[00:04.720 --> 00:07.380]  Wow, I'm really kind of surprised there's this many people.
[00:07.620 --> 00:09.580]  I'm going to start off with a warning for those of you who
[00:09.580 --> 00:11.980]  are thinking that you might be able to attack other people
[00:11.980 --> 00:13.400]  using what I'm going to talk about.
[00:13.400 --> 00:15.980]  I have yet to figure out a black hat method,
[00:15.980 --> 00:17.600]  a black hat use for this,
[00:17.600 --> 00:19.700]  because if you already own the IDSS,
[00:19.700 --> 00:22.240]  it's too late, you know, you can get everything,
[00:22.240 --> 00:24.160]  and I'm only looking for the good things.
[00:25.520 --> 00:27.620]  What I'm talking about is passive auditing.
[00:27.700 --> 00:29.540]  We encountered a problem where I work where
[00:29.540 --> 00:31.500]  we have so many users
[00:31.500 --> 00:33.780]  that it became really difficult to find out
[00:33.780 --> 00:35.200]  what they're doing, because nobody wanted to run
[00:35.200 --> 00:36.960]  like a client or something, so we couldn't see
[00:37.340 --> 00:39.000]  what activity they were doing, you know,
[00:39.000 --> 00:40.460]  were they patching, stuff like this.
[00:40.460 --> 00:42.340]  So we started developing signatures, actually,
[00:42.340 --> 00:43.920]  that actually kind of takes that out,
[00:43.920 --> 00:45.640]  and actually eliminates the need for us
[00:45.640 --> 00:48.320]  to actually run a client on the end users.
[00:48.500 --> 00:50.040]  And so that's what I'm going to talk about here,
[00:50.040 --> 00:51.780]  is what the signatures are, the sort of things
[00:51.780 --> 00:53.900]  you can find out in signatures,
[00:53.900 --> 00:56.200]  just by watching the network passively.
[00:57.260 --> 00:59.420]  So, of course, a brief introduction
[00:59.420 --> 01:00.960]  to why you need to audit.
[01:01.480 --> 01:03.480]  It identifies assets, so that
[01:03.480 --> 01:05.780]  when you get your alerts going through,
[01:05.780 --> 01:08.360]  you know, if there's an attack on IIS,
[01:08.360 --> 01:09.420]  do you really care if it hit an
[01:09.420 --> 01:10.520]  Apache box?
[01:11.400 --> 01:13.520]  An inventory of what you have, where you have it,
[01:13.520 --> 01:15.100]  you know, all that other good stuff.
[01:16.000 --> 01:17.480]  The state of auditing today, basically,
[01:17.480 --> 01:19.720]  it relies a lot on active scanning.
[01:19.800 --> 01:22.120]  It uses the heavy usage of clients,
[01:22.120 --> 01:23.360]  so you need to have a client on that
[01:23.360 --> 01:25.880]  end machine, you connect to that client,
[01:25.880 --> 01:27.320]  you know, it runs the scan, tells you
[01:27.320 --> 01:29.700]  what's on the box, and it's difficult
[01:29.700 --> 01:31.860]  or impossible in a decentralized environment.
[01:31.860 --> 01:33.380]  I work at a major university,
[01:33.380 --> 01:35.420]  we have about, we have
[01:35.420 --> 01:36.780]  three class B
[01:37.500 --> 01:39.260]  addresses and about a dozen
[01:39.260 --> 01:41.000]  class Cs.
[01:41.280 --> 01:43.860]  You know, it becomes really kind of difficult in that environment.
[01:44.540 --> 01:45.500]  Especially since most of them
[01:45.500 --> 01:46.600]  don't like us.
[01:48.540 --> 01:49.420]  What we're
[01:49.420 --> 01:51.420]  doing with passive auditing is we're using packets on the
[01:51.420 --> 01:53.380]  network, stuff that they're doing anyways, to find out
[01:53.380 --> 01:55.880]  what their patch levels are,
[01:55.880 --> 01:58.160]  whether they're doing antivirus
[01:58.160 --> 02:00.580]  software, whether they're updating at all,
[02:00.580 --> 02:02.180]  what OSs are doing.
[02:03.060 --> 02:04.200]  It does not affect
[02:04.200 --> 02:06.200]  end system logging, that's one of the great things about it,
[02:06.200 --> 02:07.960]  is we get a lot of complaints every time we do try
[02:07.960 --> 02:09.700]  to scan, because they complain
[02:10.140 --> 02:12.120]  ad nauseum about the amount of logs
[02:12.120 --> 02:13.980]  they get. My feeling is
[02:13.980 --> 02:15.200]  tough, but okay.
[02:16.180 --> 02:17.820]  Also, we get to take advantage of all those
[02:17.820 --> 02:20.060]  black hat scans that are coming through. When you're in a university,
[02:20.060 --> 02:21.800]  you frequently don't have firewalls,
[02:21.800 --> 02:23.800]  or you have very limited use of firewalls,
[02:23.800 --> 02:25.760]  so I can find out what ports are open
[02:25.760 --> 02:27.640]  without ever touching the box, because the traffic
[02:27.640 --> 02:30.300]  goes across my sensors. I've got it.
[02:31.140 --> 02:31.820]  It aids policy
[02:31.820 --> 02:33.840]  enforcement. Some people like policies,
[02:33.840 --> 02:35.100]  some people don't.
[02:36.080 --> 02:37.680]  Ultimately, what it comes down to is event
[02:37.680 --> 02:39.660]  correlation, and that's where it becomes a real
[02:39.660 --> 02:41.760]  pain in the ass. And when you're looking
[02:41.760 --> 02:43.700]  at that many hosts, you know, if you
[02:43.700 --> 02:45.900]  want to keep track of what their patch level is,
[02:45.900 --> 02:47.880]  that's, you know, every patch has its own
[02:47.880 --> 02:49.100]  little line in that database,
[02:49.660 --> 02:51.960]  correlated to IP address, or MAC.
