1
00:00:04,720 --> 00:00:07,380
Wow, I'm really kind of surprised there's this many people.

2
00:00:07,620 --> 00:00:13,400
I'm going to start off with a warning for those of you who are thinking that you might be able to attack other people using what I'm going to talk about.

3
00:00:13,400 --> 00:00:24,160
I have yet to figure out a black hat method, a black hat use for this, because if you already own the IDSS, it's too late, you know, you can get everything, and I'm only looking for the good things.

4
00:00:25,520 --> 00:00:27,620
What I'm talking about is passive auditing.

5
00:00:27,700 --> 00:00:39,720
We encountered a problem where I work where we have so many users that it became really difficult to find out what they're doing, because nobody wanted to run like a client or something, so we couldn't see what activity they were doing, you know, were they patching,

6
00:00:39,720 --> 00:00:40,460
stuff like this.

7
00:00:40,460 --> 00:00:48,320
So we started developing signatures, actually, that actually kind of takes that out, and actually eliminates the need for us to actually run a client on the end users.

8
00:00:48,500 --> 00:00:56,200
And so that's what I'm going to talk about here, is what the signatures are, the sort of things you can find out in signatures, just by watching the network passively.

9
00:00:57,260 --> 00:01:00,960
So, of course, a brief introduction to why you need to audit.

10
00:01:01,480 --> 00:01:10,520
It identifies assets, so that when you get your alerts going through, you know, if there's an attack on IIS, do you really care if it hit an Apache box?

11
00:01:11,400 --> 00:01:15,100
An inventory of what you have, where you have it, you know, all that other good stuff.

12
00:01:16,000 --> 00:01:19,720
The state of auditing today, basically, it relies a lot on active scanning.

13
00:01:19,800 --> 00:01:31,860
It uses the heavy usage of clients, so you need to have a client on that end machine, you connect to that client, you know, it runs the scan, tells you what's on the box, and it's difficult or impossible in a decentralized environment.

14
00:01:31,860 --> 00:01:41,000
I work at a major university, we have about, we have three class B addresses and about a dozen class Cs.

15
00:01:41,280 --> 00:01:43,860
You know, it becomes really kind of difficult in that environment.

16
00:01:44,540 --> 00:01:46,600
Especially since most of them don't like us.

17
00:01:48,540 --> 00:02:02,180
What we're doing with passive auditing is we're using packets on the network, stuff that they're doing anyways, to find out what their patch levels are, whether they're doing antivirus software, whether they're updating at all, what OSs are doing.

18
00:02:03,060 --> 00:02:12,900
It does not affect end system logging, that's one of the great things about it, is we get a lot of complaints every time we do try to scan, because they complain ad nauseum about the amount of logs they get.

19
00:02:13,460 --> 00:02:15,200
My feeling is tough, but okay.

20
00:02:16,180 --> 00:02:19,220
Also, we get to take advantage of all those black hat scans that are coming through.

21
00:02:19,220 --> 00:02:29,040
When you're in a university, you frequently don't have firewalls, or you have very limited use of firewalls, so I can find out what ports are open without ever touching the box, because the traffic goes across my sensors.

22
00:02:29,380 --> 00:02:30,300
I've got it.

23
00:02:31,140 --> 00:02:32,600
It aids policy enforcement.

24
00:02:33,060 --> 00:02:35,100
Some people like policies, some people don't.

25
00:02:36,080 --> 00:02:41,080
Ultimately, what it comes down to is event correlation, and that's where it becomes a real pain in the ass.

26
00:02:41,240 --> 00:02:51,960
And when you're looking at that many hosts, you know, if you want to keep track of what their patch level is, that's, you know, every patch has its own little line in that database, correlated to IP address, or MAC.

27
00:02:51,960 --> 00:02:55,360
If you can get access to them, our cache, it's a lot easier.

28
00:02:55,840 --> 00:02:59,620
So these are things that we can monitor passively, OS.

29
00:03:00,460 --> 00:03:05,380
OS updates, whether they're getting antivirus and firewalls and spyware updates.

30
00:03:05,880 --> 00:03:09,660
Network services, are they using Telnet, FTP, whatever.

31
00:03:10,120 --> 00:03:23,320
Open ports, service versions, network application versions, that's mostly, that's more banner grabbing, though if you really get into it, there are ways of telling without actually grabbing banners, and policies.

32
00:03:26,380 --> 00:03:36,900
The downsides of this is, well, it's labor intensive, it takes up a lot of disk space, it takes a lot of time to build the big picture that you need, because you will not get it in the first week.

