start	end	text
4720	7380	Wow, I'm really kind of surprised there's this many people.
7620	9580	I'm going to start off with a warning for those of you who
9580	11980	are thinking that you might be able to attack other people
11980	13400	using what I'm going to talk about.
13400	15980	I have yet to figure out a black hat method,
15980	17600	a black hat use for this,
17600	19700	because if you already own the IDSS,
19700	22240	it's too late, you know, you can get everything,
22240	24160	and I'm only looking for the good things.
25520	27620	What I'm talking about is passive auditing.
27700	29540	We encountered a problem where I work where
29540	31500	we have so many users
31500	33780	that it became really difficult to find out
33780	35200	what they're doing, because nobody wanted to run
35200	36960	like a client or something, so we couldn't see
37340	39000	what activity they were doing, you know,
39000	40460	were they patching, stuff like this.
40460	42340	So we started developing signatures, actually,
42340	43920	that actually kind of takes that out,
43920	45640	and actually eliminates the need for us
45640	48320	to actually run a client on the end users.
48500	50040	And so that's what I'm going to talk about here,
50040	51780	is what the signatures are, the sort of things
51780	53900	you can find out in signatures,
53900	56200	just by watching the network passively.
57260	59420	So, of course, a brief introduction
59420	60960	to why you need to audit.
61480	63480	It identifies assets, so that
63480	65780	when you get your alerts going through,
65780	68360	you know, if there's an attack on IIS,
68360	69420	do you really care if it hit an
69420	70520	Apache box?
71400	73520	An inventory of what you have, where you have it,
73520	75100	you know, all that other good stuff.
76000	77480	The state of auditing today, basically,
77480	79720	it relies a lot on active scanning.
79800	82120	It uses the heavy usage of clients,
82120	83360	so you need to have a client on that
83360	85880	end machine, you connect to that client,
85880	87320	you know, it runs the scan, tells you
87320	89700	what's on the box, and it's difficult
89700	91860	or impossible in a decentralized environment.
91860	93380	I work at a major university,
93380	95420	we have about, we have
95420	96780	three class B
97500	99260	addresses and about a dozen
99260	101000	class Cs.
101280	103860	You know, it becomes really kind of difficult in that environment.
104540	105500	Especially since most of them
105500	106600	don't like us.
108540	109420	What we're
109420	111420	doing with passive auditing is we're using packets on the
111420	113380	network, stuff that they're doing anyways, to find out
113380	115880	what their patch levels are,
115880	118160	whether they're doing antivirus
118160	120580	software, whether they're updating at all,
120580	122180	what OSs are doing.
123060	124200	It does not affect
124200	126200	end system logging, that's one of the great things about it,
126200	127960	is we get a lot of complaints every time we do try
127960	129700	to scan, because they complain
130140	132120	ad nauseum about the amount of logs
132120	133980	they get. My feeling is
133980	135200	tough, but okay.
136180	137820	Also, we get to take advantage of all those
137820	140060	black hat scans that are coming through. When you're in a university,
140060	141800	you frequently don't have firewalls,
141800	143800	or you have very limited use of firewalls,
143800	145760	so I can find out what ports are open
145760	147640	without ever touching the box, because the traffic
147640	150300	goes across my sensors. I've got it.
151140	151820	It aids policy
151820	153840	enforcement. Some people like policies,
153840	155100	some people don't.
156080	157680	Ultimately, what it comes down to is event
157680	159660	correlation, and that's where it becomes a real
159660	161760	pain in the ass. And when you're looking
161760	163700	at that many hosts, you know, if you
163700	165900	want to keep track of what their patch level is,
165900	167880	that's, you know, every patch has its own
167880	169100	little line in that database,
169660	171960	correlated to IP address, or MAC.
171960	174200	If you can get access to them, our cache,
174200	175360	it's a lot easier.
175840	178740	So these are things that we can monitor passively,
178740	179620	OS.
180460	181920	OS updates, whether
181920	184080	they're getting antivirus and firewalls and spyware
184080	186160	updates. Network
186160	188860	services, are they using Telnet, FTP,
188860	189660	whatever.