[02:51.960 --> 02:54.200]  If you can get access to them, our cache,
[02:54.200 --> 02:55.360]  it's a lot easier.
[02:55.840 --> 02:58.740]  So these are things that we can monitor passively,
[02:58.740 --> 02:59.620]  OS.
[03:00.460 --> 03:01.920]  OS updates, whether
[03:01.920 --> 03:04.080]  they're getting antivirus and firewalls and spyware
[03:04.080 --> 03:06.160]  updates. Network
[03:06.160 --> 03:08.860]  services, are they using Telnet, FTP,
[03:08.860 --> 03:09.660]  whatever.
[03:10.120 --> 03:12.100]  Open ports,
[03:12.100 --> 03:13.940]  service versions, network application
[03:13.940 --> 03:16.020]  versions, that's mostly, that's more banner
[03:16.020 --> 03:18.400]  grabbing, though if you really get into it,
[03:18.400 --> 03:19.780]  there are ways of telling without
[03:19.780 --> 03:21.840]  actually grabbing banners,
[03:21.840 --> 03:23.320]  and policies.
[03:26.380 --> 03:27.940]  The downsides of this is,
[03:27.940 --> 03:29.820]  well, it's labor intensive, it takes up
[03:29.900 --> 03:31.520]  a lot of disk space, it takes a lot of time
[03:31.520 --> 03:33.860]  to build the big picture
[03:33.860 --> 03:35.800]  that you need, because you will not get it in
[03:35.800 --> 03:37.780]  the first week. In fact, you probably won't
[03:37.780 --> 03:39.860]  get it in the first couple months. You have to
[03:39.860 --> 03:41.720]  start really accumulating data before you know
[03:41.720 --> 03:42.800]  what's happening.
[03:44.080 --> 03:45.780]  It takes a lot of data.
[03:46.080 --> 03:47.780]  It requires a commitment of time and money, and that's
[03:47.780 --> 03:50.180]  not always something that works out well.
[03:50.320 --> 03:51.780]  You know, if everybody's saying, well, we need to know this
[03:51.780 --> 03:53.660]  data now, go buy a scanner.
[03:53.720 --> 03:55.360]  Hopefully you get through the firewalls.
[03:56.000 --> 03:57.760]  If you are willing to actually take the time, you'll
[03:57.760 --> 03:59.760]  get a better, you'll get a different picture
[03:59.760 --> 04:01.300]  than if you do scanning.
[04:03.140 --> 04:04.660]  It can be bypassed.
[04:04.660 --> 04:05.920]  If people manually download
[04:05.920 --> 04:07.700]  stuff to one machine, and they copy
[04:07.700 --> 04:10.260]  off that patch, I'm not going to see it.
[04:10.940 --> 04:11.900]  Though you can bypass
[04:11.900 --> 04:13.700]  all this stuff. You go back to that OS stuff, as long as they
[04:13.700 --> 04:15.980]  want to talk to the network, I can find out what they've got.
[04:16.540 --> 04:19.120]  It actually benefits from an ugly network.
[04:19.440 --> 04:20.300]  It's one of those few places
[04:20.300 --> 04:22.540]  that not having firewalls really helps.
[04:22.540 --> 04:24.280]  Because I can see so much traffic.
[04:25.020 --> 04:26.440]  So I'm going to start off with some rules.
[04:26.440 --> 04:28.700]  I wanted to jump right into the rules because I've only got 20 minutes here.
[04:28.920 --> 04:29.980]  So here's a basic
[04:30.620 --> 04:32.440]  snort rule. Try to keep these all
[04:32.440 --> 04:34.220]  nice and easy, very little
[04:34.840 --> 04:35.880]  stuff done with
[04:37.320 --> 04:38.660]  in bin hex.
[04:38.980 --> 04:40.100]  I'm sorry,
[04:40.100 --> 04:42.300]  in hex. I'm just looking at
[04:42.300 --> 04:44.380]  the strings here, with a couple exceptions.
[04:44.940 --> 04:46.220]  So this first one,
[04:46.220 --> 04:47.800]  it looks for people actually updating antivirus
[04:49.020 --> 04:49.820]  information.
[04:50.220 --> 04:52.040]  Antivirus actually and firewalls, because that's
[04:52.040 --> 04:53.600]  with the semantic corporate edition.
[04:54.180 --> 04:56.320]  You notice here, you see the user agent.
[04:56.820 --> 04:58.300]  User agents are your friend
[04:58.300 --> 05:00.520]  if you want to do this. Because they really come in handy.
[05:00.520 --> 05:02.020]  Everyone wants to advertise what they've got.
[05:02.020 --> 05:03.660]  Well, this is where you get them handy.
[05:04.040 --> 05:05.840]  So you capture on this.
[05:05.960 --> 05:08.200]  You capture on that user agent, you can capture on
[05:08.200 --> 05:10.040]  the host, because they actually, semantics
[05:10.040 --> 05:11.720]  sends everything to one place.
[05:11.720 --> 05:14.020]  Not everybody does that, so you have to watch that.
[05:14.480 --> 05:16.000]  Then right down here, that last line,
[05:16.000 --> 05:17.740]  you have the threshold, type limit,
[05:17.740 --> 05:19.500]  track. So what we're going to do is
[05:19.500 --> 05:22.300]  look at type limit, track by source.
[05:22.300 --> 05:24.060]  So each source IP address.
[05:24.340 --> 05:25.880]  Count one, so we're only looking for
[05:25.880 --> 05:27.660]  we only need one packet here, to find out
[05:27.660 --> 05:29.660]  this is working. And we only
[05:29.660 --> 05:32.140]  record this every...
[05:32.140 --> 05:33.860]  180 seconds.