33
00:03:36,980 --> 00:03:39,240
In fact, you probably won't get it in the first couple months.

34
00:03:39,360 --> 00:03:42,800
You have to start really accumulating data before you know what's happening.

35
00:03:44,080 --> 00:03:45,780
It takes a lot of data.

36
00:03:46,080 --> 00:03:50,180
It requires a commitment of time and money, and that's not always something that works out well.

37
00:03:50,320 --> 00:03:53,660
You know, if everybody's saying, well, we need to know this data now, go buy a scanner.

38
00:03:53,720 --> 00:03:55,360
Hopefully you get through the firewalls.

39
00:03:56,000 --> 00:04:01,300
If you are willing to actually take the time, you'll get a better, you'll get a different picture than if you do scanning.

40
00:04:03,140 --> 00:04:04,660
It can be bypassed.

41
00:04:04,660 --> 00:04:10,260
If people manually download stuff to one machine, and they copy off that patch, I'm not going to see it.

42
00:04:10,940 --> 00:04:12,440
Though you can bypass all this stuff.

43
00:04:12,440 --> 00:04:15,980
You go back to that OS stuff, as long as they want to talk to the network, I can find out what they've got.

44
00:04:16,540 --> 00:04:19,120
It actually benefits from an ugly network.

45
00:04:19,440 --> 00:04:22,540
It's one of those few places that not having firewalls really helps.

46
00:04:22,540 --> 00:04:24,280
Because I can see so much traffic.

47
00:04:25,020 --> 00:04:26,440
So I'm going to start off with some rules.

48
00:04:26,440 --> 00:04:28,700
I wanted to jump right into the rules because I've only got 20 minutes here.

49
00:04:28,920 --> 00:04:31,660
So here's a basic snort rule.

50
00:04:31,720 --> 00:04:38,660
Try to keep these all nice and easy, very little stuff done with in bin hex.

51
00:04:38,980 --> 00:04:40,960
I'm sorry, in hex.

52
00:04:41,320 --> 00:04:44,380
I'm just looking at the strings here, with a couple exceptions.

53
00:04:44,940 --> 00:04:49,820
So this first one, it looks for people actually updating antivirus information.

54
00:04:50,220 --> 00:04:53,600
Antivirus actually and firewalls, because that's with the semantic corporate edition.

55
00:04:54,180 --> 00:04:56,320
You notice here, you see the user agent.

56
00:04:56,820 --> 00:04:59,400
User agents are your friend if you want to do this.

57
00:04:59,400 --> 00:05:00,520
Because they really come in handy.

58
00:05:00,520 --> 00:05:02,020
Everyone wants to advertise what they've got.

59
00:05:02,020 --> 00:05:03,660
Well, this is where you get them handy.

60
00:05:04,040 --> 00:05:05,840
So you capture on this.

61
00:05:05,960 --> 00:05:11,720
You capture on that user agent, you can capture on the host, because they actually, semantics sends everything to one place.

62
00:05:11,720 --> 00:05:14,020
Not everybody does that, so you have to watch that.

63
00:05:14,480 --> 00:05:18,380
Then right down here, that last line, you have the threshold, type limit, track.

64
00:05:18,520 --> 00:05:22,300
So what we're going to do is look at type limit, track by source.

65
00:05:22,300 --> 00:05:24,060
So each source IP address.

66
00:05:24,340 --> 00:05:28,520
Count one, so we're only looking for we only need one packet here, to find out this is working.

67
00:05:28,680 --> 00:05:32,140
And we only record this every...

68
00:05:32,140 --> 00:05:33,860
180 seconds.

69
00:05:34,760 --> 00:05:36,560
Sorry, 1800 seconds.

70
00:05:36,640 --> 00:05:43,440
The reason I had to do this with this particular rule, is that it will go and do that so many times, for so many different things, it was filling up logs.

71
00:05:43,440 --> 00:05:46,320
All I need to know is they did it, I don't need to know how many times they did it.

72
00:05:47,080 --> 00:05:49,760
And this is what the traffic you get out of this is.

73
00:05:49,880 --> 00:05:56,140
You notice in that, when you get down to the data, it tells you right in that line, what they're updating.

74
00:05:56,220 --> 00:06:04,240
Semantic, antivirus, corporate, client, NT 9.0, English, so it's language, you know, you have everything there.

75
00:06:06,340 --> 00:06:12,100
So, by that those 20s are going to be the space characters, that's what they'll be using them.