190120	192100	Open ports,
192100	193940	service versions, network application
193940	196020	versions, that's mostly, that's more banner
196020	198400	grabbing, though if you really get into it,
198400	199780	there are ways of telling without
199780	201840	actually grabbing banners,
201840	203320	and policies.
206380	207940	The downsides of this is,
207940	209820	well, it's labor intensive, it takes up
209900	211520	a lot of disk space, it takes a lot of time
211520	213860	to build the big picture
213860	215800	that you need, because you will not get it in
215800	217780	the first week. In fact, you probably won't
217780	219860	get it in the first couple months. You have to
219860	221720	start really accumulating data before you know
221720	222800	what's happening.
224080	225780	It takes a lot of data.
226080	227780	It requires a commitment of time and money, and that's
227780	230180	not always something that works out well.
230320	231780	You know, if everybody's saying, well, we need to know this
231780	233660	data now, go buy a scanner.
233720	235360	Hopefully you get through the firewalls.
236000	237760	If you are willing to actually take the time, you'll
237760	239760	get a better, you'll get a different picture
239760	241300	than if you do scanning.
243140	244660	It can be bypassed.
244660	245920	If people manually download
245920	247700	stuff to one machine, and they copy
247700	250260	off that patch, I'm not going to see it.
250940	251900	Though you can bypass
251900	253700	all this stuff. You go back to that OS stuff, as long as they
253700	255980	want to talk to the network, I can find out what they've got.
256540	259120	It actually benefits from an ugly network.
259440	260300	It's one of those few places
260300	262540	that not having firewalls really helps.
262540	264280	Because I can see so much traffic.
265020	266440	So I'm going to start off with some rules.
266440	268700	I wanted to jump right into the rules because I've only got 20 minutes here.
268920	269980	So here's a basic
270620	272440	snort rule. Try to keep these all
272440	274220	nice and easy, very little
274840	275880	stuff done with
277320	278660	in bin hex.
278980	280100	I'm sorry,
280100	282300	in hex. I'm just looking at
282300	284380	the strings here, with a couple exceptions.
284940	286220	So this first one,
286220	287800	it looks for people actually updating antivirus
289020	289820	information.
290220	292040	Antivirus actually and firewalls, because that's
292040	293600	with the semantic corporate edition.
294180	296320	You notice here, you see the user agent.
296820	298300	User agents are your friend
298300	300520	if you want to do this. Because they really come in handy.
300520	302020	Everyone wants to advertise what they've got.
302020	303660	Well, this is where you get them handy.
304040	305840	So you capture on this.
305960	308200	You capture on that user agent, you can capture on
308200	310040	the host, because they actually, semantics
310040	311720	sends everything to one place.
311720	314020	Not everybody does that, so you have to watch that.
314480	316000	Then right down here, that last line,
316000	317740	you have the threshold, type limit,
317740	319500	track. So what we're going to do is
319500	322300	look at type limit, track by source.
322300	324060	So each source IP address.
324340	325880	Count one, so we're only looking for
325880	327660	we only need one packet here, to find out
327660	329660	this is working. And we only
329660	332140	record this every...
332140	333860	180 seconds.
334760	335620	Sorry, 1800
335620	337600	seconds. The reason I had to do this
337600	339560	with this particular rule, is that it
339560	341500	will go and do that so many times,
341500	343440	for so many different things, it was filling up logs.
343440	345600	All I need to know is they did it, I don't need to know how many times
345600	347540	they did it. And this is
347540	349760	what the traffic you get out of this is.
349880	351480	You notice in that, when you get down to the
351480	353560	data,
353560	355440	it tells you right in that line,
355440	357500	what they're updating. Semantic, antivirus,
357500	359280	corporate, client,
359280	361480	NT 9.0, English,
361480	363640	so it's language, you know, you have everything
363640	364240	there.
366340	367480	So, by that
367480	369400	those 20s are going to be the
369400	371480	space characters, that's what they'll be using
371480	372100	them.
373280	375460	So, another rule. This is an
375460	377160	OS update. We're looking for a specific
377160	379100	Windows update here.
380420	381500	I wrote a rule that just looks
381500	383500	for the KB article. If you're actually really
383500	385320	quick, they actually release the
385320	387360	article numbers before they
387360	389420	release the patches, but you have to know where to find them
389420	391440	at Microsoft site. I didn't include
391440	392820	that in the slide, which I should have.