[05:34.760 --> 05:35.620]  Sorry, 1800
[05:35.620 --> 05:37.600]  seconds. The reason I had to do this
[05:37.600 --> 05:39.560]  with this particular rule, is that it
[05:39.560 --> 05:41.500]  will go and do that so many times,
[05:41.500 --> 05:43.440]  for so many different things, it was filling up logs.
[05:43.440 --> 05:45.600]  All I need to know is they did it, I don't need to know how many times
[05:45.600 --> 05:47.540]  they did it. And this is
[05:47.540 --> 05:49.760]  what the traffic you get out of this is.
[05:49.880 --> 05:51.480]  You notice in that, when you get down to the
[05:51.480 --> 05:53.560]  data,
[05:53.560 --> 05:55.440]  it tells you right in that line,
[05:55.440 --> 05:57.500]  what they're updating. Semantic, antivirus,
[05:57.500 --> 05:59.280]  corporate, client,
[05:59.280 --> 06:01.480]  NT 9.0, English,
[06:01.480 --> 06:03.640]  so it's language, you know, you have everything
[06:03.640 --> 06:04.240]  there.
[06:06.340 --> 06:07.480]  So, by that
[06:07.480 --> 06:09.400]  those 20s are going to be the
[06:09.400 --> 06:11.480]  space characters, that's what they'll be using
[06:11.480 --> 06:12.100]  them.
[06:13.280 --> 06:15.460]  So, another rule. This is an
[06:15.460 --> 06:17.160]  OS update. We're looking for a specific
[06:17.160 --> 06:19.100]  Windows update here.
[06:20.420 --> 06:21.500]  I wrote a rule that just looks
[06:21.500 --> 06:23.500]  for the KB article. If you're actually really
[06:23.500 --> 06:25.320]  quick, they actually release the
[06:25.320 --> 06:27.360]  article numbers before they
[06:27.360 --> 06:29.420]  release the patches, but you have to know where to find them
[06:29.420 --> 06:31.440]  at Microsoft site. I didn't include
[06:31.440 --> 06:32.820]  that in the slide, which I should have.
[06:34.000 --> 06:35.480]  And so you can get a slight
[06:35.480 --> 06:37.500]  jump. Now, actually I really
[06:37.500 --> 06:39.900]  recommend using generic rules that will catch everything
[06:40.320 --> 06:41.920]  and post-processing.
[06:41.920 --> 06:43.520]  I'm really big on post-processing.
[06:43.520 --> 06:44.760]  It speeds up the whole process
[06:45.380 --> 06:47.560]  from a machine point. And so what we're
[06:47.560 --> 06:49.320]  looking for is, it has that string that says
[06:49.320 --> 06:51.440]  the get space, and that's a slash
[06:51.440 --> 06:53.500]  character. For some reason,
[06:53.500 --> 06:55.580]  well, this is me, I like using
[06:55.580 --> 06:56.940]  hex in those points.
[06:58.320 --> 06:59.440]  And you have a depth
[06:59.440 --> 07:01.240]  of five, so this has to be in the first five
[07:01.240 --> 07:03.620]  hex decimals, the first five
[07:03.620 --> 07:05.620]  characters coming from that host in the TCP
[07:06.680 --> 07:07.200]  field,
[07:07.680 --> 07:09.620]  level. So then you're
[07:09.620 --> 07:11.640]  looking for the knowledge base article, and you want this
[07:11.640 --> 07:13.680]  line to end off with the exe
[07:14.400 --> 07:15.640]  basically the get,
[07:15.640 --> 07:17.520]  this is the whole get string. These are
[07:17.520 --> 07:19.600]  elements out of it. One of these days I'm going to get around to
[07:19.600 --> 07:21.480]  rewriting these in PCRE so that I have
[07:21.480 --> 07:23.320]  the per compatible regular expressions
[07:23.320 --> 07:25.940]  to make the whole line a little easier to read.
[07:26.960 --> 07:27.680]  However,
[07:27.680 --> 07:29.600]  there's a penalty hit there and I haven't quite figured
[07:29.600 --> 07:31.780]  out if it's going to be something I can keep up with.
[07:33.020 --> 07:34.360]  So out of this,
[07:34.360 --> 07:35.960]  we then find out it's a Windows ME
[07:35.960 --> 07:38.080]  host, because it's right there in that string
[07:38.080 --> 07:39.700]  that it actually downloaded.
[07:39.840 --> 07:42.000]  So you say msdownload, update,
[07:42.000 --> 07:43.820]  version, capital, you get down to
[07:43.820 --> 07:46.420]  Windows ME, knowledge base article,
[07:46.420 --> 07:48.120]  and this is also an English box.
[07:48.700 --> 07:49.900]  So this is all the stuff you see
[07:49.900 --> 07:52.400]  in their files that they're downloading from Microsoft.
[07:53.280 --> 07:53.840]  Also, this
[07:53.840 --> 07:56.080]  progressive download there, that's the user agent for ME
[07:56.080 --> 07:57.820]  when you do the automatic update
[07:57.820 --> 07:58.600]  through them.
[08:00.160 --> 08:00.600]  Next
[08:00.600 --> 08:02.480]  rule, Windows malicious
[08:02.480 --> 08:04.100]  software removal tool, their new
[08:04.100 --> 08:06.300]  anti-spyware stuff.
[08:06.640 --> 08:08.380]  Again, this is a rule using similar
[08:08.960 --> 08:10.520]  functionalities to the last one.
[08:10.600 --> 08:12.480]  Right now we're going with the Windows, the Microsoft
[08:12.480 --> 08:14.440]  bits for the agent. That is the normal
[08:15.060 --> 08:15.500]  XP2000
[08:16.540 --> 08:18.280]  agent that you're going to see.
[08:18.280 --> 08:20.140]  And this is what you see here.
[08:20.600 --> 08:22.540]  You see this packet come through.
