WEBVTT 00:04.720 --> 00:07.380 Wow, I'm really kind of surprised there's this many people. 00:07.620 --> 00:13.400 I'm going to start off with a warning for those of you who are thinking that you might be able to attack other people using what I'm going to talk about. 00:13.400 --> 00:24.160 I have yet to figure out a black hat method, a black hat use for this, because if you already own the IDSS, it's too late, you know, you can get everything, and I'm only looking for the good things. 00:25.520 --> 00:27.620 What I'm talking about is passive auditing. 00:27.700 --> 00:39.720 We encountered a problem where I work where we have so many users that it became really difficult to find out what they're doing, because nobody wanted to run like a client or something, so we couldn't see what activity they were doing, you know, were they patching, 00:39.720 --> 00:40.460 stuff like this. 00:40.460 --> 00:48.320 So we started developing signatures, actually, that actually kind of takes that out, and actually eliminates the need for us to actually run a client on the end users. 00:48.500 --> 00:56.200 And so that's what I'm going to talk about here, is what the signatures are, the sort of things you can find out in signatures, just by watching the network passively. 00:57.260 --> 01:00.960 So, of course, a brief introduction to why you need to audit. 01:01.480 --> 01:10.520 It identifies assets, so that when you get your alerts going through, you know, if there's an attack on IIS, do you really care if it hit an Apache box? 01:11.400 --> 01:15.100 An inventory of what you have, where you have it, you know, all that other good stuff. 01:16.000 --> 01:19.720 The state of auditing today, basically, it relies a lot on active scanning. 01:19.800 --> 01:31.860 It uses the heavy usage of clients, so you need to have a client on that end machine, you connect to that client, you know, it runs the scan, tells you what's on the box, and it's difficult or impossible in a decentralized environment. 01:31.860 --> 01:41.000 I work at a major university, we have about, we have three class B addresses and about a dozen class Cs. 01:41.280 --> 01:43.860 You know, it becomes really kind of difficult in that environment. 01:44.540 --> 01:46.600 Especially since most of them don't like us. 01:48.540 --> 02:02.180 What we're doing with passive auditing is we're using packets on the network, stuff that they're doing anyways, to find out what their patch levels are, whether they're doing antivirus software, whether they're updating at all, what OSs are doing. 02:03.060 --> 02:12.900 It does not affect end system logging, that's one of the great things about it, is we get a lot of complaints every time we do try to scan, because they complain ad nauseum about the amount of logs they get. 02:13.460 --> 02:15.200 My feeling is tough, but okay. 02:16.180 --> 02:19.220 Also, we get to take advantage of all those black hat scans that are coming through. 02:19.220 --> 02:29.040 When you're in a university, you frequently don't have firewalls, or you have very limited use of firewalls, so I can find out what ports are open without ever touching the box, because the traffic goes across my sensors. 02:29.380 --> 02:30.300 I've got it. 02:31.140 --> 02:32.600 It aids policy enforcement. 02:33.060 --> 02:35.100 Some people like policies, some people don't. 02:36.080 --> 02:41.080 Ultimately, what it comes down to is event correlation, and that's where it becomes a real pain in the ass. 02:41.240 --> 02:51.960 And when you're looking at that many hosts, you know, if you want to keep track of what their patch level is, that's, you know, every patch has its own little line in that database, correlated to IP address, or MAC. 02:51.960 --> 02:55.360 If you can get access to them, our cache, it's a lot easier. 02:55.840 --> 02:59.620 So these are things that we can monitor passively, OS. 03:00.460 --> 03:05.380 OS updates, whether they're getting antivirus and firewalls and spyware updates. 03:05.880 --> 03:09.660 Network services, are they using Telnet, FTP, whatever. 03:10.120 --> 03:23.320 Open ports, service versions, network application versions, that's mostly, that's more banner grabbing, though if you really get into it, there are ways of telling without actually grabbing banners, and policies. 