394000	395480	And so you can get a slight
395480	397500	jump. Now, actually I really
397500	399900	recommend using generic rules that will catch everything
400320	401920	and post-processing.
401920	403520	I'm really big on post-processing.
403520	404760	It speeds up the whole process
405380	407560	from a machine point. And so what we're
407560	409320	looking for is, it has that string that says
409320	411440	the get space, and that's a slash
411440	413500	character. For some reason,
413500	415580	well, this is me, I like using
415580	416940	hex in those points.
418320	419440	And you have a depth
419440	421240	of five, so this has to be in the first five
421240	423620	hex decimals, the first five
423620	425620	characters coming from that host in the TCP
426680	427200	field,
427680	429620	level. So then you're
429620	431640	looking for the knowledge base article, and you want this
431640	433680	line to end off with the exe
434400	435640	basically the get,
435640	437520	this is the whole get string. These are
437520	439600	elements out of it. One of these days I'm going to get around to
439600	441480	rewriting these in PCRE so that I have
441480	443320	the per compatible regular expressions
443320	445940	to make the whole line a little easier to read.
446960	447680	However,
447680	449600	there's a penalty hit there and I haven't quite figured
449600	451780	out if it's going to be something I can keep up with.
453020	454360	So out of this,
454360	455960	we then find out it's a Windows ME
455960	458080	host, because it's right there in that string
458080	459700	that it actually downloaded.
459840	462000	So you say msdownload, update,
462000	463820	version, capital, you get down to
463820	466420	Windows ME, knowledge base article,
466420	468120	and this is also an English box.
468700	469900	So this is all the stuff you see
469900	472400	in their files that they're downloading from Microsoft.
473280	473840	Also, this
473840	476080	progressive download there, that's the user agent for ME
476080	477820	when you do the automatic update
477820	478600	through them.
480160	480600	Next
480600	482480	rule, Windows malicious
482480	484100	software removal tool, their new
484100	486300	anti-spyware stuff.
486640	488380	Again, this is a rule using similar
488960	490520	functionalities to the last one.
490600	492480	Right now we're going with the Windows, the Microsoft
492480	494440	bits for the agent. That is the normal
495060	495500	XP2000
496540	498280	agent that you're going to see.
498280	500140	And this is what you see here.
500600	502540	You see this packet come through.
503180	504620	For this one, I actually, just in case
504620	506420	anybody's curious, this one was
506420	508840	TCP show I used to grab these packets out.
508940	510700	I've also written some scripts for just extracting
510700	511580	text from
512700	514820	TCP dump files, UP caps.
515180	516580	So you have, you find out this is
516580	518080	Windows. It doesn't really specify
518680	520580	which one. Knowledge base
520580	522580	article, name
522580	524940	of the program and everything. Again, English.
526620	528840	Now this is where it starts getting a little more fun.
529120	530560	Now with Red Hat, you seem to
530560	532440	see a lot of people using their automatic update,
532440	533800	the up-to-date stuff.
534240	535980	This one is just checking in.
535980	538180	It's saying, are there any updates available?
538320	539340	This really answers
539800	541840	questions about OSes also.
542120	544060	All of a sudden, you don't know just that it's a
544060	546000	Linux box, you know it's
546000	547760	Red Hat.
547760	549980	So you get this whole string. The header info
549980	551940	file is the one that actually says, what is
551940	554160	the differences between now
554160	555940	and what I have and what is available.
555940	558140	So you're going to see this one anytime it checks in, whether it gets
558140	560020	a download or not. So this actually
560020	561500	allows you to actually map out who is
561500	563640	trying to be a good network
563640	564380	citizen.
566180	567620	And here's what you get. But if you look
567620	569400	at the get string on this one, you see the pub,
569400	571800	Fedora, Linux, Core 3,
571800	573700	so you know they're running Core 3.
574800	575140	And
575600	577520	i3, i6, so you now see, you have an idea of
577520	578560	the architecture.
579300	581160	Though there's a better one for that one in the next
581160	583460	write-up. And you see they're using
583460	585560	the Red Hat applet. Now you can actually rewrite
585560	586360	these so that
587340	589180	you can download and stack anything.