[08:23.180 --> 08:24.620]  For this one, I actually, just in case
[08:24.620 --> 08:26.420]  anybody's curious, this one was
[08:26.420 --> 08:28.840]  TCP show I used to grab these packets out.
[08:28.940 --> 08:30.700]  I've also written some scripts for just extracting
[08:30.700 --> 08:31.580]  text from
[08:32.700 --> 08:34.820]  TCP dump files, UP caps.
[08:35.180 --> 08:36.580]  So you have, you find out this is
[08:36.580 --> 08:38.080]  Windows. It doesn't really specify
[08:38.680 --> 08:40.580]  which one. Knowledge base
[08:40.580 --> 08:42.580]  article, name
[08:42.580 --> 08:44.940]  of the program and everything. Again, English.
[08:46.620 --> 08:48.840]  Now this is where it starts getting a little more fun.
[08:49.120 --> 08:50.560]  Now with Red Hat, you seem to
[08:50.560 --> 08:52.440]  see a lot of people using their automatic update,
[08:52.440 --> 08:53.800]  the up-to-date stuff.
[08:54.240 --> 08:55.980]  This one is just checking in.
[08:55.980 --> 08:58.180]  It's saying, are there any updates available?
[08:58.320 --> 08:59.340]  This really answers
[08:59.800 --> 09:01.840]  questions about OSes also.
[09:02.120 --> 09:04.060]  All of a sudden, you don't know just that it's a
[09:04.060 --> 09:06.000]  Linux box, you know it's
[09:06.000 --> 09:07.760]  Red Hat.
[09:07.760 --> 09:09.980]  So you get this whole string. The header info
[09:09.980 --> 09:11.940]  file is the one that actually says, what is
[09:11.940 --> 09:14.160]  the differences between now
[09:14.160 --> 09:15.940]  and what I have and what is available.
[09:15.940 --> 09:18.140]  So you're going to see this one anytime it checks in, whether it gets
[09:18.140 --> 09:20.020]  a download or not. So this actually
[09:20.020 --> 09:21.500]  allows you to actually map out who is
[09:21.500 --> 09:23.640]  trying to be a good network
[09:23.640 --> 09:24.380]  citizen.
[09:26.180 --> 09:27.620]  And here's what you get. But if you look
[09:27.620 --> 09:29.400]  at the get string on this one, you see the pub,
[09:29.400 --> 09:31.800]  Fedora, Linux, Core 3,
[09:31.800 --> 09:33.700]  so you know they're running Core 3.
[09:34.800 --> 09:35.140]  And
[09:35.600 --> 09:37.520]  i3, i6, so you now see, you have an idea of
[09:37.520 --> 09:38.560]  the architecture.
[09:39.300 --> 09:41.160]  Though there's a better one for that one in the next
[09:41.160 --> 09:43.460]  write-up. And you see they're using
[09:43.460 --> 09:45.560]  the Red Hat applet. Now you can actually rewrite
[09:45.560 --> 09:46.360]  these so that
[09:47.340 --> 09:49.180]  you can download and stack anything.
[09:49.180 --> 09:50.980]  You have to draw a line here.
[09:50.980 --> 09:53.100]  Where is the privacy? You don't want to actually
[09:53.100 --> 09:55.160]  be capturing everything they do.
[09:55.160 --> 09:56.900]  But you also have to say, you know,
[09:56.900 --> 09:59.400]  this is the information we need to know to protect the network.
[10:00.040 --> 10:01.160]  And that is the biggest problem we've
[10:01.160 --> 10:03.460]  had, is actually, where do you draw that line?
[10:04.680 --> 10:05.700]  Now this one,
[10:05.700 --> 10:07.000]  this is another update.
[10:07.620 --> 10:08.980]  Looking for the...
[10:10.480 --> 10:11.300]  Actually, I rewrote
[10:11.300 --> 10:13.240]  this one early this morning. I messed up.
[10:13.320 --> 10:14.980]  It's not a check-in anymore.
[10:15.040 --> 10:16.400]  You're actually looking for
[10:17.000 --> 10:18.420]  the actual downloading of the
[10:18.420 --> 10:19.160]  update.
[10:20.300 --> 10:22.260]  Well, when you get to this one...
[10:22.260 --> 10:24.720]  What happened to my slide here?
[10:25.400 --> 10:26.040]  Crap.
[10:26.700 --> 10:28.920]  Okay, well, I'll tell you what that one did download.
[10:28.960 --> 10:30.200]  It actually saw the kernel.
[10:30.460 --> 10:32.360]  And when you see the kernel goes by, you get to see
[10:32.360 --> 10:34.100]  the architecture at a different level. You get to see it as
[10:34.100 --> 10:36.840]  I-686. You get to see the language.
[10:37.140 --> 10:37.920]  You get to see
[10:37.920 --> 10:40.020]  the specific kernel version.
[10:40.200 --> 10:42.340]  So once you take this stuff out, you post-process
[10:42.340 --> 10:44.360]  it, you can actually find out a lot of stuff in
[10:44.360 --> 10:46.340]  that one kernel, in that one get
[10:46.340 --> 10:48.300]  request about the box.
[10:48.980 --> 10:50.860]  Actually, I'm going a lot faster than I thought I would.
[10:51.500 --> 10:52.420]  I should include more
[10:52.420 --> 10:53.240]  rules.
[10:55.900 --> 10:56.460]  So this
[10:56.460 --> 10:57.800]  is the check-in again.
[10:58.340 --> 11:00.480]  Okay, now this is where it gets a little more
[11:00.480 --> 11:03.240]  obscure. This top one here,
[11:03.240 --> 11:04.000]  all this pat
[11:04.000 --> 11:06.280]  and all this snort signature does
[11:06.280 --> 11:08.400]  is it catches one sin for each
[11:08.400 --> 11:09.860]  host every half hour.
