasting time, you're slowing down this loop. 10:04.690 --> 10:11.910 And then after you do it, you have to act, and typically action requires some physical response, which is a motor response, which will slow it down. 10:11.910 --> 10:20.490 So if you're slowing your opponent's OODA loop down, again, you're conducting a successful attack. 10:20.490 --> 10:25.050 So you can have people go through cycles unnecessarily, or you can slow it down. 10:27.470 --> 10:33.310 So, with that in mind, Observe, Orient, Decide, and Act, let's look at the webpage again. 10:34.470 --> 10:51.390 And this time, if your task was to just find out your local weather, which isn't available, and it took me a while, so you observe this, and orient yourself to it, and find out where do you type it in, where do you get your local weather. 10:52.370 --> 10:54.950 So think how long it would take. 10:55.310 --> 10:57.850 Well, it turns out, it's there. 10:57.850 --> 11:00.030 Everything else is noise for the task at hand. 11:00.030 --> 11:02.510 So you've slowed the person down as they go through that. 11:02.510 --> 11:06.810 And granted, they've got business reasons for doing so, they want to show you ads. 11:08.650 --> 11:12.110 Some of the news websites are the worst offenders of all. 11:13.730 --> 11:22.050 Okay, so moving forward, let's look at then, you've seen some of these examples, big examples, let's look at how people are defending against these type of attacks. 11:24.230 --> 11:31.230 And I spent about, oh jeez, three years of my life reading Slashdot every day, looking for denial of information attacks in the news. 11:31.230 --> 11:33.610 And certain trends came out of it. 11:33.610 --> 11:36.250 And clearly, there were legal responses. 11:36.530 --> 11:41.150 And you can consider the anti-telemarketer legislation, for example. 11:41.450 --> 11:43.150 As well as regulatory. 11:43.310 --> 11:54.500 There were moral responses, public relation campaigns, from the Motion Picture Association of America, for example, like you'll put our employees out of their jobs if you pirate movies. 11:57.720 --> 12:01.580 And I was particularly intrigued by the use of violence. 12:01.580 --> 12:08.340 Violence is, if people are receiving information they don't want, violence has been a proven countermeasure in certain instances. 12:08.600 --> 12:20.520 And I was particularly intrigued by the, let's see, Charles Bauer, Charles Bauer case, where he received one spam too many, and snapped, and started sending death threats back to the spammers. 12:20.680 --> 12:22.840 And he was arrested for his troubles. 12:26.300 --> 12:32.440 So, I want to take a harder look at, alright, you've got these limited resources, how do they all interplay? 12:32.440 --> 12:35.120 So, this is you. 12:35.220 --> 12:44.840 And I've modeled it, and it's hard, many of you may not be able to see it, but those boxes represent your cognitive capability, short-term memory, long-term memory. 12:45.040 --> 12:48.260 And that's you in the red square, talking to your computer. 12:48.260 --> 12:56.740 So, the arrows you see between that, actually, along this boundary, that's your vision, your hearing, your speech, and your motor. 12:56.740 --> 13:05.680 So, the input-output through your computer, which also has a limited amount of resources, CPU, RAM, hard drive space, and IO. 13:06.560 --> 13:13.180 And it communicates, so you're the information consumer, you're consuming information from information producers. 13:13.180 --> 13:18.240 And you need to pull that information in, say from websites, over some sort of communication channel. 13:19.980 --> 13:23.020 Those are servers out there providing you the information. 13:23.060 --> 13:26.600 They too have limited resources. 13:27.480 --> 13:31.380 And often there's a human sitting there, you know, the spammer hits the send button. 13:31.380 --> 13:34.440 But they could be things like unattended machines, like sensors. 13:36.300 --> 13:40.760 So, if you take a closer look, then, you can see where these attacks take place. 13:40.800 --> 13:51.160 For example, if you use very small text, like in legal agreements, in EULAs, you will... that's attack against the vision of the recipient. 13:52.480 --> 13:57.740 Spoofing the browser, you know, some of the phishing attacks that have taken place occur along that HCI boundary. 13:57.740 --> 14:01.060 And I just found this useful to get a feel for where these things are occurring. 14:01.380 --> 14:04.640 To look at where attacks are taking place. 14:04.640 --> 14:06.900 Maybe where new attacks could take place. 