589180	590980	You have to draw a line here.
590980	593100	Where is the privacy? You don't want to actually
593100	595160	be capturing everything they do.
595160	596900	But you also have to say, you know,
596900	599400	this is the information we need to know to protect the network.
600040	601160	And that is the biggest problem we've
601160	603460	had, is actually, where do you draw that line?
604680	605700	Now this one,
605700	607000	this is another update.
607620	608980	Looking for the...
610480	611300	Actually, I rewrote
611300	613240	this one early this morning. I messed up.
613320	614980	It's not a check-in anymore.
615040	616400	You're actually looking for
617000	618420	the actual downloading of the
618420	619160	update.
620300	622260	Well, when you get to this one...
622260	624720	What happened to my slide here?
625400	626040	Crap.
626700	628920	Okay, well, I'll tell you what that one did download.
628960	630200	It actually saw the kernel.
630460	632360	And when you see the kernel goes by, you get to see
632360	634100	the architecture at a different level. You get to see it as
634100	636840	I-686. You get to see the language.
637140	637920	You get to see
637920	640020	the specific kernel version.
640200	642340	So once you take this stuff out, you post-process
642340	644360	it, you can actually find out a lot of stuff in
644360	646340	that one kernel, in that one get
646340	648300	request about the box.
648980	650860	Actually, I'm going a lot faster than I thought I would.
651500	652420	I should include more
652420	653240	rules.
655900	656460	So this
656460	657800	is the check-in again.
658340	660480	Okay, now this is where it gets a little more
660480	663240	obscure. This top one here,
663240	664000	all this pat
664000	666280	and all this snort signature does
666280	668400	is it catches one sin for each
668400	669860	host every half hour.
670400	672280	It just tapes a pdump file, a
672280	674260	pcap dump of this stuff.
675080	676280	I use this one actually
676280	678160	to map OSes because I can
678160	680280	take this, the pcap file, post
680280	682020	process it through p0f
682020	684200	and all of a sudden, you have a list of
684200	685780	every IP address and what it's talking
685780	687960	and what the OS is.
688400	690200	Now there are, I have
690200	692180	this every half hour. You will
692180	694200	start encountering problems when you get to
694200	696060	VMware or they're running
696060	698080	NAT boxes. This is where that
698080	700400	ARP cache comes in. Using that ARP cache,
700400	702420	if you have access to the ARP table, you can say
702420	704160	at this point, was it the same
705620	706340	MAC address
706340	708040	as the one that was there before?
708340	710660	So you can say, if it's
710660	712900	two different MAC addresses, it's probably two different machines.
712900	714340	However, if you have the same MAC address,
714340	716200	you're now looking at VMware or NATing.
716200	718200	If you go over and look up the MAC address,
718200	720340	you can probably tell if it links this
721640	722360	little router
722360	724360	or if it is actually
725460	725760	a Dell
726520	728260	box, in which case you know it's VMware.
728260	730540	So it's actually all about collecting so much data
730540	732260	that you can actually then make logical
732260	734340	choices about what's happening on the
734340	736220	host themselves.
736600	737680	The second one
738700	740300	here is the ability to
740300	742180	actually map what services they're doing.
742180	744020	This one actually uses banner grabbing.
744040	746200	There's also some signatures for doing what versions of
746200	747680	SSH they're running.
748220	750140	When you actually get down to versions, that becomes really important
750140	752660	because you actually can say, hey, there's a
752660	754600	vulnerable version here. And you can actually
754600	756240	notify people, say, you know, you need
756240	758240	to fix this. You never have to scan the box.
758240	760360	You just watch them doing their traffic on their
760360	761060	own.
762260	764300	So in that one, you're looking
764300	766220	for basically the server return field from
766220	768300	the server. This is one of the places where you can start
768300	770260	mapping out what's happening on your
770260	772180	host that aren't them doing
772180	774000	things, it's people coming into them.
774620	776300	So this here, we're looking at Microsoft
777280	778620	IIS 5.1.
778620	780440	That version actually only exists
780440	782360	in XP. So you know
782360	783940	that they're running XP also.
784520	786080	This can be spoofed, of course,
786080	787740	with Apache, you can compile it with
787740	789860	any browser, with any server, you can actually
789860	791980	compile this stuff in and change
791980	794020	it. I say any, and
794020	795300	it's actually an overstatement.