76
00:06:13,280 --> 00:06:15,040
So, another rule.

77
00:06:15,040 --> 00:06:16,220
This is an OS update.

78
00:06:16,220 --> 00:06:19,100
We're looking for a specific Windows update here.

79
00:06:20,420 --> 00:06:22,740
I wrote a rule that just looks for the KB article.

80
00:06:22,840 --> 00:06:30,580
If you're actually really quick, they actually release the article numbers before they release the patches, but you have to know where to find them at Microsoft site.

81
00:06:30,760 --> 00:06:32,820
I didn't include that in the slide, which I should have.

82
00:06:34,000 --> 00:06:35,880
And so you can get a slight jump.

83
00:06:35,880 --> 00:06:41,920
Now, actually I really recommend using generic rules that will catch everything and post-processing.

84
00:06:41,920 --> 00:06:43,520
I'm really big on post-processing.

85
00:06:43,520 --> 00:06:46,900
It speeds up the whole process from a machine point.

86
00:06:47,160 --> 00:06:52,260
And so what we're looking for is, it has that string that says the get space, and that's a slash character.

87
00:06:52,860 --> 00:06:56,940
For some reason, well, this is me, I like using hex in those points.

88
00:06:58,320 --> 00:07:08,400
And you have a depth of five, so this has to be in the first five hex decimals, the first five characters coming from that host in the TCP field, level.

89
00:07:09,120 --> 00:07:17,160
So then you're looking for the knowledge base article, and you want this line to end off with the exe basically the get, this is the whole get string.

90
00:07:17,280 --> 00:07:18,520
These are elements out of it.

91
00:07:18,520 --> 00:07:25,940
One of these days I'm going to get around to rewriting these in PCRE so that I have the per compatible regular expressions to make the whole line a little easier to read.

92
00:07:26,960 --> 00:07:31,780
However, there's a penalty hit there and I haven't quite figured out if it's going to be something I can keep up with.

93
00:07:33,020 --> 00:07:39,700
So out of this, we then find out it's a Windows ME host, because it's right there in that string that it actually downloaded.

94
00:07:39,840 --> 00:07:48,120
So you say msdownload, update, version, capital, you get down to Windows ME, knowledge base article, and this is also an English box.

95
00:07:48,700 --> 00:07:52,400
So this is all the stuff you see in their files that they're downloading from Microsoft.

96
00:07:53,280 --> 00:07:58,600
Also, this progressive download there, that's the user agent for ME when you do the automatic update through them.

97
00:08:00,160 --> 00:08:06,300
Next rule, Windows malicious software removal tool, their new anti-spyware stuff.

98
00:08:06,640 --> 00:08:10,520
Again, this is a rule using similar functionalities to the last one.

99
00:08:10,600 --> 00:08:13,600
Right now we're going with the Windows, the Microsoft bits for the agent.

100
00:08:13,600 --> 00:08:18,280
That is the normal XP2000 agent that you're going to see.

101
00:08:18,280 --> 00:08:20,140
And this is what you see here.

102
00:08:20,600 --> 00:08:22,540
You see this packet come through.

103
00:08:23,180 --> 00:08:28,840
For this one, I actually, just in case anybody's curious, this one was TCP show I used to grab these packets out.

104
00:08:28,940 --> 00:08:34,820
I've also written some scripts for just extracting text from TCP dump files, UP caps.

105
00:08:35,180 --> 00:08:37,280
So you have, you find out this is Windows.

106
00:08:37,280 --> 00:08:39,740
It doesn't really specify which one.

107
00:08:40,000 --> 00:08:43,900
Knowledge base article, name of the program and everything.

108
00:08:43,900 --> 00:08:44,940
Again, English.

109
00:08:46,620 --> 00:08:48,840
Now this is where it starts getting a little more fun.

110
00:08:49,120 --> 00:08:53,800
Now with Red Hat, you seem to see a lot of people using their automatic update, the up-to-date stuff.

111
00:08:54,240 --> 00:08:55,980
This one is just checking in.

112
00:08:55,980 --> 00:08:58,180
It's saying, are there any updates available?

113
00:08:58,320 --> 00:09:01,840
This really answers questions about OSes also.

114
00:09:02,120 --> 00:09:06,640
All of a sudden, you don't know just that it's a Linux box, you know it's Red Hat.

115
00:09:07,540 --> 00:09:08,980
So you get this whole string.

116
00:09:08,980 --> 00:09:15,840
The header info file is the one that actually says, what is the differences between now and what I have and what is available.