14:06.900 --> 14:10.180 As well as where some defenses could be put up. 14:10.720 --> 14:12.880 So, if you look at defenses, there's a... 14:12.880 --> 14:15.900 the HCI boundary between you and your computer. 14:15.900 --> 14:19.480 There's been a move forward in the notion of usable security. 14:19.480 --> 14:24.260 Like security actually people can... it gives them the information they need. 14:24.760 --> 14:32.080 TCP damping on the communication channel will slow down even if a certain number of email exceed a given threshold. 14:32.080 --> 14:34.800 They'll slow down the network pace. 14:34.960 --> 14:39.680 And I believe that's actually... there's some penalties in capture the flag on that front. 14:40.660 --> 14:44.640 Or pushing... most of these push the problem back to the attacker. 14:44.640 --> 14:47.260 So you see computational puzzle solving. 14:47.260 --> 14:54.280 Attack requires... if you want to send this email, for example, requires a small amount of CPU space on the attacker. 14:55.520 --> 15:00.680 And I'm particularly intrigued by Paul Graham's idea of the Eliza spam responder. 15:00.680 --> 15:03.640 And who's heard of that idea for spam in Eliza? 15:04.740 --> 15:05.800 Okay, good. 15:05.800 --> 15:14.000 The idea is Eliza's early straightforward artificial intelligence program that was designed to be like a psychologist. 15:14.940 --> 15:17.200 So the idea then is you have a... 15:18.040 --> 15:20.800 listening on a given port or email address. 15:20.800 --> 15:21.540 The email comes in. 15:21.540 --> 15:29.300 If they can craft it in such a way that the spammer buys the response and people all across the internet do that, we win. 15:29.300 --> 15:31.100 So it's a pretty intriguing idea. 15:31.100 --> 15:34.160 And it shows you, again, denial of information, how little resources... 15:35.720 --> 15:42.920 the spammer is relying on economies of scale, 10 million email to press of a button. 15:43.240 --> 15:48.020 If you can, you know, 1% of those people eat up a little bit of time, you've won. 15:49.880 --> 15:51.980 So I thought this was Slashdot. 15:51.980 --> 15:53.000 I love Slashdot. 15:53.000 --> 15:56.640 It's like this high of mind and there's always interesting insights. 15:57.540 --> 16:05.400 So from Slashdot on this subject, I have a little PHP script that I use whenever I get a phishing email. 16:05.400 --> 16:12.400 The script generates fake credit card numbers and expiration dates and repeatedly hits the sites... 16:12.400 --> 16:15.620 the phishing sites form dumping in random information. 16:16.780 --> 16:24.140 Any halfway intelligent phisher would record the IP address and just dump all of mine when he saw they were bogus. 16:24.380 --> 16:28.000 But it makes me feel good that I at least wasted some of his time. 16:28.340 --> 16:30.080 So again, you know, you push that back. 16:30.080 --> 16:31.900 If a lot of people did... and I'm not encouraging... 16:31.900 --> 16:33.760 I don't want to get drug off in shackles. 16:33.920 --> 16:38.880 But it is intriguing, the idea of pushing the problem back to the spammer. 16:41.560 --> 16:43.200 So I've looked at this... 16:43.200 --> 16:45.400 well, honestly, entirely too much, this problem. 16:45.420 --> 16:51.100 But I have... there are several papers on it that are on my website that I'll give you the link at the end and it's on the CD. 16:51.360 --> 17:02.400 But if you're interested, you know, on any of the papers, on the website that are like pre-publication, you can send me an email and I'll send you a private copy for review or something like that. 17:02.400 --> 17:04.700 And most of the others are available if you're interested in more. 17:04.700 --> 17:07.660 I just tried to hit some highlights I thought you'd find entertaining. 17:08.980 --> 17:14.300 So given that big problem, I wanted to look at a specific domain. 17:14.300 --> 17:16.480 And there are a lot of people working in spam. 17:16.480 --> 17:19.120 So I've looked specifically at network security. 17:21.160 --> 17:28.980 And in particular, the idea of using information visualization as a way to deal with that problem of denial of information attacks. 17:28.980 --> 17:40.380 Because there's this battle and you see it during Capture the Flag of hiding your activities from the human who's monitoring the system or the intrusion detection systems or the defenders. 17:40.380 --> 17:43.320 So I was looking at information visualization to do that. 17:44.280 --> 17:57.160 So I came up with a tool that's a PVR and it monitors network traffic and will load historical data sets and provides different specially crafted windows to hopefully provide you insight. 