[11:10.400 --> 11:12.280]  It just tapes a pdump file, a
[11:12.280 --> 11:14.260]  pcap dump of this stuff.
[11:15.080 --> 11:16.280]  I use this one actually
[11:16.280 --> 11:18.160]  to map OSes because I can
[11:18.160 --> 11:20.280]  take this, the pcap file, post
[11:20.280 --> 11:22.020]  process it through p0f
[11:22.020 --> 11:24.200]  and all of a sudden, you have a list of
[11:24.200 --> 11:25.780]  every IP address and what it's talking
[11:25.780 --> 11:27.960]  and what the OS is.
[11:28.400 --> 11:30.200]  Now there are, I have
[11:30.200 --> 11:32.180]  this every half hour. You will
[11:32.180 --> 11:34.200]  start encountering problems when you get to
[11:34.200 --> 11:36.060]  VMware or they're running
[11:36.060 --> 11:38.080]  NAT boxes. This is where that
[11:38.080 --> 11:40.400]  ARP cache comes in. Using that ARP cache,
[11:40.400 --> 11:42.420]  if you have access to the ARP table, you can say
[11:42.420 --> 11:44.160]  at this point, was it the same
[11:45.620 --> 11:46.340]  MAC address
[11:46.340 --> 11:48.040]  as the one that was there before?
[11:48.340 --> 11:50.660]  So you can say, if it's
[11:50.660 --> 11:52.900]  two different MAC addresses, it's probably two different machines.
[11:52.900 --> 11:54.340]  However, if you have the same MAC address,
[11:54.340 --> 11:56.200]  you're now looking at VMware or NATing.
[11:56.200 --> 11:58.200]  If you go over and look up the MAC address,
[11:58.200 --> 12:00.340]  you can probably tell if it links this
[12:01.640 --> 12:02.360]  little router
[12:02.360 --> 12:04.360]  or if it is actually
[12:05.460 --> 12:05.760]  a Dell
[12:06.520 --> 12:08.260]  box, in which case you know it's VMware.
[12:08.260 --> 12:10.540]  So it's actually all about collecting so much data
[12:10.540 --> 12:12.260]  that you can actually then make logical
[12:12.260 --> 12:14.340]  choices about what's happening on the
[12:14.340 --> 12:16.220]  host themselves.
[12:16.600 --> 12:17.680]  The second one
[12:18.700 --> 12:20.300]  here is the ability to
[12:20.300 --> 12:22.180]  actually map what services they're doing.
[12:22.180 --> 12:24.020]  This one actually uses banner grabbing.
[12:24.040 --> 12:26.200]  There's also some signatures for doing what versions of
[12:26.200 --> 12:27.680]  SSH they're running.
[12:28.220 --> 12:30.140]  When you actually get down to versions, that becomes really important
[12:30.140 --> 12:32.660]  because you actually can say, hey, there's a
[12:32.660 --> 12:34.600]  vulnerable version here. And you can actually
[12:34.600 --> 12:36.240]  notify people, say, you know, you need
[12:36.240 --> 12:38.240]  to fix this. You never have to scan the box.
[12:38.240 --> 12:40.360]  You just watch them doing their traffic on their
[12:40.360 --> 12:41.060]  own.
[12:42.260 --> 12:44.300]  So in that one, you're looking
[12:44.300 --> 12:46.220]  for basically the server return field from
[12:46.220 --> 12:48.300]  the server. This is one of the places where you can start
[12:48.300 --> 12:50.260]  mapping out what's happening on your
[12:50.260 --> 12:52.180]  host that aren't them doing
[12:52.180 --> 12:54.000]  things, it's people coming into them.
[12:54.620 --> 12:56.300]  So this here, we're looking at Microsoft
[12:57.280 --> 12:58.620]  IIS 5.1.
[12:58.620 --> 13:00.440]  That version actually only exists
[13:00.440 --> 13:02.360]  in XP. So you know
[13:02.360 --> 13:03.940]  that they're running XP also.
[13:04.520 --> 13:06.080]  This can be spoofed, of course,
[13:06.080 --> 13:07.740]  with Apache, you can compile it with
[13:07.740 --> 13:09.860]  any browser, with any server, you can actually
[13:09.860 --> 13:11.980]  compile this stuff in and change
[13:11.980 --> 13:14.020]  it. I say any, and
[13:14.020 --> 13:15.300]  it's actually an overstatement.
[13:15.720 --> 13:17.860]  But the idea is that the people
[13:17.860 --> 13:19.860]  who are really trying to do that stuff, these are people
[13:19.860 --> 13:21.920]  who are good admins anyways, and I'm not
[13:21.920 --> 13:24.060]  worried about them. I'm worried about the
[13:24.060 --> 13:25.980]  idiot who runs their box, you know, they
[13:25.980 --> 13:27.820]  have never patched it. They just
[13:27.820 --> 13:29.960]  put it up on the network, and five minutes
[13:29.960 --> 13:31.700]  later, you know, it's a warehouse box, and it's attacking
[13:31.700 --> 13:33.780]  30 million other hosts. That's my
[13:33.780 --> 13:35.660]  issue. I don't have a, I don't care about the person
[13:35.660 --> 13:37.940]  who's actually sitting there doing their job.
[13:38.080 --> 13:39.760]  It's all the ones that aren't doing their job that I'm trying to find
[13:39.760 --> 13:41.800]  with this. This also
[13:41.800 --> 13:43.820]  gets by, the biggest problem that we had on campus
[13:43.820 --> 13:45.560]  really was dealing with
[13:46.240 --> 13:47.680]  firewalls. Windows XP
[13:47.680 --> 13:49.700]  2, XP 2 came out, every, all
[13:49.700 --> 13:51.740]  these firewalls, all of a sudden we can't get into these boxes
[13:51.740 --> 13:53.620]  with the scanners we do have.