117
00:09:15,840 --> 00:09:19,020
So you're going to see this one anytime it checks in, whether it gets a download or not.

118
00:09:19,060 --> 00:09:24,380
So this actually allows you to actually map out who is trying to be a good network citizen.

119
00:09:26,180 --> 00:09:27,200
And here's what you get.

120
00:09:27,200 --> 00:09:33,700
But if you look at the get string on this one, you see the pub, Fedora, Linux, Core 3, so you know they're running Core 3.

121
00:09:34,800 --> 00:09:38,560
And i3, i6, so you now see, you have an idea of the architecture.

122
00:09:39,300 --> 00:09:42,580
Though there's a better one for that one in the next write-up.

123
00:09:42,580 --> 00:09:44,640
And you see they're using the Red Hat applet.

124
00:09:44,660 --> 00:09:49,180
Now you can actually rewrite these so that you can download and stack anything.

125
00:09:49,180 --> 00:09:50,980
You have to draw a line here.

126
00:09:50,980 --> 00:09:52,260
Where is the privacy?

127
00:09:52,380 --> 00:09:55,160
You don't want to actually be capturing everything they do.

128
00:09:55,160 --> 00:09:59,400
But you also have to say, you know, this is the information we need to know to protect the network.

129
00:10:00,040 --> 00:10:03,460
And that is the biggest problem we've had, is actually, where do you draw that line?

130
00:10:04,680 --> 00:10:07,000
Now this one, this is another update.

131
00:10:07,620 --> 00:10:08,980
Looking for the...

132
00:10:10,480 --> 00:10:12,240
Actually, I rewrote this one early this morning.

133
00:10:12,240 --> 00:10:13,240
I messed up.

134
00:10:13,320 --> 00:10:14,980
It's not a check-in anymore.

135
00:10:15,040 --> 00:10:19,160
You're actually looking for the actual downloading of the update.

136
00:10:20,300 --> 00:10:22,260
Well, when you get to this one...

137
00:10:22,260 --> 00:10:24,720
What happened to my slide here?

138
00:10:25,400 --> 00:10:26,040
Crap.

139
00:10:26,700 --> 00:10:28,920
Okay, well, I'll tell you what that one did download.

140
00:10:28,960 --> 00:10:30,200
It actually saw the kernel.

141
00:10:30,460 --> 00:10:33,620
And when you see the kernel goes by, you get to see the architecture at a different level.

142
00:10:33,620 --> 00:10:35,160
You get to see it as I-686.

143
00:10:35,640 --> 00:10:36,840
You get to see the language.

144
00:10:37,140 --> 00:10:40,020
You get to see the specific kernel version.

145
00:10:40,200 --> 00:10:48,300
So once you take this stuff out, you post-process it, you can actually find out a lot of stuff in that one kernel, in that one get request about the box.

146
00:10:48,980 --> 00:10:50,860
Actually, I'm going a lot faster than I thought I would.

147
00:10:51,500 --> 00:10:53,240
I should include more rules.

148
00:10:55,900 --> 00:10:57,800
So this is the check-in again.

149
00:10:58,340 --> 00:11:01,280
Okay, now this is where it gets a little more obscure.

150
00:11:01,560 --> 00:11:09,860
This top one here, all this pat and all this snort signature does is it catches one sin for each host every half hour.

151
00:11:10,400 --> 00:11:14,260
It just tapes a pdump file, a pcap dump of this stuff.

152
00:11:15,080 --> 00:11:27,960
I use this one actually to map OSes because I can take this, the pcap file, post process it through p0f and all of a sudden, you have a list of every IP address and what it's talking and what the OS is.

153
00:11:28,400 --> 00:11:31,540
Now there are, I have this every half hour.

154
00:11:31,800 --> 00:11:37,340
You will start encountering problems when you get to VMware or they're running NAT boxes.

155
00:11:37,460 --> 00:11:39,340
This is where that ARP cache comes in.

156
00:11:39,340 --> 00:11:48,040
Using that ARP cache, if you have access to the ARP table, you can say at this point, was it the same MAC address as the one that was there before?

157
00:11:48,340 --> 00:11:52,900
So you can say, if it's two different MAC addresses, it's probably two different machines.

158
00:11:52,900 --> 00:11:56,200
However, if you have the same MAC address, you're now looking at VMware or NATing.

159
00:11:56,200 --> 00:12:08,260
If you go over and look up the MAC address, you can probably tell if it links this little router or if it is actually a Dell box, in which case you know it's VMware.