17:58.060 --> 18:08.300 At Interzone, I had a friend who said they thought they might have to change the rules of Capture the Flag if all of a sudden you could see network activity in useful ways. 18:08.300 --> 18:09.180 So that's the idea. 18:09.180 --> 18:11.900 I mean, the space we're in, everything's one-upmanship. 18:11.900 --> 18:16.080 So I thought, okay, we have these windows and that's useful. 18:16.080 --> 18:18.580 Well, how can we attack them? 18:19.000 --> 18:32.000 Kind of take it one step forward and look at how can we look at the traffic in ways that are useful, then take it another step and say, okay, knowing how we all think, okay, this is in place, this is cool, how can we attack it? 18:32.960 --> 18:41.600 So this is what the tool looked like and this is just a quick snapshot and it's using the Microsoft Virtual Desktop to show a few different panes at the same time. 18:41.600 --> 18:43.120 I'll demo this at the end. 18:45.960 --> 18:53.040 Okay, so last year at DEF CON, I gave a talk on a related subject and the first question was, how do we attack it? 18:53.220 --> 18:58.940 So combined with my interest and your interest, I thought it would be an interesting space to look at. 18:59.140 --> 19:02.400 And you'll find in academia, not many... 19:02.400 --> 19:06.640 I mean, if you're not in the security field, generally you're not in the security field. 19:06.640 --> 19:12.020 So you can make a lot of progress just by looking at their stuff and breaking it for them. 19:12.420 --> 19:13.400 It's pretty fun. 19:13.400 --> 19:17.080 So that led to the work on malicious visualizations. 19:18.580 --> 19:26.180 And then the idea was attacking the human through their computer, through their system that presents information to them in some way. 19:26.680 --> 19:33.260 So ideally, you can understand how these attacks occur, then you can design better ways to protect yourself. 19:34.320 --> 19:36.700 Ah, I was motivated by Pokemon. 19:36.880 --> 19:41.580 Now I know at a normal academic conference, people wouldn't know the answer to this. 19:41.580 --> 19:48.740 But why was I motivated about Pokemon as far as attacking people through information technology? 19:50.200 --> 19:51.280 Seizures. 19:51.280 --> 19:52.940 Okay, very good. 19:52.940 --> 20:05.460 In the late 1990s, there was a specific Pokemon episode that had rapid flashing red lights in 20 to 30 hertz. 20:05.940 --> 20:12.740 Well, it turns out that people who have photosensitive epilepsy, that's just the right frequency to trigger a seizure. 20:13.160 --> 20:23.120 And reports vary, but thousands of people went to the hospital with nausea, and several hundred went to the hospital because of seizures. 20:23.140 --> 20:26.140 So it got me thinking about reaching... 20:26.140 --> 20:33.660 I know that's a very specific case, but I think the prevalence in the US population is about 2% through the lifetime for epilepsy. 20:34.020 --> 20:36.060 So it's non-zero. 20:36.060 --> 20:40.360 But it got me thinking about attacking people through computers. 20:41.660 --> 20:43.640 But then I wanted to be realistic. 20:43.920 --> 20:47.620 So, yeah, I mean, you just want theoretic attacks that never occur. 20:47.680 --> 20:58.960 I wanted to look at, well, where can you really insert information into what people see, and how can that little bit of information impact a lot of information, or the display of the information. 20:59.580 --> 21:01.380 So I made some assumptions. 21:01.580 --> 21:08.200 I'm not dossing the system, I'm just adding a little bit of information, trying to skew the results as much as possible and trick people. 21:09.260 --> 21:20.120 As well as, in some cases, I think it's reasonable to assume you could alter the timing of the data, particularly if you had access to the sensor or something, or the network, somewhere in between, you might be able to slow it down. 21:20.280 --> 21:23.140 But I really focused on adding a little bit of information. 21:23.440 --> 21:29.140 And I did not assume that you'd compromise their computer and you'd have full access to the database to do whatever you want with it. 21:29.140 --> 21:31.540 I wanted some places where you could really do it. 21:33.180 --> 21:37.720 So, you know, network traffic is where I spent most of my time. 21:37.900 --> 21:39.700 Particularly in this area. 21:39.720 --> 21:42.800 Because, I mean, clearly you can spoof packets, you can inject things. 21:42.800 --> 21:47.400 I mean, you're constrained in some ways by protocols or upstream network devices. 21:47.400 --> 21:51.080 But still, the network, you can insert information pretty much at random. 21:51.280 --> 21:53.580 As well as some of these other domains. 