WEBVTT 00:00.930 --> 00:02.850 ...edition of DEF CON. 00:02.950 --> 00:06.230 Those are the hours that start at 8 and never end. 00:07.750 --> 00:17.110 My name is Ophir Arkin, and I will be speaking today about infrastructure discovery. 00:17.110 --> 00:24.910 Usually, a lot of people at DEF CON talk about how to break things. 00:26.410 --> 00:31.110 How to search cool stuff, how to take something and to break it. 00:31.110 --> 00:42.630 Most of the people that I know from the world that actually do network security, they are in charge of how they maintain their stuff. 00:44.870 --> 00:52.090 This talk is basically going to speak about what kind of knowledge and how we get it from an enterprise network. 00:52.090 --> 00:55.750 How do we acquaint ourselves with our users. 00:55.930 --> 01:03.070 How do we acquaint ourselves with the machines that operate on the network and with actually what is being done on the network. 01:03.070 --> 01:09.290 Usually, if you look at the DMZ, the DMZ is usually well fortified. 01:10.110 --> 01:13.430 Most of the things are already there. 01:13.430 --> 01:18.870 Most of the firewalls that we have can block 90%, 95% of all attacks. 01:18.870 --> 01:23.710 We can put another system where we are 99% protected. 01:23.710 --> 01:30.350 The guys that understand how to defend themselves, they are actually pretty good at doing that. 01:30.350 --> 01:33.610 Usually, it's not that hard to do that. 01:33.610 --> 01:36.790 You just need to understand what you need to do, what you need to defend. 01:36.990 --> 01:39.510 That's another interesting question. 01:40.510 --> 01:50.250 The talk will be... well, I'll try to do it really fast so they can take one of those walls down and have the ball here. 01:51.010 --> 01:55.270 We're going to talk about why do we need infrastructure discovery. 01:55.610 --> 02:00.130 Why active network discovery and passive network discovery are not that good and what can we do. 02:00.650 --> 02:13.350 I will demonstrate to you a new, agent-less, real-time approach that enables us to have real-time information about our infrastructure and to allow us to do monitoring and auditing. 02:16.110 --> 02:18.690 A bit about myself, I'll do that pretty fast. 02:18.690 --> 02:21.690 I'm the Chief Technology Officer for InsightX. 02:21.690 --> 02:23.590 I'm also the founder of the Cisco Security Group. 02:23.590 --> 02:26.390 Most of you know me from my previous work. 02:26.390 --> 02:28.790 ICPSR Scanning Expert 2. 02:29.810 --> 02:32.590 And other things that I've published along the years. 02:32.590 --> 02:35.270 I'm also a member of the Voice over IP Security Alliance. 02:35.990 --> 02:37.070 Let's go. 02:37.110 --> 02:39.790 Okay, so you have an enterprise network. 02:39.850 --> 02:41.550 It's large, it's complex. 02:41.590 --> 02:43.410 A lot of things operate there. 02:43.830 --> 02:53.310 Usually it may be combined from multiple networks in different locations. 02:53.310 --> 02:57.570 And basically there are a lot of nice things that operate on the network. 03:00.150 --> 03:01.770 Some of those are mission-critical. 03:01.770 --> 03:05.910 Mission-critical is a nice definition that says a lot of things to different people. 03:06.130 --> 03:11.770 At the end of the day, we need those systems to work in order not to have some financial damages, another nice definition. 03:12.050 --> 03:21.170 But at the end of the day, mission-critical means that if those systems are down or if those systems cause some kind of a problem, it means that other systems suffer. 03:21.170 --> 03:29.250 So for some, mission-critical means the servers, the networking gear, and for others it means also the desktops. 03:29.310 --> 03:42.090 If you had suffered an outbreak of a worm that hit a desktop and that desktop brought down your access switch or other things on your network, then that desktop is mission-critical to you. 03:44.730 --> 03:53.730 IT basically needs to take care of a lot of things that are actually important for the regular operation of the network. 03:53.950 --> 04:02.890 We need the network to be available, we need the elements to be available, we need to maintain the security of the network, and of course the availability of whatever is on the network. 04:03.030 --> 04:05.290 So basically IT has a ton of work. 04:05.290 --> 04:17.950 Usually the CIO will come to IT and say, well, you have enough people that needs to maintain what we have, just invest in smarter management systems. 04:18.370 --> 04:33.390 So IT needs to identify what are the assets, what they mean to the organization, their properties, their roles, the different interdependencies, what would happen if one of them would fail, how that will affect the IT organization and the business process, 04:33.390 --> 04:36.590 to understand the importance of those assets. 