03:26.380 --> 03:36.900 The downsides of this is, well, it's labor intensive, it takes up a lot of disk space, it takes a lot of time to build the big picture that you need, because you will not get it in the first week. 03:36.980 --> 03:39.240 In fact, you probably won't get it in the first couple months. 03:39.360 --> 03:42.800 You have to start really accumulating data before you know what's happening. 03:44.080 --> 03:45.780 It takes a lot of data. 03:46.080 --> 03:50.180 It requires a commitment of time and money, and that's not always something that works out well. 03:50.320 --> 03:53.660 You know, if everybody's saying, well, we need to know this data now, go buy a scanner. 03:53.720 --> 03:55.360 Hopefully you get through the firewalls. 03:56.000 --> 04:01.300 If you are willing to actually take the time, you'll get a better, you'll get a different picture than if you do scanning. 04:03.140 --> 04:04.660 It can be bypassed. 04:04.660 --> 04:10.260 If people manually download stuff to one machine, and they copy off that patch, I'm not going to see it. 04:10.940 --> 04:12.440 Though you can bypass all this stuff. 04:12.440 --> 04:15.980 You go back to that OS stuff, as long as they want to talk to the network, I can find out what they've got. 04:16.540 --> 04:19.120 It actually benefits from an ugly network. 04:19.440 --> 04:22.540 It's one of those few places that not having firewalls really helps. 04:22.540 --> 04:24.280 Because I can see so much traffic. 04:25.020 --> 04:26.440 So I'm going to start off with some rules. 04:26.440 --> 04:28.700 I wanted to jump right into the rules because I've only got 20 minutes here. 04:28.920 --> 04:31.660 So here's a basic snort rule. 04:31.720 --> 04:38.660 Try to keep these all nice and easy, very little stuff done with in bin hex. 04:38.980 --> 04:40.960 I'm sorry, in hex. 04:41.320 --> 04:44.380 I'm just looking at the strings here, with a couple exceptions. 04:44.940 --> 04:49.820 So this first one, it looks for people actually updating antivirus information. 04:50.220 --> 04:53.600 Antivirus actually and firewalls, because that's with the semantic corporate edition. 04:54.180 --> 04:56.320 You notice here, you see the user agent. 04:56.820 --> 04:59.400 User agents are your friend if you want to do this. 04:59.400 --> 05:00.520 Because they really come in handy. 05:00.520 --> 05:02.020 Everyone wants to advertise what they've got. 05:02.020 --> 05:03.660 Well, this is where you get them handy. 05:04.040 --> 05:05.840 So you capture on this. 05:05.960 --> 05:11.720 You capture on that user agent, you can capture on the host, because they actually, semantics sends everything to one place. 05:11.720 --> 05:14.020 Not everybody does that, so you have to watch that. 05:14.480 --> 05:18.380 Then right down here, that last line, you have the threshold, type limit, track. 05:18.520 --> 05:22.300 So what we're going to do is look at type limit, track by source. 05:22.300 --> 05:24.060 So each source IP address. 05:24.340 --> 05:28.520 Count one, so we're only looking for we only need one packet here, to find out this is working. 05:28.680 --> 05:32.140 And we only record this every... 05:32.140 --> 05:33.860 180 seconds. 05:34.760 --> 05:36.560 Sorry, 1800 seconds. 05:36.640 --> 05:43.440 The reason I had to do this with this particular rule, is that it will go and do that so many times, for so many different things, it was filling up logs. 05:43.440 --> 05:46.320 All I need to know is they did it, I don't need to know how many times they did it. 05:47.080 --> 05:49.760 And this is what the traffic you get out of this is. 05:49.880 --> 05:56.140 You notice in that, when you get down to the data, it tells you right in that line, what they're updating. 05:56.220 --> 06:04.240 Semantic, antivirus, corporate, client, NT 9.0, English, so it's language, you know, you have everything there. 06:06.340 --> 06:12.100 So, by that those 20s are going to be the space characters, that's what they'll be using them. 06:13.280 --> 06:15.040 So, another rule. 06:15.040 --> 06:16.220 This is an OS update. 06:16.220 --> 06:19.100 We're looking for a specific Windows update here. 06:20.420 --> 06:22.740 I wrote a rule that just looks for the KB article. 