21:53.580 --> 21:58.580 Any place where you can insert some amount of information, then there can be a problem. 22:01.340 --> 22:11.100 So, going back to the model, I assumed that anywhere in that space, along the communication channel, or the information producer, could insert a little bit of information. 22:11.960 --> 22:14.560 And then the timing attack would occur. 22:14.580 --> 22:20.040 Even on the sensor itself, but I was looking more at the network in between. 22:20.840 --> 22:23.440 So how do these things manifest themselves? 22:23.900 --> 22:32.940 I looked at all the different places where they could manifest themselves, but I've chosen some highlights here I think would be best just to show you the idea. 22:33.440 --> 22:35.340 So I focused on your computer. 22:35.340 --> 22:45.060 How people can send a little bit of malicious information to your computer so that it will present you a lot of malicious information in a visual display. 22:47.060 --> 22:52.500 So what really got me thinking is just some tools, and this is a $10,000 visualization tool. 22:52.500 --> 22:56.120 It labels things, only puts 20 labels on the display. 22:56.120 --> 23:01.800 So if you hit a threshold above 20 labels, labels start disappearing. 23:01.800 --> 23:15.040 So I thought, if you can exceed limits of the program, then you're gaining ground, you're slowing people down, they may miss what you want them to miss, or see what you want them to see. 23:15.580 --> 23:27.600 And even better in displaying information, oftentimes labeling algorithms are used, and you can see here that it doesn't take much to start filling up a display with labels. 23:28.400 --> 23:31.500 And, you know, it dropped out here, and they're not even sorted in this one. 23:31.500 --> 23:34.720 So perhaps just a little bit, you can start hitting the threshold. 23:35.920 --> 23:52.300 And even better, I think, is you see auto-scaling algorithms, where this graphic, the left-hand side, shows ports on external computers that are talking, and on the right-hand side are ports on your computer. 23:52.300 --> 23:56.840 So it connects the dots between one to the other, what port to what port. 23:57.420 --> 24:08.400 And if you look at the little detail, you have a great deal, that was the initial display, it was like 1 to 135, but this tool auto-scaled. 24:08.400 --> 24:11.820 So initially, I saw exactly what I wanted to see. 24:11.820 --> 24:19.460 I winged one packet to a high port, it auto-scaled it, reduced all that relevant information down to one pixel. 24:19.580 --> 24:25.840 So then you have to waste time, grab the mouse, zoom in, zoom out, just by winging one packet high. 24:25.900 --> 24:30.120 Now you may think this is just arbitrary, but you see this in real life. 24:30.120 --> 24:36.720 This is a very common web log analysis program. 24:36.840 --> 24:46.240 So here, and this is from the Netty at Home project, you see a spike of activity, and actually this was a site being slashed out. 24:46.240 --> 25:05.780 So yes, it's more akin to the Nile service attack, but it does illustrate that you can impact, I mean, web logs, you can enter information in, I mean, you probably send ASCII art into web logs, if you are so inclined, but that input in the logs, and then you can alter how the information is displayed. 25:05.800 --> 25:11.300 So you see that on the day of the slash dotting, it flat-lined everything else. 25:11.300 --> 25:12.980 So, you know, everything else is gone. 25:15.900 --> 25:20.080 Also, this is the spinning cube of potential doom, which you may have heard about. 25:21.300 --> 25:27.220 And the idea is it shows network flows in 3D space. 25:28.440 --> 25:43.600 And in the foreground, though, if you look at how information is rounded down, then this is a whole class B network mapped to the 2 to the 16th bits, mapped along about 500 or 800 pixels. 25:43.860 --> 25:55.740 And the entire internet is on the green line, so you are mapping 2 to the 32nd, more or less, along the vertical axis, so you are losing a great deal of information. 25:56.160 --> 26:00.580 And then the Z axis, blue, they are mapping the target port. 26:00.660 --> 26:17.680 And it turns out that an attacker, if you are using this to watch your network, the attacker would be able to operate with tens of thousands of degrees of freedom as far as destination port, destination IP, and source IP, and illuminate only a single pixel. 26:18.040 --> 26:21.800 So again, looking at the scaling in place is significant. 26:22.780 --> 26:29.320 And of course, just using a little bit, you put something on the screen, it is easy often to put something on top of it. 26:30.120 --> 26:33.600 Some types are more susceptible than others. 