795720	797860	But the idea is that the people
797860	799860	who are really trying to do that stuff, these are people
799860	801920	who are good admins anyways, and I'm not
801920	804060	worried about them. I'm worried about the
804060	805980	idiot who runs their box, you know, they
805980	807820	have never patched it. They just
807820	809960	put it up on the network, and five minutes
809960	811700	later, you know, it's a warehouse box, and it's attacking
811700	813780	30 million other hosts. That's my
813780	815660	issue. I don't have a, I don't care about the person
815660	817940	who's actually sitting there doing their job.
818080	819760	It's all the ones that aren't doing their job that I'm trying to find
819760	821800	with this. This also
821800	823820	gets by, the biggest problem that we had on campus
823820	825560	really was dealing with
826240	827680	firewalls. Windows XP
827680	829700	2, XP 2 came out, every, all
829700	831740	these firewalls, all of a sudden we can't get into these boxes
831740	833620	with the scanners we do have.
834240	835800	If you want to write a rule that will
835800	837820	allow an IP address to talk to
838220	839680	a box like that, you actually end up
839680	841520	writing 65,535
841520	843920	TCP rules, 65,535
843920	845580	UDP rules, because they don't
845580	847440	actually allow you to set
848040	849120	a trusted IP.
849560	851660	Microsoft's firewall does not have that concept.
851660	853980	It's trusted ports, trusted programs, that's it.
854800	855680	This way, we don't
855680	857740	have to worry about that. We actually see the patching,
857740	859060	we don't have to do the vulnerabilities.
859440	862240	Scanning is still great. Scanning will help you a lot.
862260	863720	It will answer questions faster than
863720	865620	this will. But in the long run, you get
865740	867860	a different picture here. Because if you look at those
868360	869900	user agent stuff, you can see, are
869900	871920	they running Kazaa? Are they using
872840	873920	Outlook? You can see
873920	875800	all this stuff by looking at the traffic
875800	877840	that comes out of this box. Things that you
877840	879860	will never see. You can't tell what browser somebody
879860	882400	is using by a scanner.
882860	883940	Are they running a three-year-old
883940	885520	version of IE?
885860	887840	I got a break-in yesterday,
888260	889800	two days ago,
889800	891960	on campus. They were running a version of IE
891960	894060	that had a flaw in it that was fixed two years
894060	894700	ago.
895540	896720	Now, all of a sudden, they've
896720	898740	got a whole batch of extra stuff
898740	900480	on their computer they didn't know about.
901420	902720	This, I can tell.
902720	904860	I mean, by actually watching
904860	906800	the get request that comes
906800	908400	out of that box.
908400	910660	How they request things, because that's
910660	912800	also in there. I mean, when you say
912800	915280	you're going to download this,
915280	916980	if I go back a couple of screens,
916980	918700	that's where you... let's see...
919820	920660	that user agent
920660	922640	comes in. Because the user agent is
923580	925200	trying... it's not required.
925200	926460	You don't see this in Debian.
926620	928980	When it does patching, it doesn't do this.
929480	930880	Actually, I didn't include all my...
930880	932240	I have a lot of signatures
932240	934840	for this. I didn't include all of them, but I have
934840	936660	patches for Suse,
936660	939700	Debian, Mandrake,
939700	940720	you know, all these things.
940720	942680	These are all available out there. The information
942680	944660	is available. The hardest one
944660	947060	I actually had to come up with was one for Solaris.
947140	948800	Because if you look at, like, Solaris 10,
948800	950580	this automatic update feature, it encrypts
950580	951740	the whole channel.
952740	954700	However, when you look at an SSL
954700	956720	certificate, when you do that key exchange
956720	958640	at the beginning, and it sends what the
958640	960640	certificate is, there's a place in there where it
960640	962820	says who bought the license
962820	964620	and what machine it goes on.
964620	966620	Well, it just so happens that Sun, that machine
966620	969200	is like sunupdate.
969200	971440	You know, it's like solarisupdate.sun.com
971440	972320	or something like that.
972320	974420	So you find that string, you know what's happening.
974440	976760	You know they're now being a good network citizen.