04:37.030 --> 04:48.910 A lot of boring stuff, which at the end of the day is very critical to be done, because if we're not doing this, we don't stand a chance to actually run an IT organization. 04:48.910 --> 05:05.910 And we have here a lot of things that relate to provisioning the network, provisioning the elements, know what we're defending, knowing what we're managing, detect and troubleshoot issues, defend our assets, eliminate those systems that actually pose a risk to some of our assets, 05:05.910 --> 05:12.130 and of course do other things like prepare for the worst, do disaster recovery, disaster recovery management, and a lot of other things. 05:12.130 --> 05:18.630 The problem is that in order to do all of those things, we need information. 05:18.630 --> 05:32.770 We need information about the network layout, how does our network look like, another worker at your local burger store. 05:37.980 --> 05:50.060 Okay, so we need to know the topology, we need to understand what are our resources, and we also need to understand what are the elements that we actually need to manage and secure. 05:50.480 --> 06:03.940 So at the end of the day, we need intimate, complete, and accurate knowledge about our infrastructure, and without this kind of knowledge, it will be, well, we can't actually do management and security. 06:04.860 --> 06:12.460 The problem is that the information that we need is either unavailable, partial, or incomplete. 06:12.460 --> 06:16.100 This is because this kind of information is not easily produced. 06:17.340 --> 06:21.940 Some people in our organization may have had that information, but they left. 06:21.940 --> 06:29.040 Some of this information is dynamic, and some of the systems that we use in order to maintain that information are insufficient. 06:29.040 --> 06:35.380 So at the end of the day, if we don't know the network, we can't actually manage or secure it. 06:36.500 --> 06:39.520 This brings us to this slide, to the result. 06:39.520 --> 06:43.660 The result is that we always work at the 80-20 rule. 06:43.700 --> 06:44.840 And you know what? 06:44.840 --> 06:51.140 The 80-20 rule is really bad when you do management for networking and for security. 06:51.140 --> 06:52.100 Because you know what? 06:52.100 --> 06:54.320 The 80% that I know of, you know what? 06:54.340 --> 06:55.900 I'm managing them right. 06:55.900 --> 06:59.480 I'm doing all the things that I need to do for them right. 06:59.480 --> 07:07.760 But those other 20% that I'm able to uncover, that I don't know what they are in my organization, those that actually pose the highest risk for me. 07:08.020 --> 07:10.260 Well, the highest risk can come from a compromise. 07:10.260 --> 07:14.160 The highest risk may come from auditing perspective. 07:14.160 --> 07:18.380 The highest risk may come from a lot of things, but at the end of the day, I don't have control. 07:18.380 --> 07:23.580 I cannot understand what I have, and I have full sense of control and full sense of security. 07:23.780 --> 07:27.780 And when I have these, then it's all downhill from there. 07:28.140 --> 07:34.840 So along the years, there were several technologies that were trying to solve the issue of knowing the network. 07:34.840 --> 07:51.880 Basically, what they were trying to do is, they were actually trying to have the topology of the network, understand what are the elements that reside on the network, what their properties are, and they maintain this information up to date. 07:51.880 --> 07:57.140 It seems that this is a definition that is very small, right? 07:57.140 --> 08:00.720 It contains everything, but it has a lot of problems in it. 08:00.720 --> 08:07.500 Doing network topology, if some of you are using network management systems that claim that they do this, it's a hard thing to do. 08:07.500 --> 08:08.640 It's not that easy. 08:08.640 --> 08:15.020 It's not that easy to say which switch is connected to another if you do not use CDP or other proprietary protocol. 08:15.320 --> 08:20.820 It's also not easy to produce the information about what actually lies on the network. 08:21.660 --> 08:26.540 So, let's start with one of my favorites, Active Network Discovery. 08:26.540 --> 08:34.800 With Active Network Discovery, basically, we send some packets to the network and we hope that we'll see some responses from those elements on the network. 08:34.800 --> 08:42.240 And sometimes, according to those responses or the lack of, we will draw some conclusions about those elements. 08:43.880 --> 08:58.440 An Active Network Discovery system will try to get information about the inventory, meaning the elements, their properties, information about network services, the configuration, the topology, and if this Active Network Discovery is able to do vulnerability assessment. 