06:22.840 --> 06:30.580 If you're actually really quick, they actually release the article numbers before they release the patches, but you have to know where to find them at Microsoft site. 06:30.760 --> 06:32.820 I didn't include that in the slide, which I should have. 06:34.000 --> 06:35.880 And so you can get a slight jump. 06:35.880 --> 06:41.920 Now, actually I really recommend using generic rules that will catch everything and post-processing. 06:41.920 --> 06:43.520 I'm really big on post-processing. 06:43.520 --> 06:46.900 It speeds up the whole process from a machine point. 06:47.160 --> 06:52.260 And so what we're looking for is, it has that string that says the get space, and that's a slash character. 06:52.860 --> 06:56.940 For some reason, well, this is me, I like using hex in those points. 06:58.320 --> 07:08.400 And you have a depth of five, so this has to be in the first five hex decimals, the first five characters coming from that host in the TCP field, level. 07:09.120 --> 07:17.160 So then you're looking for the knowledge base article, and you want this line to end off with the exe basically the get, this is the whole get string. 07:17.280 --> 07:18.520 These are elements out of it. 07:18.520 --> 07:25.940 One of these days I'm going to get around to rewriting these in PCRE so that I have the per compatible regular expressions to make the whole line a little easier to read. 07:26.960 --> 07:31.780 However, there's a penalty hit there and I haven't quite figured out if it's going to be something I can keep up with. 07:33.020 --> 07:39.700 So out of this, we then find out it's a Windows ME host, because it's right there in that string that it actually downloaded. 07:39.840 --> 07:48.120 So you say msdownload, update, version, capital, you get down to Windows ME, knowledge base article, and this is also an English box. 07:48.700 --> 07:52.400 So this is all the stuff you see in their files that they're downloading from Microsoft. 07:53.280 --> 07:58.600 Also, this progressive download there, that's the user agent for ME when you do the automatic update through them. 08:00.160 --> 08:06.300 Next rule, Windows malicious software removal tool, their new anti-spyware stuff. 08:06.640 --> 08:10.520 Again, this is a rule using similar functionalities to the last one. 08:10.600 --> 08:13.600 Right now we're going with the Windows, the Microsoft bits for the agent. 08:13.600 --> 08:18.280 That is the normal XP2000 agent that you're going to see. 08:18.280 --> 08:20.140 And this is what you see here. 08:20.600 --> 08:22.540 You see this packet come through. 08:23.180 --> 08:28.840 For this one, I actually, just in case anybody's curious, this one was TCP show I used to grab these packets out. 08:28.940 --> 08:34.820 I've also written some scripts for just extracting text from TCP dump files, UP caps. 08:35.180 --> 08:37.280 So you have, you find out this is Windows. 08:37.280 --> 08:39.740 It doesn't really specify which one. 08:40.000 --> 08:43.900 Knowledge base article, name of the program and everything. 08:43.900 --> 08:44.940 Again, English. 08:46.620 --> 08:48.840 Now this is where it starts getting a little more fun. 08:49.120 --> 08:53.800 Now with Red Hat, you seem to see a lot of people using their automatic update, the up-to-date stuff. 08:54.240 --> 08:55.980 This one is just checking in. 08:55.980 --> 08:58.180 It's saying, are there any updates available? 08:58.320 --> 09:01.840 This really answers questions about OSes also. 09:02.120 --> 09:06.640 All of a sudden, you don't know just that it's a Linux box, you know it's Red Hat. 09:07.540 --> 09:08.980 So you get this whole string. 09:08.980 --> 09:15.840 The header info file is the one that actually says, what is the differences between now and what I have and what is available. 09:15.840 --> 09:19.020 So you're going to see this one anytime it checks in, whether it gets a download or not. 09:19.060 --> 09:24.380 So this actually allows you to actually map out who is trying to be a good network citizen. 09:26.180 --> 09:27.200 And here's what you get. 09:27.200 --> 09:33.700 But if you look at the get string on this one, you see the pub, Fedora, Linux, Core 3, so you know they're running Core 3. 09:34.800 --> 09:38.560 And i3, i6, so you now see, you have an idea of the architecture. 09:39.300 --> 09:42.580 Though there's a better one for that one in the next write-up. 09:42.580 --> 09:44.640 And you see they're using the Red Hat applet. 09:44.660 --> 09:49.180 Now you can actually rewrite these so that you can download and stack anything. 