160
00:12:08,260 --> 00:12:16,220
So it's actually all about collecting so much data that you can actually then make logical choices about what's happening on the host themselves.

161
00:12:16,600 --> 00:12:22,180
The second one here is the ability to actually map what services they're doing.

162
00:12:22,180 --> 00:12:24,020
This one actually uses banner grabbing.

163
00:12:24,040 --> 00:12:27,680
There's also some signatures for doing what versions of SSH they're running.

164
00:12:28,220 --> 00:12:33,720
When you actually get down to versions, that becomes really important because you actually can say, hey, there's a vulnerable version here.

165
00:12:33,720 --> 00:12:37,080
And you can actually notify people, say, you know, you need to fix this.

166
00:12:37,080 --> 00:12:38,240
You never have to scan the box.

167
00:12:38,240 --> 00:12:41,060
You just watch them doing their traffic on their own.

168
00:12:42,260 --> 00:12:47,080
So in that one, you're looking for basically the server return field from the server.

169
00:12:47,240 --> 00:12:54,000
This is one of the places where you can start mapping out what's happening on your host that aren't them doing things, it's people coming into them.

170
00:12:54,620 --> 00:12:58,620
So this here, we're looking at Microsoft IIS 5.1.

171
00:12:58,620 --> 00:13:01,280
That version actually only exists in XP.

172
00:13:01,580 --> 00:13:03,940
So you know that they're running XP also.

173
00:13:04,520 --> 00:13:12,600
This can be spoofed, of course, with Apache, you can compile it with any browser, with any server, you can actually compile this stuff in and change it.

174
00:13:13,200 --> 00:13:15,300
I say any, and it's actually an overstatement.

175
00:13:15,720 --> 00:13:23,000
But the idea is that the people who are really trying to do that stuff, these are people who are good admins anyways, and I'm not worried about them.

176
00:13:23,000 --> 00:13:27,460
I'm worried about the idiot who runs their box, you know, they have never patched it.

177
00:13:27,460 --> 00:13:33,120
They just put it up on the network, and five minutes later, you know, it's a warehouse box, and it's attacking 30 million other hosts.

178
00:13:33,240 --> 00:13:34,160
That's my issue.

179
00:13:34,160 --> 00:13:37,940
I don't have a, I don't care about the person who's actually sitting there doing their job.

180
00:13:38,080 --> 00:13:40,520
It's all the ones that aren't doing their job that I'm trying to find with this.

181
00:13:41,180 --> 00:13:46,960
This also gets by, the biggest problem that we had on campus really was dealing with firewalls.

182
00:13:47,040 --> 00:13:53,620
Windows XP 2, XP 2 came out, every, all these firewalls, all of a sudden we can't get into these boxes with the scanners we do have.

183
00:13:54,240 --> 00:14:09,120
If you want to write a rule that will allow an IP address to talk to a box like that, you actually end up writing 65,535 TCP rules, 65,535 UDP rules, because they don't actually allow you to set a trusted IP.

184
00:14:09,560 --> 00:14:11,660
Microsoft's firewall does not have that concept.

185
00:14:11,660 --> 00:14:13,980
It's trusted ports, trusted programs, that's it.

186
00:14:14,800 --> 00:14:16,600
This way, we don't have to worry about that.

187
00:14:16,600 --> 00:14:19,060
We actually see the patching, we don't have to do the vulnerabilities.

188
00:14:19,440 --> 00:14:20,580
Scanning is still great.

189
00:14:20,580 --> 00:14:22,240
Scanning will help you a lot.

190
00:14:22,260 --> 00:14:24,560
It will answer questions faster than this will.

191
00:14:24,720 --> 00:14:26,920
But in the long run, you get a different picture here.

192
00:14:26,920 --> 00:14:31,160
Because if you look at those user agent stuff, you can see, are they running Kazaa?

193
00:14:31,180 --> 00:14:33,520
Are they using Outlook?

194
00:14:33,520 --> 00:14:37,240
You can see all this stuff by looking at the traffic that comes out of this box.

195
00:14:37,320 --> 00:14:38,520
Things that you will never see.

196
00:14:38,520 --> 00:14:42,400
You can't tell what browser somebody is using by a scanner.

197
00:14:42,860 --> 00:14:45,520
Are they running a three-year-old version of IE?

198
00:14:45,860 --> 00:14:50,700
I got a break-in yesterday, two days ago, on campus.