977420	978580	You don't know what patches they
978580	980520	grabbed. And I'm sorry that
980820	982520	I haven't figured out a way to get around the SSL.
982520	984660	And if anybody has any ideas, come and talk
984660	987140	to me. You know, we have a lot of other things we can do with that one.
988120	988400	Um...
989720	990620	I won't have to go back
990620	991520	to work on Monday.
993380	994760	So I can't get around that one,
994760	996560	but I can help, you know, give you an idea of
996560	998540	who is actually helping on the network. Who's being
998540	999940	good? Got a question?
1006600	1007960	Yeah, using statistic
1007960	1009920	analysis, you actually could do that.
1009920	1011700	There's a program I'm going to mention at the end.
1011700	1013900	It's a different IDS system called Bro.
1014400	1015700	Um, it's kind of a...
1015700	1018200	I refer to it as a bastard stepchild out of LBNL,
1018200	1020200	but actually they love it and they use it a lot.
1020200	1021860	It is written by Vern Paxton
1021860	1023500	and it does some great
1024080	1025740	anomaly detection, but it also
1025740	1027860	keeps a connection log that says
1027860	1029520	this IP address on this port
1029520	1031800	talked to this IP on this port. This is how much traffic
1031800	1033860	went by and this is what time it happened and how long
1033860	1035840	it took. Using that, you can go
1035840	1037760	back and do the statistical analysis and actually
1037760	1040040	get a good idea of did they download one patch
1040040	1041800	or did they update the whole system?
1046300	1048980	I really didn't think I'd go through this this fast.
1049640	1050100	Um,
1050820	1052340	so on here. So these
1052340	1054100	are the tools that I use for doing this. Snort.
1054100	1055620	I'm a big snort fan.
1056220	1058260	It's easy. You can really get
1058260	1060000	into it and it's really, fairly powerful
1060000	1062780	if you get into it. P0F.
1062840	1063920	You know that OS
1063920	1065540	fingerprinting that I do?
1065540	1067580	Post processing through there, it helps
1067740	1069320	a lot. Make sure you do have
1069720	1071140	one of the latest versions because
1071140	1073540	the one I first installed, it didn't give me
1073640	1075620	a timestamp. It just kind of
1075620	1077920	said relative to when I started running P0F.
1077980	1079440	Didn't really help me identify
1079440	1081780	when you had to go back to that ARP table to figure it out.
1081780	1083540	You need that timestamp. So make sure you have
1083540	1085500	the latest one. TCP dump.
1085740	1087400	I use TCP dump for everything. I'm sure
1087400	1089260	everybody here does. Got a question?
1095680	1096480	Yeah?
1106080	1106780	Actually,
1106780	1108620	our network group on campus, they actually
1108620	1110620	have a database that they keep of it.
1110620	1112660	They dump the ARP cache from every switch
1112660	1114460	and every router on campus every
1114460	1116540	15 minutes. So we go back to
1116540	1117520	the database.
1121740	1122920	What was that?
1127200	1128960	Too many years of punk concerts.
1128960	1129980	I'm really going to...
1137650	1139250	Do I have a suggestion?
1139450	1140910	Unfortunately, I don't.
1140910	1142770	It's just not something I've had to encounter yet.
1142770	1144930	I haven't had to figure out how to do it.
1146050	1146670	Yes.
1146770	1147290	Okay.
1148710	1150150	TCP show and ngrep.
1150190	1152330	Those are tools that actually will help you
1152710	1155050	pull out those strings. Now, actually,
1155930	1156810	TCP show
1158590	1159250	has one
1159250	1161610	flaw in that it doesn't give you an accurate time.
1162110	1163030	It actually doesn't dump
1163030	1165310	the time in a format that I could use well.
1165650	1167010	And ngrep does that, however,
1167010	1168910	core dumped on large files.
1168910	1170210	So I wrote my own.
1170690	1172770	It really is just a simple Perl script.
1172770	1175050	If you think about it, you pull out the Perl.
1175590	1176910	Actually, if you wrap the...
1178250	1179090	you do the
1180190	1180910	minus lowercase
1180910	1182910	x of the TCP dump, it gives you that
1182910	1185230	whole binary. It gives you the hex, actually.