26:34.040 --> 26:38.600 As well as just inserting some random noise or carefully crafted noise. 26:39.860 --> 26:49.240 So how do you protect people, how do you protect your users from small amounts of information having a major impact on what they see? 26:49.240 --> 27:02.720 Well, the first thing, and there is no cure-all, in systems where there is some degree of authentication, then that is better than no authentication, or limited where you just basically have to click on an email to verify your identity or something. 27:05.120 --> 27:10.800 And I think it is not appropriate, for you, I am just telling you, for entertainment purposes, this next one. 27:11.200 --> 27:15.940 I am telling the other people this line because they need to do it. 27:16.180 --> 27:20.020 That you need to design systems with malicious data in mind. 27:20.020 --> 27:26.080 Often times they live in a utopian world in design systems where they just think only happy data will arrive. 27:27.380 --> 27:44.640 But to design systems with malicious data, as well as to train users to be alert for them, and you train people not to give away their passwords over the phone or whatever, that you train users to be aware of the weaknesses, as well as to allow them to customize the system. 27:46.060 --> 27:47.980 So again, there is more on this. 27:48.000 --> 27:51.900 This paper is on your CD, if you are interested in some more detail. 27:54.640 --> 27:59.040 And as well on the CD, I have got some other links you can go to for more information. 28:02.220 --> 28:03.100 One moment... 28:24.190 --> 28:27.430 So this is a tool I released at Black Hat. 28:27.430 --> 28:29.790 And the idea is it is a network PVR. 28:29.910 --> 28:35.550 And each of these windows, each of these black squares is a thumbnail that shows you your network traffic. 28:44.500 --> 28:47.660 So let me go ahead and load a packet capture data set. 28:48.060 --> 28:51.760 And this data set is a packet capture from HoneyNet Scan of the Month. 28:52.000 --> 28:53.760 And you can see it is loading the packets. 28:54.420 --> 28:56.240 And there is 3,300 packets. 28:56.520 --> 28:57.620 So this is what I was working on. 28:57.620 --> 28:59.200 Remember, I am going back to what I said before. 28:59.200 --> 29:06.000 I wanted to build tools that would raise the bar on how visible attacks are to the people watching the networks. 29:06.140 --> 29:09.640 Then I wanted to take a further step and look at, well, how could that be subverted? 29:09.880 --> 29:12.300 So I will point you toward my Black Hat slides. 29:12.300 --> 29:16.720 And I will be posting those in a little while where it goes into more detail on how this works. 29:16.720 --> 29:18.920 But I will give you a quick tour. 29:18.920 --> 29:20.560 And this is also on your CD. 29:22.880 --> 29:26.100 The idea is there are different views that show you your data. 29:29.620 --> 29:30.720 Most straightforward. 29:30.720 --> 29:32.260 And they all operate in tandem. 29:32.260 --> 29:35.360 So what you see in one occurs in another. 29:35.660 --> 29:41.540 So if we play it, you start seeing the data, different views are all operating in lockstep. 29:41.540 --> 29:44.620 So the most straightforward one is showing you the text in the packets. 29:44.620 --> 29:46.100 This is a text view. 29:46.360 --> 29:54.180 It will go and show you the hex view as well as a decimal view. 29:54.660 --> 29:59.360 But anyway, things like it has the strings command built in. 29:59.360 --> 30:06.420 So you can filter just for the text, strings of a given length in the packets. 30:11.120 --> 30:14.500 This view shows one packet per line. 30:14.500 --> 30:22.460 And you can see it illuminates the pixel on that line if that hex value exists. 30:22.460 --> 30:27.280 So for example, in this region here, that's the printable ASCII range. 30:27.280 --> 30:34.720 So if I hover over it, you can see that that's a B, a J, and so on. 30:34.720 --> 30:38.580 So you can see the characteristics of it. 30:38.660 --> 30:41.560 It will also do the frequency of the bytes per packet. 30:42.700 --> 30:44.020 And you can set a threshold 30:48.350 --> 30:48.770 for that. 30:48.770 --> 30:55.290 Anything above a certain threshold will be hot, so we can move the threshold down until we start finding the tipping point. 30:59.240 --> 31:02.560 It looks relative to each packet in that case. 31:02.900 --> 31:04.700 I don't pad anything. 31:08.850 --> 31:10.510 Yeah, this is very straightforward. 