09:49.180 --> 09:50.980 You have to draw a line here. 09:50.980 --> 09:52.260 Where is the privacy? 09:52.380 --> 09:55.160 You don't want to actually be capturing everything they do. 09:55.160 --> 09:59.400 But you also have to say, you know, this is the information we need to know to protect the network. 10:00.040 --> 10:03.460 And that is the biggest problem we've had, is actually, where do you draw that line? 10:04.680 --> 10:07.000 Now this one, this is another update. 10:07.620 --> 10:08.980 Looking for the... 10:10.480 --> 10:12.240 Actually, I rewrote this one early this morning. 10:12.240 --> 10:13.240 I messed up. 10:13.320 --> 10:14.980 It's not a check-in anymore. 10:15.040 --> 10:19.160 You're actually looking for the actual downloading of the update. 10:20.300 --> 10:22.260 Well, when you get to this one... 10:22.260 --> 10:24.720 What happened to my slide here? 10:25.400 --> 10:26.040 Crap. 10:26.700 --> 10:28.920 Okay, well, I'll tell you what that one did download. 10:28.960 --> 10:30.200 It actually saw the kernel. 10:30.460 --> 10:33.620 And when you see the kernel goes by, you get to see the architecture at a different level. 10:33.620 --> 10:35.160 You get to see it as I-686. 10:35.640 --> 10:36.840 You get to see the language. 10:37.140 --> 10:40.020 You get to see the specific kernel version. 10:40.200 --> 10:48.300 So once you take this stuff out, you post-process it, you can actually find out a lot of stuff in that one kernel, in that one get request about the box. 10:48.980 --> 10:50.860 Actually, I'm going a lot faster than I thought I would. 10:51.500 --> 10:53.240 I should include more rules. 10:55.900 --> 10:57.800 So this is the check-in again. 10:58.340 --> 11:01.280 Okay, now this is where it gets a little more obscure. 11:01.560 --> 11:09.860 This top one here, all this pat and all this snort signature does is it catches one sin for each host every half hour. 11:10.400 --> 11:14.260 It just tapes a pdump file, a pcap dump of this stuff. 11:15.080 --> 11:27.960 I use this one actually to map OSes because I can take this, the pcap file, post process it through p0f and all of a sudden, you have a list of every IP address and what it's talking and what the OS is. 11:28.400 --> 11:31.540 Now there are, I have this every half hour. 11:31.800 --> 11:37.340 You will start encountering problems when you get to VMware or they're running NAT boxes. 11:37.460 --> 11:39.340 This is where that ARP cache comes in. 11:39.340 --> 11:48.040 Using that ARP cache, if you have access to the ARP table, you can say at this point, was it the same MAC address as the one that was there before? 11:48.340 --> 11:52.900 So you can say, if it's two different MAC addresses, it's probably two different machines. 11:52.900 --> 11:56.200 However, if you have the same MAC address, you're now looking at VMware or NATing. 11:56.200 --> 12:08.260 If you go over and look up the MAC address, you can probably tell if it links this little router or if it is actually a Dell box, in which case you know it's VMware. 12:08.260 --> 12:16.220 So it's actually all about collecting so much data that you can actually then make logical choices about what's happening on the host themselves. 12:16.600 --> 12:22.180 The second one here is the ability to actually map what services they're doing. 12:22.180 --> 12:24.020 This one actually uses banner grabbing. 12:24.040 --> 12:27.680 There's also some signatures for doing what versions of SSH they're running. 12:28.220 --> 12:33.720 When you actually get down to versions, that becomes really important because you actually can say, hey, there's a vulnerable version here. 12:33.720 --> 12:37.080 And you can actually notify people, say, you know, you need to fix this. 12:37.080 --> 12:38.240 You never have to scan the box. 12:38.240 --> 12:41.060 You just watch them doing their traffic on their own. 12:42.260 --> 12:47.080 So in that one, you're looking for basically the server return field from the server. 12:47.240 --> 12:54.000 This is one of the places where you can start mapping out what's happening on your host that aren't them doing things, it's people coming into them. 12:54.620 --> 12:58.620 So this here, we're looking at Microsoft IIS 5.1. 