1185630	1186370	Well, you can just
1186850	1188690	process through it, measure out, okay,
1188690	1191230	this is the IP header, this is the TCP header.
1191230	1192850	Now you want the data after that.
1193270	1195190	So, actually, on the website that I will give you,
1195190	1196770	I have that script. It's really
1196770	1198510	actually a very simple script.
1199870	1201090	And so I use,
1201090	1202650	that's where I go back to, I use TCB dump
1202650	1205010	more than anything else, and Perl.
1205010	1206770	Perl is great. Now I mentioned
1206770	1208770	that bro-ids, if you are
1208770	1210350	interested in that, it's a really great
1210350	1213390	IDS system, awesome anomaly detection.
1213790	1214830	Really kind of hard to
1214830	1217410	use, though. I mean, be prepared.
1217490	1218630	But it's bro-ids.
1218630	1220670	bro-ids.org
1221350	1223110	It is a really good one.
1223650	1224630	It's just...
1224630	1226850	And it will never file into Windows, so don't even try
1226850	1228270	if you're running Windows.
1228930	1230070	A lot of custom scripts.
1230070	1232910	You really have to be able to write your own programs
1232910	1234250	to do this stuff.
1234490	1236590	At least for now. I'm hoping that eventually I'll get
1236590	1238470	enough of them that I can just hand them off to people and say,
1238470	1240490	hey, use this. But for now,
1240830	1242490	you're going to want to write some of your own.
1242490	1244590	I have some example scripts that I use.
1244690	1246630	So if you want them, they'll be on the website.
1246630	1249170	They should be on your CD, though I update all of them.
1249470	1251130	So, go to the website.
1252690	1253890	And a database.
1253910	1255570	At the end of the day, you are going to need
1255710	1257070	a database more than you're going to need
1257070	1259010	anything else that I talk about.
1259270	1261290	Because if you figure that
1261290	1263130	Microsoft has released about 35
1264570	1265870	major patches this year
1265870	1266710	already.
1267210	1268990	Those are the major, the MS05.
1269830	1271090	They've already released like 35.
1271090	1273070	And this is actually kind of a slow year for them.
1273070	1275490	And you look at like 40,000 hosts.
1276010	1277230	And then you look at all the
1277230	1279290	antivirus programs. And then you look at
1279290	1280950	all the OSs they're running.
1281630	1283110	You need a database.
1283710	1285110	I mean, I've been doing it actually for a while with
1285110	1285910	NGREP.
1287870	1289190	Sorry, not NGREP.
1289370	1290010	FGREP.
1290870	1292870	So I just grep out flat files.
1292870	1295270	And we're building the database now. I had to prove that it could be done
1295270	1297150	before they built it. And then somebody would take the time to build
1297150	1298270	the database for me.
1298950	1301610	So at the end of the day, though, you are going to need a database to do this.
1302510	1303410	So, I'm going to say
1303410	1304410	thank you for coming.
1304790	1307790	I've got an address there. If you go to www.passiveaudit.org
1307790	1309910	you'll see all the scripts I have, all the signatures.
1309910	1311850	And I really would like to actually have more people writing
1311850	1313470	signatures than just me.
1313650	1316010	I do this at home at like 3 o'clock
1316010	1317810	in the morning. So,
1317810	1318610	help.
1319770	1321950	This is how I, when I have time, I do this
1321950	1323810	because I find it fun. I'm kind of curious, how far
1323810	1325930	can I go? Can I actually, you know,
1326570	1327910	I can actually find out if they've got office
1327910	1329630	and stuff, but how much can I learn
1329630	1331550	about the computer?
1331730	1333710	I don't want to let anybody think that I'm actually
1333710	1335710	trying to learn stuff about the people.
1335710	1337970	That'd be wrong.
1338210	1340070	At least I would on campus.
1340070	1341690	Okay, thank you.
1342110	1342850	Applause
1346040	1348000	I'll be
1348000	1349600	outside if anybody wants to get questions
1349600	1351880	or wants to volunteer.
1352700	1352740	Laughter
1360500	1361580	Alright,
1361580	1363560	thank you. We need everyone
1363560	1365800	out those doors there.
1366880	1367620	Laughter
1368440	1369180	Uh...
1369180	1370020	Silence