31:10.510 --> 31:11.690 It's kind of like an initial step. 31:11.690 --> 31:17.730 I mean, there's all sorts of entropy algorithms I could use to do all sorts of cool things with this type of view. 31:20.430 --> 31:26.850 You can see the bytes occurring in each packet, but changing with a regular consistency so you can look at the slope. 31:28.290 --> 31:31.150 So that's the byte frequency view. 31:31.410 --> 31:34.250 I think you'll find this one particularly entertaining. 31:34.250 --> 31:39.930 This is called a parallel coordinate plot, and essentially you're connecting the dots on these axes. 31:40.690 --> 31:48.070 Where I'm going with it is it's connecting the dots between every header field that's possible. 31:48.070 --> 31:48.830 That's my goal. 31:48.830 --> 31:50.770 I've got 17 fields in it now. 31:54.330 --> 31:59.690 So if I go like this, it shows the fields. 31:59.950 --> 32:00.610 Keep going. 32:02.170 --> 32:08.790 The idea, then, is you can go through one at a time and see each packet and see its values for every header field. 32:10.250 --> 32:11.850 Or you can play it. 32:13.270 --> 32:17.410 And what you see growing on the right, that's the IP identification field. 32:17.410 --> 32:20.130 You can see the distribution of packets . 32:21.110 --> 32:28.930 And the idea, then, is you can take 5,000 packets, roll them through this, and at least watch them unfold and get a feel for what happens. 32:28.930 --> 32:31.970 So you can see random activity for a given field. 32:31.970 --> 32:33.990 You can see sequential activity. 32:34.090 --> 32:38.490 You can see things that don't change, things that change a lot, and so on. 32:40.150 --> 32:43.150 I'm going for a whole model of interaction here, like a mixing board 32:52.060 --> 32:52.760 Let me open this tool. 32:52.760 --> 32:56.000 Let me show you one or two more windows and then I'll show you how to attack it. 32:56.560 --> 33:00.600 They're using it for capture the flag, too, to show the network, on occasion. 33:01.840 --> 33:03.260 So you can have some fun. 33:04.460 --> 33:06.360 This is more of a matrix view. 33:07.960 --> 33:16.080 It does have some uses other than just looking cool, but we're kind of tight for time and I don't want to blather on about it. 33:16.880 --> 33:25.420 But this is one packet per line and it's showing you the bits if the pixel is on, if there's a one on the wire. 33:25.420 --> 33:27.380 So you can see different types of packets. 33:27.660 --> 33:35.860 And you can see at a glance the length of the packet, as well as I've played around with such things as, well, show me the printable ASCII values in there. 33:35.880 --> 33:39.280 So when I do that, it greys out everything that's not printable ASCII. 33:39.420 --> 33:41.660 And this is, the blue is printable ASCII. 33:41.660 --> 33:46.600 So you can see at a glance what packets, after you've filtered things, contain printable ASCII. 33:47.260 --> 33:50.560 I've also played around with the idea of no-ops. 33:50.560 --> 33:56.040 I like the idea of disassembling code on the fly. 33:56.040 --> 34:11.220 Looking at things as if they are executables and perhaps you as an analyst, if it's color-coded by common opcodes or something, will be able to look at the flow or the packets and say, that looks like an executable going across the wire and it's not supposed to be there. 34:11.220 --> 34:15.900 Perhaps you'll see something your intrusion detection systems or anomaly detection systems won't. 34:23.650 --> 34:28.290 And the final one, and this is the final zone for networks. 34:28.870 --> 34:30.890 It's connecting the dots between any fields. 34:30.890 --> 34:49.750 I don't know if you can quite see it in the back, but it's connecting the dots and then pixels fly off and slide off the screen based on what, and this is showing source IP to destination port, TCP port, but as it happens, they fly off the screen. 34:49.750 --> 34:52.610 So you can see a variety of activities. 34:52.950 --> 34:55.390 And the way it's set up is you can compare anything to anything. 34:56.690 --> 34:58.670 You can look at combinations that might be of use to you. 34:59.250 --> 35:06.950 And if you have the different windows open, all at the same time, running lockstep, you might be able to find things you wouldn't be able to find using today's tools. 35:07.270 --> 35:08.810 So anyway, this is on your CD. 35:09.430 --> 35:14.270 I'd encourage you, and I'll give you the link to go to the website where you can download the latest version. 35:14.270 --> 35:16.110 I made a little bit of a fix. 35:16.430 --> 35:19.130 It crashes on a certain header condition. 35:20.290 --> 35:22.970 But I'll post that when I get back from DEF CON. 35:23.850 --> 35:25.230 Anyway, going back to the topic. 