[13:54.240 --> 13:55.800]  If you want to write a rule that will
[13:55.800 --> 13:57.820]  allow an IP address to talk to
[13:58.220 --> 13:59.680]  a box like that, you actually end up
[13:59.680 --> 14:01.520]  writing 65,535
[14:01.520 --> 14:03.920]  TCP rules, 65,535
[14:03.920 --> 14:05.580]  UDP rules, because they don't
[14:05.580 --> 14:07.440]  actually allow you to set
[14:08.040 --> 14:09.120]  a trusted IP.
[14:09.560 --> 14:11.660]  Microsoft's firewall does not have that concept.
[14:11.660 --> 14:13.980]  It's trusted ports, trusted programs, that's it.
[14:14.800 --> 14:15.680]  This way, we don't
[14:15.680 --> 14:17.740]  have to worry about that. We actually see the patching,
[14:17.740 --> 14:19.060]  we don't have to do the vulnerabilities.
[14:19.440 --> 14:22.240]  Scanning is still great. Scanning will help you a lot.
[14:22.260 --> 14:23.720]  It will answer questions faster than
[14:23.720 --> 14:25.620]  this will. But in the long run, you get
[14:25.740 --> 14:27.860]  a different picture here. Because if you look at those
[14:28.360 --> 14:29.900]  user agent stuff, you can see, are
[14:29.900 --> 14:31.920]  they running Kazaa? Are they using
[14:32.840 --> 14:33.920]  Outlook? You can see
[14:33.920 --> 14:35.800]  all this stuff by looking at the traffic
[14:35.800 --> 14:37.840]  that comes out of this box. Things that you
[14:37.840 --> 14:39.860]  will never see. You can't tell what browser somebody
[14:39.860 --> 14:42.400]  is using by a scanner.
[14:42.860 --> 14:43.940]  Are they running a three-year-old
[14:43.940 --> 14:45.520]  version of IE?
[14:45.860 --> 14:47.840]  I got a break-in yesterday,
[14:48.260 --> 14:49.800]  two days ago,
[14:49.800 --> 14:51.960]  on campus. They were running a version of IE
[14:51.960 --> 14:54.060]  that had a flaw in it that was fixed two years
[14:54.060 --> 14:54.700]  ago.
[14:55.540 --> 14:56.720]  Now, all of a sudden, they've
[14:56.720 --> 14:58.740]  got a whole batch of extra stuff
[14:58.740 --> 15:00.480]  on their computer they didn't know about.
[15:01.420 --> 15:02.720]  This, I can tell.
[15:02.720 --> 15:04.860]  I mean, by actually watching
[15:04.860 --> 15:06.800]  the get request that comes
[15:06.800 --> 15:08.400]  out of that box.
[15:08.400 --> 15:10.660]  How they request things, because that's
[15:10.660 --> 15:12.800]  also in there. I mean, when you say
[15:12.800 --> 15:15.280]  you're going to download this,
[15:15.280 --> 15:16.980]  if I go back a couple of screens,
[15:16.980 --> 15:18.700]  that's where you... let's see...
[15:19.820 --> 15:20.660]  that user agent
[15:20.660 --> 15:22.640]  comes in. Because the user agent is
[15:23.580 --> 15:25.200]  trying... it's not required.
[15:25.200 --> 15:26.460]  You don't see this in Debian.
[15:26.620 --> 15:28.980]  When it does patching, it doesn't do this.
[15:29.480 --> 15:30.880]  Actually, I didn't include all my...
[15:30.880 --> 15:32.240]  I have a lot of signatures
[15:32.240 --> 15:34.840]  for this. I didn't include all of them, but I have
[15:34.840 --> 15:36.660]  patches for Suse,
[15:36.660 --> 15:39.700]  Debian, Mandrake,
[15:39.700 --> 15:40.720]  you know, all these things.
[15:40.720 --> 15:42.680]  These are all available out there. The information
[15:42.680 --> 15:44.660]  is available. The hardest one
[15:44.660 --> 15:47.060]  I actually had to come up with was one for Solaris.
[15:47.140 --> 15:48.800]  Because if you look at, like, Solaris 10,
[15:48.800 --> 15:50.580]  this automatic update feature, it encrypts
[15:50.580 --> 15:51.740]  the whole channel.
[15:52.740 --> 15:54.700]  However, when you look at an SSL
[15:54.700 --> 15:56.720]  certificate, when you do that key exchange
[15:56.720 --> 15:58.640]  at the beginning, and it sends what the
[15:58.640 --> 16:00.640]  certificate is, there's a place in there where it
[16:00.640 --> 16:02.820]  says who bought the license
[16:02.820 --> 16:04.620]  and what machine it goes on.
[16:04.620 --> 16:06.620]  Well, it just so happens that Sun, that machine
[16:06.620 --> 16:09.200]  is like sunupdate.
[16:09.200 --> 16:11.440]  You know, it's like solarisupdate.sun.com
[16:11.440 --> 16:12.320]  or something like that.
[16:12.320 --> 16:14.420]  So you find that string, you know what's happening.
[16:14.440 --> 16:16.760]  You know they're now being a good network citizen.
[16:17.420 --> 16:18.580]  You don't know what patches they
[16:18.580 --> 16:20.520]  grabbed. And I'm sorry that
[16:20.820 --> 16:22.520]  I haven't figured out a way to get around the SSL.
[16:22.520 --> 16:24.660]  And if anybody has any ideas, come and talk
[16:24.660 --> 16:27.140]  to me. You know, we have a lot of other things we can do with that one.
[16:28.120 --> 16:28.400]  Um...
[16:29.720 --> 16:30.620]  I won't have to go back
[16:30.620 --> 16:31.520]  to work on Monday.
[16:33.380 --> 16:34.760]  So I can't get around that one,
[16:34.760 --> 16:36.560]  but I can help, you know, give you an idea of
[16:36.560 --> 16:38.540]  who is actually helping on the network. Who's being
[16:38.540 --> 16:39.940]  good? Got a question?