199
00:14:50,740 --> 00:14:54,700
They were running a version of IE that had a flaw in it that was fixed two years ago.

200
00:14:55,540 --> 00:15:00,480
Now, all of a sudden, they've got a whole batch of extra stuff on their computer they didn't know about.

201
00:15:01,420 --> 00:15:02,720
This, I can tell.

202
00:15:02,720 --> 00:15:08,400
I mean, by actually watching the get request that comes out of that box.

203
00:15:08,400 --> 00:15:11,800
How they request things, because that's also in there.

204
00:15:11,800 --> 00:15:18,700
I mean, when you say you're going to download this, if I go back a couple of screens, that's where you... let's see...

205
00:15:19,820 --> 00:15:21,500
that user agent comes in.

206
00:15:21,500 --> 00:15:25,200
Because the user agent is trying... it's not required.

207
00:15:25,200 --> 00:15:26,460
You don't see this in Debian.

208
00:15:26,620 --> 00:15:28,980
When it does patching, it doesn't do this.

209
00:15:29,480 --> 00:15:30,880
Actually, I didn't include all my...

210
00:15:30,880 --> 00:15:33,340
I have a lot of signatures for this.

211
00:15:33,340 --> 00:15:40,720
I didn't include all of them, but I have patches for Suse, Debian, Mandrake, you know, all these things.

212
00:15:40,720 --> 00:15:42,160
These are all available out there.

213
00:15:42,160 --> 00:15:43,680
The information is available.

214
00:15:43,960 --> 00:15:47,060
The hardest one I actually had to come up with was one for Solaris.

215
00:15:47,140 --> 00:15:51,740
Because if you look at, like, Solaris 10, this automatic update feature, it encrypts the whole channel.

216
00:15:52,740 --> 00:16:04,620
However, when you look at an SSL certificate, when you do that key exchange at the beginning, and it sends what the certificate is, there's a place in there where it says who bought the license and what machine it goes on.

217
00:16:04,620 --> 00:16:09,200
Well, it just so happens that Sun, that machine is like sunupdate.

218
00:16:09,200 --> 00:16:12,320
You know, it's like solarisupdate.sun.com or something like that.

219
00:16:12,320 --> 00:16:14,420
So you find that string, you know what's happening.

220
00:16:14,440 --> 00:16:16,760
You know they're now being a good network citizen.

221
00:16:17,420 --> 00:16:19,100
You don't know what patches they grabbed.

222
00:16:19,780 --> 00:16:22,520
And I'm sorry that I haven't figured out a way to get around the SSL.

223
00:16:22,520 --> 00:16:25,000
And if anybody has any ideas, come and talk to me.

224
00:16:25,000 --> 00:16:27,140
You know, we have a lot of other things we can do with that one.

225
00:16:28,120 --> 00:16:28,400
Um...

226
00:16:29,720 --> 00:16:31,520
I won't have to go back to work on Monday.

227
00:16:33,380 --> 00:16:38,280
So I can't get around that one, but I can help, you know, give you an idea of who is actually helping on the network.

228
00:16:38,280 --> 00:16:39,040
Who's being good?

229
00:16:39,160 --> 00:16:39,940
Got a question?

230
00:16:46,600 --> 00:16:49,920
Yeah, using statistic analysis, you actually could do that.

231
00:16:49,920 --> 00:16:51,700
There's a program I'm going to mention at the end.

232
00:16:51,700 --> 00:16:53,900
It's a different IDS system called Bro.

233
00:16:54,400 --> 00:16:55,700
Um, it's kind of a...

234
00:16:55,700 --> 00:17:00,200
I refer to it as a bastard stepchild out of LBNL, but actually they love it and they use it a lot.

235
00:17:00,200 --> 00:17:11,100
It is written by Vern Paxton and it does some great anomaly detection, but it also keeps a connection log that says this IP address on this port talked to this IP on this port.

236
00:17:11,100 --> 00:17:14,600
This is how much traffic went by and this is what time it happened and how long it took.

237
00:17:14,940 --> 00:17:21,800
Using that, you can go back and do the statistical analysis and actually get a good idea of did they download one patch or did they update the whole system?

238
00:17:26,300 --> 00:17:28,980
I really didn't think I'd go through this this fast.

239
00:17:29,640 --> 00:17:31,900
Um , so on here.

240
00:17:31,900 --> 00:17:33,880
So these are the tools that I use for doing this.

241
00:17:33,880 --> 00:17:34,100
Snort.

242
00:17:34,100 --> 00:17:35,620
I'm a big snort fan.