12:58.620 --> 13:01.280 That version actually only exists in XP. 13:01.580 --> 13:03.940 So you know that they're running XP also. 13:04.520 --> 13:12.600 This can be spoofed, of course, with Apache, you can compile it with any browser, with any server, you can actually compile this stuff in and change it. 13:13.200 --> 13:15.300 I say any, and it's actually an overstatement. 13:15.720 --> 13:23.000 But the idea is that the people who are really trying to do that stuff, these are people who are good admins anyways, and I'm not worried about them. 13:23.000 --> 13:27.460 I'm worried about the idiot who runs their box, you know, they have never patched it. 13:27.460 --> 13:33.120 They just put it up on the network, and five minutes later, you know, it's a warehouse box, and it's attacking 30 million other hosts. 13:33.240 --> 13:34.160 That's my issue. 13:34.160 --> 13:37.940 I don't have a, I don't care about the person who's actually sitting there doing their job. 13:38.080 --> 13:40.520 It's all the ones that aren't doing their job that I'm trying to find with this. 13:41.180 --> 13:46.960 This also gets by, the biggest problem that we had on campus really was dealing with firewalls. 13:47.040 --> 13:53.620 Windows XP 2, XP 2 came out, every, all these firewalls, all of a sudden we can't get into these boxes with the scanners we do have. 13:54.240 --> 14:09.120 If you want to write a rule that will allow an IP address to talk to a box like that, you actually end up writing 65,535 TCP rules, 65,535 UDP rules, because they don't actually allow you to set a trusted IP. 14:09.560 --> 14:11.660 Microsoft's firewall does not have that concept. 14:11.660 --> 14:13.980 It's trusted ports, trusted programs, that's it. 14:14.800 --> 14:16.600 This way, we don't have to worry about that. 14:16.600 --> 14:19.060 We actually see the patching, we don't have to do the vulnerabilities. 14:19.440 --> 14:20.580 Scanning is still great. 14:20.580 --> 14:22.240 Scanning will help you a lot. 14:22.260 --> 14:24.560 It will answer questions faster than this will. 14:24.720 --> 14:26.920 But in the long run, you get a different picture here. 14:26.920 --> 14:31.160 Because if you look at those user agent stuff, you can see, are they running Kazaa? 14:31.180 --> 14:33.520 Are they using Outlook? 14:33.520 --> 14:37.240 You can see all this stuff by looking at the traffic that comes out of this box. 14:37.320 --> 14:38.520 Things that you will never see. 14:38.520 --> 14:42.400 You can't tell what browser somebody is using by a scanner. 14:42.860 --> 14:45.520 Are they running a three-year-old version of IE? 14:45.860 --> 14:50.700 I got a break-in yesterday, two days ago, on campus. 14:50.740 --> 14:54.700 They were running a version of IE that had a flaw in it that was fixed two years ago. 14:55.540 --> 15:00.480 Now, all of a sudden, they've got a whole batch of extra stuff on their computer they didn't know about. 15:01.420 --> 15:02.720 This, I can tell. 15:02.720 --> 15:08.400 I mean, by actually watching the get request that comes out of that box. 15:08.400 --> 15:11.800 How they request things, because that's also in there. 15:11.800 --> 15:18.700 I mean, when you say you're going to download this, if I go back a couple of screens, that's where you... let's see... 15:19.820 --> 15:21.500 that user agent comes in. 15:21.500 --> 15:25.200 Because the user agent is trying... it's not required. 15:25.200 --> 15:26.460 You don't see this in Debian. 15:26.620 --> 15:28.980 When it does patching, it doesn't do this. 15:29.480 --> 15:30.880 Actually, I didn't include all my... 15:30.880 --> 15:33.340 I have a lot of signatures for this. 15:33.340 --> 15:40.720 I didn't include all of them, but I have patches for Suse, Debian, Mandrake, you know, all these things. 15:40.720 --> 15:42.160 These are all available out there. 15:42.160 --> 15:43.680 The information is available. 15:43.960 --> 15:47.060 The hardest one I actually had to come up with was one for Solaris. 15:47.140 --> 15:51.740 Because if you look at, like, Solaris 10, this automatic update feature, it encrypts the whole channel. 15:52.740 --> 16:04.620 However, when you look at an SSL certificate, when you do that key exchange at the beginning, and it sends what the certificate is, there's a place in there where it says who bought the license and what machine it goes on. 16:04.620 --> 16:09.200 Well, it just so happens that Sun, that machine is like sunupdate. 