35:26.530 --> 35:28.290 And I thought, how can I attack it? 35:33.010 --> 35:34.930 So let's look at some basic attacks. 35:35.530 --> 35:40.890 It really doesn't take much to bring down a visualization system if you're so inclined. 35:47.050 --> 35:49.770 So I showed you what normal looked like. 35:51.650 --> 35:53.570 Something odd happened here. 35:59.010 --> 36:01.510 So let's go ahead and see what the attack looked like. 36:07.050 --> 36:09.030 Now this is only 203 packets. 36:09.030 --> 36:20.670 So if you were displaying information, looking at a data set, watching capture the flag, I'm using random IPs, and we're only at 30, and it's already becoming crowded. 36:21.650 --> 36:24.550 And look what's going on on the UDP. 36:24.550 --> 36:27.570 This is color-coded, so orange is UDP traffic. 36:27.690 --> 36:30.930 You can see that it's filling up the display pretty quickly. 36:30.930 --> 36:35.470 With only 180 packets, it's already a windshield wiper effect. 36:35.470 --> 36:38.290 Well, as it turns out, you don't need to hit every single port. 36:40.590 --> 36:41.790 You can see how it's scaled. 36:41.970 --> 36:49.370 So I only need to hit every 60th port with a packet to draw the line and create that solid effect. 36:50.950 --> 36:54.210 So let's look at another example that totally melts it down. 37:23.940 --> 37:28.660 So again, just a small amount of information can generate a lot of noise for the human. 37:34.630 --> 37:37.250 So this is 1,300 packets. 37:37.930 --> 37:39.990 This is pretty much a nuclear meltdown. 37:40.270 --> 37:43.490 Now you can change the speed as well, so I'll change the speed to max. 37:44.470 --> 37:47.250 And look what's happened on the IP address space. 37:50.010 --> 37:59.850 But you can also see what I haven't messed with, so perhaps something is constant and maybe they have a consistent time to live or something that you can grab ahold of and create a filter to counter this. 38:00.490 --> 38:07.690 So again, I tried to create the tool and then think about how it would be attacked and then how we can defend and it never ends, but I think this is worth looking at. 38:07.750 --> 38:09.430 So that's a meltdown. 38:10.510 --> 38:12.310 There are other interesting uses. 38:12.530 --> 38:14.830 Who saw the talk at Black Hat? 38:15.670 --> 38:18.130 Okay, if you saw the talk at Black Hat, don't give this away. 38:18.130 --> 38:19.670 But there are other interesting uses. 38:28.020 --> 38:29.840 So this is 600 packets. 38:33.240 --> 38:38.780 And if you look at it, say, in the parallel coordinate plot display, you can get the 600 packets. 38:38.780 --> 38:41.280 You can look and see a quick overview of what happened. 38:45.150 --> 38:45.770 Okay. 38:46.190 --> 38:48.070 And again, you can run through them. 38:48.850 --> 38:55.730 Well, it really just looks like a lot of source ports were in use, but other than that, not the same IPs were used. 38:57.930 --> 39:00.310 So let's play it again, though, with a different view. 39:04.840 --> 39:14.140 So if we look at the frequency of the packets, then, you notice odd clouds of packets, of groupings of bytes. 39:16.860 --> 39:21.960 Then if we look at it as a rainfall, remember, this is one packet per line. 39:22.280 --> 39:28.600 And the way this is, it takes each byte on the wire, maps it to a pixel, is a grayscale. 39:28.960 --> 39:34.540 So you can see the rainfall effect of the bytes on the wire is grayscale. 39:48.670 --> 39:50.810 It's have I or could you? 39:52.910 --> 39:57.230 Right now, the idea is that there's a degree of flexibility built in. 39:57.230 --> 40:00.790 The question was, how much can I change the mapping of colors? 40:08.320 --> 40:12.020 Well, the extent as it stands, there's no technical reason you couldn't do that. 40:12.020 --> 40:15.400 As far as what it's coded, I have filters built in. 40:15.400 --> 40:16.600 Right now, they're straightforward. 40:16.600 --> 40:23.280 I want to go to greater complexity, but they'll filter certain streams of TCP, UDP, ICMP. 40:23.280 --> 40:27.140 And you can change the colors by clicking on there, and that'll change it. 40:27.140 --> 40:29.940 But the degree of customizability isn't there yet. 40:30.480 --> 40:33.200 But it's certain there's no technical reason that couldn't occur. 40:39.900 --> 40:44.580 So just to wrap up, again, on your CD, you've got the talk slides. 40:44.860 --> 40:47.780 The roommate tool itself is on the CD. 40:48.660 --> 40:51.800 The malicious visualization paper is on the CD. 40:51.920 --> 40:56.060 And there's a hacker convention article I want to point you toward. 