[16:46.600 --> 16:47.960]  Yeah, using statistic
[16:47.960 --> 16:49.920]  analysis, you actually could do that.
[16:49.920 --> 16:51.700]  There's a program I'm going to mention at the end.
[16:51.700 --> 16:53.900]  It's a different IDS system called Bro.
[16:54.400 --> 16:55.700]  Um, it's kind of a...
[16:55.700 --> 16:58.200]  I refer to it as a bastard stepchild out of LBNL,
[16:58.200 --> 17:00.200]  but actually they love it and they use it a lot.
[17:00.200 --> 17:01.860]  It is written by Vern Paxton
[17:01.860 --> 17:03.500]  and it does some great
[17:04.080 --> 17:05.740]  anomaly detection, but it also
[17:05.740 --> 17:07.860]  keeps a connection log that says
[17:07.860 --> 17:09.520]  this IP address on this port
[17:09.520 --> 17:11.800]  talked to this IP on this port. This is how much traffic
[17:11.800 --> 17:13.860]  went by and this is what time it happened and how long
[17:13.860 --> 17:15.840]  it took. Using that, you can go
[17:15.840 --> 17:17.760]  back and do the statistical analysis and actually
[17:17.760 --> 17:20.040]  get a good idea of did they download one patch
[17:20.040 --> 17:21.800]  or did they update the whole system?
[17:26.300 --> 17:28.980]  I really didn't think I'd go through this this fast.
[17:29.640 --> 17:30.100]  Um,
[17:30.820 --> 17:32.340]  so on here. So these
[17:32.340 --> 17:34.100]  are the tools that I use for doing this. Snort.
[17:34.100 --> 17:35.620]  I'm a big snort fan.
[17:36.220 --> 17:38.260]  It's easy. You can really get
[17:38.260 --> 17:40.000]  into it and it's really, fairly powerful
[17:40.000 --> 17:42.780]  if you get into it. P0F.
[17:42.840 --> 17:43.920]  You know that OS
[17:43.920 --> 17:45.540]  fingerprinting that I do?
[17:45.540 --> 17:47.580]  Post processing through there, it helps
[17:47.740 --> 17:49.320]  a lot. Make sure you do have
[17:49.720 --> 17:51.140]  one of the latest versions because
[17:51.140 --> 17:53.540]  the one I first installed, it didn't give me
[17:53.640 --> 17:55.620]  a timestamp. It just kind of
[17:55.620 --> 17:57.920]  said relative to when I started running P0F.
[17:57.980 --> 17:59.440]  Didn't really help me identify
[17:59.440 --> 18:01.780]  when you had to go back to that ARP table to figure it out.
[18:01.780 --> 18:03.540]  You need that timestamp. So make sure you have
[18:03.540 --> 18:05.500]  the latest one. TCP dump.
[18:05.740 --> 18:07.400]  I use TCP dump for everything. I'm sure
[18:07.400 --> 18:09.260]  everybody here does. Got a question?
[18:15.680 --> 18:16.480]  Yeah?
[18:26.080 --> 18:26.780]  Actually,
[18:26.780 --> 18:28.620]  our network group on campus, they actually
[18:28.620 --> 18:30.620]  have a database that they keep of it.
[18:30.620 --> 18:32.660]  They dump the ARP cache from every switch
[18:32.660 --> 18:34.460]  and every router on campus every
[18:34.460 --> 18:36.540]  15 minutes. So we go back to
[18:36.540 --> 18:37.520]  the database.
[18:41.740 --> 18:42.920]  What was that?
[18:47.200 --> 18:48.960]  Too many years of punk concerts.
[18:48.960 --> 18:49.980]  I'm really going to...
[18:57.650 --> 18:59.250]  Do I have a suggestion?
[18:59.450 --> 19:00.910]  Unfortunately, I don't.
[19:00.910 --> 19:02.770]  It's just not something I've had to encounter yet.
[19:02.770 --> 19:04.930]  I haven't had to figure out how to do it.
[19:06.050 --> 19:06.670]  Yes.
[19:06.770 --> 19:07.290]  Okay.
[19:08.710 --> 19:10.150]  TCP show and ngrep.
[19:10.190 --> 19:12.330]  Those are tools that actually will help you
[19:12.710 --> 19:15.050]  pull out those strings. Now, actually,
[19:15.930 --> 19:16.810]  TCP show
[19:18.590 --> 19:19.250]  has one
[19:19.250 --> 19:21.610]  flaw in that it doesn't give you an accurate time.
[19:22.110 --> 19:23.030]  It actually doesn't dump
[19:23.030 --> 19:25.310]  the time in a format that I could use well.
[19:25.650 --> 19:27.010]  And ngrep does that, however,
[19:27.010 --> 19:28.910]  core dumped on large files.
[19:28.910 --> 19:30.210]  So I wrote my own.
[19:30.690 --> 19:32.770]  It really is just a simple Perl script.
[19:32.770 --> 19:35.050]  If you think about it, you pull out the Perl.
[19:35.590 --> 19:36.910]  Actually, if you wrap the...
[19:38.250 --> 19:39.090]  you do the
[19:40.190 --> 19:40.910]  minus lowercase
[19:40.910 --> 19:42.910]  x of the TCP dump, it gives you that
[19:42.910 --> 19:45.230]  whole binary. It gives you the hex, actually.
[19:45.630 --> 19:46.370]  Well, you can just
[19:46.850 --> 19:48.690]  process through it, measure out, okay,
[19:48.690 --> 19:51.230]  this is the IP header, this is the TCP header.
[19:51.230 --> 19:52.850]  Now you want the data after that.