16:09.200 --> 16:12.320 You know, it's like solarisupdate.sun.com or something like that. 16:12.320 --> 16:14.420 So you find that string, you know what's happening. 16:14.440 --> 16:16.760 You know they're now being a good network citizen. 16:17.420 --> 16:19.100 You don't know what patches they grabbed. 16:19.780 --> 16:22.520 And I'm sorry that I haven't figured out a way to get around the SSL. 16:22.520 --> 16:25.000 And if anybody has any ideas, come and talk to me. 16:25.000 --> 16:27.140 You know, we have a lot of other things we can do with that one. 16:28.120 --> 16:28.400 Um... 16:29.720 --> 16:31.520 I won't have to go back to work on Monday. 16:33.380 --> 16:38.280 So I can't get around that one, but I can help, you know, give you an idea of who is actually helping on the network. 16:38.280 --> 16:39.040 Who's being good? 16:39.160 --> 16:39.940 Got a question? 16:46.600 --> 16:49.920 Yeah, using statistic analysis, you actually could do that. 16:49.920 --> 16:51.700 There's a program I'm going to mention at the end. 16:51.700 --> 16:53.900 It's a different IDS system called Bro. 16:54.400 --> 16:55.700 Um, it's kind of a... 16:55.700 --> 17:00.200 I refer to it as a bastard stepchild out of LBNL, but actually they love it and they use it a lot. 17:00.200 --> 17:11.100 It is written by Vern Paxton and it does some great anomaly detection, but it also keeps a connection log that says this IP address on this port talked to this IP on this port. 17:11.100 --> 17:14.600 This is how much traffic went by and this is what time it happened and how long it took. 17:14.940 --> 17:21.800 Using that, you can go back and do the statistical analysis and actually get a good idea of did they download one patch or did they update the whole system? 17:26.300 --> 17:28.980 I really didn't think I'd go through this this fast. 17:29.640 --> 17:31.900 Um , so on here. 17:31.900 --> 17:33.880 So these are the tools that I use for doing this. 17:33.880 --> 17:34.100 Snort. 17:34.100 --> 17:35.620 I'm a big snort fan. 17:36.220 --> 17:37.320 It's easy. 17:37.460 --> 17:41.380 You can really get into it and it's really, fairly powerful if you get into it. 17:41.940 --> 17:42.780 P0F. 17:42.840 --> 17:45.540 You know that OS fingerprinting that I do? 17:45.540 --> 17:48.340 Post processing through there, it helps a lot. 17:48.340 --> 17:54.580 Make sure you do have one of the latest versions because the one I first installed, it didn't give me a timestamp. 17:54.840 --> 17:57.920 It just kind of said relative to when I started running P0F. 17:57.980 --> 18:01.780 Didn't really help me identify when you had to go back to that ARP table to figure it out. 18:01.780 --> 18:03.060 You need that timestamp. 18:03.060 --> 18:04.440 So make sure you have the latest one. 18:04.520 --> 18:05.500 TCP dump. 18:05.740 --> 18:07.140 I use TCP dump for everything. 18:07.140 --> 18:08.380 I'm sure everybody here does. 18:08.380 --> 18:09.260 Got a question? 18:15.680 --> 18:16.480 Yeah? 18:26.080 --> 18:30.620 Actually, our network group on campus, they actually have a database that they keep of it. 18:30.620 --> 18:35.700 They dump the ARP cache from every switch and every router on campus every 15 minutes. 18:35.960 --> 18:37.520 So we go back to the database. 18:41.740 --> 18:42.920 What was that? 18:47.200 --> 18:48.960 Too many years of punk concerts. 18:48.960 --> 18:49.980 I'm really going to... 18:57.650 --> 18:59.250 Do I have a suggestion? 18:59.450 --> 19:00.910 Unfortunately, I don't. 19:00.910 --> 19:02.770 It's just not something I've had to encounter yet. 19:02.770 --> 19:04.930 I haven't had to figure out how to do it. 19:06.050 --> 19:06.670 Yes. 19:06.770 --> 19:07.290 Okay. 19:08.710 --> 19:10.150 TCP show and ngrep. 19:10.190 --> 19:14.130 Those are tools that actually will help you pull out those strings. 19:14.230 --> 19:21.610 Now, actually, TCP show has one flaw in that it doesn't give you an accurate time. 19:22.110 --> 19:25.310 It actually doesn't dump the time in a format that I could use well. 19:25.650 --> 19:28.910 And ngrep does that, however, core dumped on large files. 19:28.910 --> 19:30.210 So I wrote my own. 19:30.690 --> 19:32.770 It really is just a simple Perl script. 19:32.770 --> 19:35.050 If you think about it, you pull out the Perl. 19:35.590 --> 19:36.910 Actually, if you wrap the... 19:38.250 --> 19:43.870 you do the minus lowercase x of the TCP dump, it gives you that whole binary. 