40:56.600 --> 41:02.220 Because I know some of you have difficulty explaining why it's of value to come here. 41:02.600 --> 41:03.820 Or is it just me? 41:04.620 --> 41:05.460 Right? 41:06.600 --> 41:16.740 So I was able to get into the communications of the ACM, which is like the Professional Computer Society's lead journal on why computer sciences should attend hacker conventions. 41:16.960 --> 41:20.820 So hopefully, we can change some perceptions out there. 41:20.820 --> 41:25.680 And you can wave this around in front of your husband, wife, or boss. 41:25.940 --> 41:27.380 Or parent. 41:30.100 --> 41:31.760 And that's on the CD as well. 41:35.860 --> 41:39.640 I'm looking for anyone who could give me feedback on the tool. 41:40.580 --> 41:42.220 It's at roommate.org. 41:42.220 --> 41:43.720 Again, it's there. 41:43.720 --> 41:45.200 It's on your CD as well. 41:45.500 --> 41:47.640 I'm in school, and I'm trying to graduate. 41:47.640 --> 41:49.640 So I need feedback to make it better. 41:49.920 --> 41:52.900 And right now, I've got a two-page, five-minute survey. 41:52.940 --> 42:01.580 If anybody would be kind and see Julian, I'd be permanently indebted to you if you could take five minutes of your time and fill that out. 42:01.580 --> 42:02.320 It would help. 42:02.740 --> 42:10.660 And basically, if you're an Ethereal user I'd love to see some quick questions on how can people mess with your minds if you are using that tool. 42:10.660 --> 42:11.660 Or how they happen. 42:15.420 --> 42:16.840 Lots of people to thank. 42:16.840 --> 42:20.500 I've been iterating through this in small groups. 42:20.560 --> 42:22.720 And I've gotten a lot of feedback from a lot of people. 42:22.720 --> 42:24.480 So too many to thank at one time. 42:25.840 --> 42:27.760 Finally, I wanted to end with... 42:27.760 --> 42:29.400 I've had a good experience at Georgia Tech. 42:29.400 --> 42:30.880 A very positive experience. 42:31.060 --> 42:32.100 And I've enjoyed the... 42:32.100 --> 42:36.440 They've got an undergrad and grad or master's and PhD programs in InfoSec. 42:36.460 --> 42:42.020 So if you're interested in that you can send me an email and I'd be happy to answer your questions or point you to someone who could. 42:42.200 --> 42:44.580 As well as they're looking to partner with industry. 42:44.680 --> 42:47.320 Again, this is part of my business case for coming out here. 42:48.660 --> 42:50.760 They're looking to partner with industry and government. 42:50.760 --> 42:55.920 So if you're looking to kind of like outsourced R&D, they're very much up for that. 42:56.000 --> 42:59.100 And the website or I could point you to more information. 43:03.640 --> 43:04.520 Yes. 43:10.030 --> 43:13.230 The website is outdated as of now. 43:13.250 --> 43:14.810 So I wanted to release it at Black Hat. 43:14.810 --> 43:18.550 So when I get back, the version on the CD is like 1.7 something. 43:18.550 --> 43:22.130 And I have 1.8 something that I will release as soon as I get back. 43:22.130 --> 43:23.250 It'll function. 43:23.510 --> 43:25.470 It's IP header length. 43:25.710 --> 43:28.330 If it's not 5, it'll crash. 43:29.350 --> 43:30.790 Which is 5 is the normal value. 43:30.790 --> 43:33.990 But if you get other things, then it'll crash. 43:35.490 --> 43:36.410 This is a sample file. 43:36.410 --> 43:38.670 And a key point is it doesn't load PCAP natively. 43:38.670 --> 43:41.970 So I have a little conversion tool that converts it to the file format. 43:41.970 --> 43:43.770 So the tool's on the CD. 43:43.770 --> 43:44.990 It runs on XP. 43:45.310 --> 43:49.690 And I have a sample data file on there for you to take a look at and play with. 43:54.280 --> 43:55.080 Yes. 43:59.780 --> 44:00.800 I have not. 44:00.800 --> 44:02.440 But I don't see any reason why not. 44:02.440 --> 44:10.660 I mean, I want to show like the picture of what it looked like or whatever with the PCAP file and the file format for my tool. 44:11.580 --> 44:13.120 I mean, they're not sensitive or anything. 44:13.120 --> 44:14.840 So yeah, absolutely, I want to share them. 44:15.260 --> 44:16.120 But I haven't. 44:16.200 --> 44:18.920 It's one of those things like the week I get back, I'll be working that. 44:24.390 --> 44:26.550 Well, I'd like to thank you all for coming. 44:26.550 --> 44:27.930 Julian's in the yellow shirt. 44:28.210 --> 44:37.050 If any of you could fill out the survey, if you've worked with Ethereal and always wondered how you can mess with people through it or work with Snort, I would appreciate it. 44:37.050 --> 44:38.810 And if anybody's interested, I'll be outside. 44:38.810 --> 44:39.150 Thank you.