243
00:17:36,220 --> 00:17:37,320
It's easy.

244
00:17:37,460 --> 00:17:41,380
You can really get into it and it's really, fairly powerful if you get into it.

245
00:17:41,940 --> 00:17:42,780
P0F.

246
00:17:42,840 --> 00:17:45,540
You know that OS fingerprinting that I do?

247
00:17:45,540 --> 00:17:48,340
Post processing through there, it helps a lot.

248
00:17:48,340 --> 00:17:54,580
Make sure you do have one of the latest versions because the one I first installed, it didn't give me a timestamp.

249
00:17:54,840 --> 00:17:57,920
It just kind of said relative to when I started running P0F.

250
00:17:57,980 --> 00:18:01,780
Didn't really help me identify when you had to go back to that ARP table to figure it out.

251
00:18:01,780 --> 00:18:03,060
You need that timestamp.

252
00:18:03,060 --> 00:18:04,440
So make sure you have the latest one.

253
00:18:04,520 --> 00:18:05,500
TCP dump.

254
00:18:05,740 --> 00:18:07,140
I use TCP dump for everything.

255
00:18:07,140 --> 00:18:08,380
I'm sure everybody here does.

256
00:18:08,380 --> 00:18:09,260
Got a question?

257
00:18:15,680 --> 00:18:16,480
Yeah?

258
00:18:26,080 --> 00:18:30,620
Actually, our network group on campus, they actually have a database that they keep of it.

259
00:18:30,620 --> 00:18:35,700
They dump the ARP cache from every switch and every router on campus every 15 minutes.

260
00:18:35,960 --> 00:18:37,520
So we go back to the database.

261
00:18:41,740 --> 00:18:42,920
What was that?

262
00:18:47,200 --> 00:18:48,960
Too many years of punk concerts.

263
00:18:48,960 --> 00:18:49,980
I'm really going to...

264
00:18:57,650 --> 00:18:59,250
Do I have a suggestion?

265
00:18:59,450 --> 00:19:00,910
Unfortunately, I don't.

266
00:19:00,910 --> 00:19:02,770
It's just not something I've had to encounter yet.

267
00:19:02,770 --> 00:19:04,930
I haven't had to figure out how to do it.

268
00:19:06,050 --> 00:19:06,670
Yes.

269
00:19:06,770 --> 00:19:07,290
Okay.

270
00:19:08,710 --> 00:19:10,150
TCP show and ngrep.

271
00:19:10,190 --> 00:19:14,130
Those are tools that actually will help you pull out those strings.

272
00:19:14,230 --> 00:19:21,610
Now, actually, TCP show has one flaw in that it doesn't give you an accurate time.

273
00:19:22,110 --> 00:19:25,310
It actually doesn't dump the time in a format that I could use well.

274
00:19:25,650 --> 00:19:28,910
And ngrep does that, however, core dumped on large files.

275
00:19:28,910 --> 00:19:30,210
So I wrote my own.

276
00:19:30,690 --> 00:19:32,770
It really is just a simple Perl script.

277
00:19:32,770 --> 00:19:35,050
If you think about it, you pull out the Perl.

278
00:19:35,590 --> 00:19:36,910
Actually, if you wrap the...

279
00:19:38,250 --> 00:19:43,870
you do the minus lowercase x of the TCP dump, it gives you that whole binary.

280
00:19:43,870 --> 00:19:45,230
It gives you the hex, actually.

281
00:19:45,630 --> 00:19:51,230
Well, you can just process through it, measure out, okay, this is the IP header, this is the TCP header.

282
00:19:51,230 --> 00:19:52,850
Now you want the data after that.

283
00:19:53,270 --> 00:19:55,990
So, actually, on the website that I will give you, I have that script.

284
00:19:55,990 --> 00:19:58,510
It's really actually a very simple script.

285
00:19:59,870 --> 00:20:05,010
And so I use, that's where I go back to, I use TCB dump more than anything else, and Perl.

286
00:20:05,010 --> 00:20:06,070
Perl is great.

287
00:20:06,310 --> 00:20:13,390
Now I mentioned that bro-ids, if you are interested in that, it's a really great IDS system, awesome anomaly detection.

288
00:20:13,790 --> 00:20:15,870
Really kind of hard to use, though.

289
00:20:15,870 --> 00:20:17,410
I mean, be prepared.

290
00:20:17,490 --> 00:20:18,630
But it's bro-ids.

291
00:20:18,630 --> 00:20:23,110
bro-ids.org It is a really good one.