[19:53.270 --> 19:55.190]  So, actually, on the website that I will give you,
[19:55.190 --> 19:56.770]  I have that script. It's really
[19:56.770 --> 19:58.510]  actually a very simple script.
[19:59.870 --> 20:01.090]  And so I use,
[20:01.090 --> 20:02.650]  that's where I go back to, I use TCB dump
[20:02.650 --> 20:05.010]  more than anything else, and Perl.
[20:05.010 --> 20:06.770]  Perl is great. Now I mentioned
[20:06.770 --> 20:08.770]  that bro-ids, if you are
[20:08.770 --> 20:10.350]  interested in that, it's a really great
[20:10.350 --> 20:13.390]  IDS system, awesome anomaly detection.
[20:13.790 --> 20:14.830]  Really kind of hard to
[20:14.830 --> 20:17.410]  use, though. I mean, be prepared.
[20:17.490 --> 20:18.630]  But it's bro-ids.
[20:18.630 --> 20:20.670]  bro-ids.org
[20:21.350 --> 20:23.110]  It is a really good one.
[20:23.650 --> 20:24.630]  It's just...
[20:24.630 --> 20:26.850]  And it will never file into Windows, so don't even try
[20:26.850 --> 20:28.270]  if you're running Windows.
[20:28.930 --> 20:30.070]  A lot of custom scripts.
[20:30.070 --> 20:32.910]  You really have to be able to write your own programs
[20:32.910 --> 20:34.250]  to do this stuff.
[20:34.490 --> 20:36.590]  At least for now. I'm hoping that eventually I'll get
[20:36.590 --> 20:38.470]  enough of them that I can just hand them off to people and say,
[20:38.470 --> 20:40.490]  hey, use this. But for now,
[20:40.830 --> 20:42.490]  you're going to want to write some of your own.
[20:42.490 --> 20:44.590]  I have some example scripts that I use.
[20:44.690 --> 20:46.630]  So if you want them, they'll be on the website.
[20:46.630 --> 20:49.170]  They should be on your CD, though I update all of them.
[20:49.470 --> 20:51.130]  So, go to the website.
[20:52.690 --> 20:53.890]  And a database.
[20:53.910 --> 20:55.570]  At the end of the day, you are going to need
[20:55.710 --> 20:57.070]  a database more than you're going to need
[20:57.070 --> 20:59.010]  anything else that I talk about.
[20:59.270 --> 21:01.290]  Because if you figure that
[21:01.290 --> 21:03.130]  Microsoft has released about 35
[21:04.570 --> 21:05.870]  major patches this year
[21:05.870 --> 21:06.710]  already.
[21:07.210 --> 21:08.990]  Those are the major, the MS05.
[21:09.830 --> 21:11.090]  They've already released like 35.
[21:11.090 --> 21:13.070]  And this is actually kind of a slow year for them.
[21:13.070 --> 21:15.490]  And you look at like 40,000 hosts.
[21:16.010 --> 21:17.230]  And then you look at all the
[21:17.230 --> 21:19.290]  antivirus programs. And then you look at
[21:19.290 --> 21:20.950]  all the OSs they're running.
[21:21.630 --> 21:23.110]  You need a database.
[21:23.710 --> 21:25.110]  I mean, I've been doing it actually for a while with
[21:25.110 --> 21:25.910]  NGREP.
[21:27.870 --> 21:29.190]  Sorry, not NGREP.
[21:29.370 --> 21:30.010]  FGREP.
[21:30.870 --> 21:32.870]  So I just grep out flat files.
[21:32.870 --> 21:35.270]  And we're building the database now. I had to prove that it could be done
[21:35.270 --> 21:37.150]  before they built it. And then somebody would take the time to build
[21:37.150 --> 21:38.270]  the database for me.
[21:38.950 --> 21:41.610]  So at the end of the day, though, you are going to need a database to do this.
[21:42.510 --> 21:43.410]  So, I'm going to say
[21:43.410 --> 21:44.410]  thank you for coming.
[21:44.790 --> 21:47.790]  I've got an address there. If you go to www.passiveaudit.org
[21:47.790 --> 21:49.910]  you'll see all the scripts I have, all the signatures.
[21:49.910 --> 21:51.850]  And I really would like to actually have more people writing
[21:51.850 --> 21:53.470]  signatures than just me.
[21:53.650 --> 21:56.010]  I do this at home at like 3 o'clock
[21:56.010 --> 21:57.810]  in the morning. So,
[21:57.810 --> 21:58.610]  help.
[21:59.770 --> 22:01.950]  This is how I, when I have time, I do this
[22:01.950 --> 22:03.810]  because I find it fun. I'm kind of curious, how far
[22:03.810 --> 22:05.930]  can I go? Can I actually, you know,
[22:06.570 --> 22:07.910]  I can actually find out if they've got office
[22:07.910 --> 22:09.630]  and stuff, but how much can I learn
[22:09.630 --> 22:11.550]  about the computer?
[22:11.730 --> 22:13.710]  I don't want to let anybody think that I'm actually
[22:13.710 --> 22:15.710]  trying to learn stuff about the people.
[22:15.710 --> 22:17.970]  That'd be wrong.
[22:18.210 --> 22:20.070]  At least I would on campus.
[22:20.070 --> 22:21.690]  Okay, thank you.
[22:22.110 --> 22:22.850]  Applause
[22:26.040 --> 22:28.000]  I'll be
[22:28.000 --> 22:29.600]  outside if anybody wants to get questions
[22:29.600 --> 22:31.880]  or wants to volunteer.
[22:32.700 --> 22:32.740]  Laughter
[22:40.500 --> 22:41.580]  Alright,
[22:41.580 --> 22:43.560]  thank you. We need everyone
[22:43.560 --> 22:45.800]  out those doors there.
[22:46.880 --> 22:47.620]  Laughter
[22:48.440 --> 22:49.180]  Uh...
[22:49.180 --> 22:50.020]  Silence