19:43.870 --> 19:45.230 It gives you the hex, actually. 19:45.630 --> 19:51.230 Well, you can just process through it, measure out, okay, this is the IP header, this is the TCP header. 19:51.230 --> 19:52.850 Now you want the data after that. 19:53.270 --> 19:55.990 So, actually, on the website that I will give you, I have that script. 19:55.990 --> 19:58.510 It's really actually a very simple script. 19:59.870 --> 20:05.010 And so I use, that's where I go back to, I use TCB dump more than anything else, and Perl. 20:05.010 --> 20:06.070 Perl is great. 20:06.310 --> 20:13.390 Now I mentioned that bro-ids, if you are interested in that, it's a really great IDS system, awesome anomaly detection. 20:13.790 --> 20:15.870 Really kind of hard to use, though. 20:15.870 --> 20:17.410 I mean, be prepared. 20:17.490 --> 20:18.630 But it's bro-ids. 20:18.630 --> 20:23.110 bro-ids.org It is a really good one. 20:23.650 --> 20:24.630 It's just... 20:24.630 --> 20:28.270 And it will never file into Windows, so don't even try if you're running Windows. 20:28.930 --> 20:30.070 A lot of custom scripts. 20:30.070 --> 20:34.250 You really have to be able to write your own programs to do this stuff. 20:34.490 --> 20:35.530 At least for now. 20:35.530 --> 20:39.690 I'm hoping that eventually I'll get enough of them that I can just hand them off to people and say, hey, use this. 20:39.690 --> 20:42.490 But for now, you're going to want to write some of your own. 20:42.490 --> 20:44.590 I have some example scripts that I use. 20:44.690 --> 20:46.630 So if you want them, they'll be on the website. 20:46.630 --> 20:49.170 They should be on your CD, though I update all of them. 20:49.470 --> 20:51.130 So, go to the website. 20:52.690 --> 20:53.890 And a database. 20:53.910 --> 20:59.010 At the end of the day, you are going to need a database more than you're going to need anything else that I talk about. 20:59.270 --> 21:06.710 Because if you figure that Microsoft has released about 35 major patches this year already. 21:07.210 --> 21:08.990 Those are the major, the MS05. 21:09.830 --> 21:11.090 They've already released like 35. 21:11.090 --> 21:13.070 And this is actually kind of a slow year for them. 21:13.070 --> 21:15.490 And you look at like 40,000 hosts. 21:16.010 --> 21:18.710 And then you look at all the antivirus programs. 21:18.710 --> 21:20.950 And then you look at all the OSs they're running. 21:21.630 --> 21:23.110 You need a database. 21:23.710 --> 21:25.910 I mean, I've been doing it actually for a while with NGREP. 21:27.870 --> 21:29.190 Sorry, not NGREP. 21:29.370 --> 21:30.010 FGREP. 21:30.870 --> 21:32.870 So I just grep out flat files. 21:32.870 --> 21:34.290 And we're building the database now. 21:34.290 --> 21:36.090 I had to prove that it could be done before they built it. 21:36.090 --> 21:38.270 And then somebody would take the time to build the database for me. 21:38.950 --> 21:41.610 So at the end of the day, though, you are going to need a database to do this. 21:42.510 --> 21:44.410 So, I'm going to say thank you for coming. 21:44.790 --> 21:46.050 I've got an address there. 21:46.050 --> 21:49.910 If you go to www.passiveaudit.org you'll see all the scripts I have, all the signatures. 21:49.910 --> 21:53.470 And I really would like to actually have more people writing signatures than just me. 21:53.650 --> 21:56.930 I do this at home at like 3 o'clock in the morning. 21:57.190 --> 21:58.610 So, help. 21:59.770 --> 22:02.870 This is how I, when I have time, I do this because I find it fun. 22:02.870 --> 22:04.610 I'm kind of curious, how far can I go? 22:04.710 --> 22:11.550 Can I actually, you know, I can actually find out if they've got office and stuff, but how much can I learn about the computer? 22:11.730 --> 22:15.710 I don't want to let anybody think that I'm actually trying to learn stuff about the people. 22:15.710 --> 22:17.970 That'd be wrong. 22:18.210 --> 22:20.070 At least I would on campus. 22:20.070 --> 22:21.690 Okay, thank you. 22:22.110 --> 22:22.850 Applause 22:26.040 --> 22:31.880 I'll be outside if anybody wants to get questions or wants to volunteer. 22:32.700 --> 22:32.740 Laughter 22:40.500 --> 22:42.600 Alright, thank you. 22:42.600 --> 22:45.800 We need everyone out those doors there. 22:46.880 --> 22:49.180 Laughter Uh... 22:49.180 --> 22:50.020 Silence