292
00:20:23,650 --> 00:20:24,630
It's just...

293
00:20:24,630 --> 00:20:28,270
And it will never file into Windows, so don't even try if you're running Windows.

294
00:20:28,930 --> 00:20:30,070
A lot of custom scripts.

295
00:20:30,070 --> 00:20:34,250
You really have to be able to write your own programs to do this stuff.

296
00:20:34,490 --> 00:20:35,530
At least for now.

297
00:20:35,530 --> 00:20:39,690
I'm hoping that eventually I'll get enough of them that I can just hand them off to people and say, hey, use this.

298
00:20:39,690 --> 00:20:42,490
But for now, you're going to want to write some of your own.

299
00:20:42,490 --> 00:20:44,590
I have some example scripts that I use.

300
00:20:44,690 --> 00:20:46,630
So if you want them, they'll be on the website.

301
00:20:46,630 --> 00:20:49,170
They should be on your CD, though I update all of them.

302
00:20:49,470 --> 00:20:51,130
So, go to the website.

303
00:20:52,690 --> 00:20:53,890
And a database.

304
00:20:53,910 --> 00:20:59,010
At the end of the day, you are going to need a database more than you're going to need anything else that I talk about.

305
00:20:59,270 --> 00:21:06,710
Because if you figure that Microsoft has released about 35 major patches this year already.

306
00:21:07,210 --> 00:21:08,990
Those are the major, the MS05.

307
00:21:09,830 --> 00:21:11,090
They've already released like 35.

308
00:21:11,090 --> 00:21:13,070
And this is actually kind of a slow year for them.

309
00:21:13,070 --> 00:21:15,490
And you look at like 40,000 hosts.

310
00:21:16,010 --> 00:21:18,710
And then you look at all the antivirus programs.

311
00:21:18,710 --> 00:21:20,950
And then you look at all the OSs they're running.

312
00:21:21,630 --> 00:21:23,110
You need a database.

313
00:21:23,710 --> 00:21:25,910
I mean, I've been doing it actually for a while with NGREP.

314
00:21:27,870 --> 00:21:29,190
Sorry, not NGREP.

315
00:21:29,370 --> 00:21:30,010
FGREP.

316
00:21:30,870 --> 00:21:32,870
So I just grep out flat files.

317
00:21:32,870 --> 00:21:34,290
And we're building the database now.

318
00:21:34,290 --> 00:21:36,090
I had to prove that it could be done before they built it.

319
00:21:36,090 --> 00:21:38,270
And then somebody would take the time to build the database for me.

320
00:21:38,950 --> 00:21:41,610
So at the end of the day, though, you are going to need a database to do this.

321
00:21:42,510 --> 00:21:44,410
So, I'm going to say thank you for coming.

322
00:21:44,790 --> 00:21:46,050
I've got an address there.

323
00:21:46,050 --> 00:21:49,910
If you go to www.passiveaudit.org you'll see all the scripts I have, all the signatures.

324
00:21:49,910 --> 00:21:53,470
And I really would like to actually have more people writing signatures than just me.

325
00:21:53,650 --> 00:21:56,930
I do this at home at like 3 o'clock in the morning.

326
00:21:57,190 --> 00:21:58,610
So, help.

327
00:21:59,770 --> 00:22:02,870
This is how I, when I have time, I do this because I find it fun.

328
00:22:02,870 --> 00:22:04,610
I'm kind of curious, how far can I go?

329
00:22:04,710 --> 00:22:11,550
Can I actually, you know, I can actually find out if they've got office and stuff, but how much can I learn about the computer?

330
00:22:11,730 --> 00:22:15,710
I don't want to let anybody think that I'm actually trying to learn stuff about the people.

331
00:22:15,710 --> 00:22:17,970
That'd be wrong.

332
00:22:18,210 --> 00:22:20,070
At least I would on campus.

333
00:22:20,070 --> 00:22:21,690
Okay, thank you.

334
00:22:22,110 --> 00:22:22,850
Applause

335
00:22:26,040 --> 00:22:31,880
I'll be outside if anybody wants to get questions or wants to volunteer.

336
00:22:32,700 --> 00:22:32,740
Laughter

337
00:22:40,500 --> 00:22:42,600
Alright, thank you.

338
00:22:42,600 --> 00:22:45,800
We need everyone out those doors there.

339
00:22:46,880 --> 00:22:49,180
Laughter Uh...

340
00:22:49,180 --> 00:22:50,020
Silence