08:58.440 --> 09:07.740 Usually, it will be installed on a single location on the network, although you can install it in multipoints, and we'll scan the network from that point. 09:09.300 --> 09:29.220 The way this can actually work is that an active tool can be fed with a list of IP addresses it needs to scan, or a list of networks it can scan, or that the Active Network Discovery tool will try to do that automatically by querying local elements and drawing that information from them. 09:29.220 --> 09:46.520 For example, HP OpenView, Tivoli, and other management systems go to the router, take the routing table, understand there are other networks they might need to operate against, and continually trying to detect other routers on the network, taking more and more IP address ranges, 09:46.520 --> 09:51.180 and from there, trying to enumerate all the information about the network. 09:54.100 --> 10:03.560 The strength that Active Network Discovery has mainly relates to the ability of active tools to completely control what they're asking for. 10:03.560 --> 10:20.100 They send the stimuli out so they can understand, well, we need this information from that element, we need that information from another, and they can also control the initiation of the scan, and also they can control the pace the queries are being sent. 10:21.060 --> 10:33.480 Technically speaking, if we're not having any kind of obstacles between the Active Network Discovery to the target, an Active Network Discovery system can scan entire IP address ranges. 10:35.980 --> 10:38.500 The weaknesses are a lot. 10:38.500 --> 10:41.720 I'll try to do something with the refresh rate pretty fast. 10:41.720 --> 10:43.200 Sorry if I can fix this. 10:45.360 --> 10:50.940 The weaknesses, well, the first one is that the discovery that will be done will be incomplete. 10:50.940 --> 10:54.820 This is since network obstacles on the network will prevent packets to reach their targets. 10:54.820 --> 11:10.160 If you have network-based firewalls, host-based firewalls, those Windows XP, SP2 that you installed and forgot that by default they have firewalls, and now you're unable to manage, not enable devices, load balancers, and other things that you put on a network will prevent the packets to reach their targets, 11:10.160 --> 11:13.280 and basically this will create black holes of information. 11:13.280 --> 11:20.140 So from a network that has a lot of elements, you'll discover that you have a very small network. 11:20.140 --> 11:21.440 Well, it's not true. 11:22.180 --> 11:30.140 Sometimes you'll need some type of information to be enumerated from those elements in order to draw your conclusions. 11:30.140 --> 11:30.720 And you know what? 11:30.720 --> 11:36.580 Sometimes those services will not be operating on those elements, and sometimes they will not be willing to speak to you. 11:36.720 --> 11:45.140 So, for example, if you need information from the Windows Remote Registry and you have the administrative rights for the domain, but the system is not a member of the domain, guess what? 11:45.140 --> 11:46.360 It will not help you. 11:46.360 --> 11:55.060 Also with SNMP, if you don't know the community strings of those routers that you want to enumerate, at the end of the day you can't draw the information from there as well. 11:55.360 --> 11:58.160 The process is very slow, it's time-consuming. 11:58.160 --> 12:01.660 By the time you get the information, the information that you get is obsolete. 12:01.660 --> 12:03.720 This is because it's not real-time. 12:04.420 --> 12:13.040 It also consumes a lot of network bandwidth, and it might take some elements down when it's actually doing the process. 12:13.040 --> 12:24.900 This is because sometimes it will overhelm the networking elements between the scanning system to the target with the amount of traffic it produces and will cause an out-of-service condition. 12:25.840 --> 12:28.740 So some folks went and said, well, you know what? 12:28.740 --> 12:32.340 We can do scanning at off-peak hours. 12:32.600 --> 12:40.020 We'll take our active network discovery systems or management systems, we'll take that to off-peak hours, and that will do it. 12:40.020 --> 12:43.060 Well, wrong, because you can't actually define what are off-peak hours. 12:43.060 --> 12:53.460 And sometimes during off-peak hours there are some crucial processes that actually are being done, like backup, restores, some reporting on your databases. 12:53.500 --> 13:03.220 So actually the process of probing those elements might not actually can be quantified to a certain time, and sometimes it may take longer than you actually know. 13:03.220 --> 13:11.900 A telecom company that I know runs HPOV against 4,000 devices and takes them 24 hours to complete the scan. 13:11.900 --> 13:17.560 Now, this is absolutely no-no if you're doing that against your operation network. 13:17.660 --> 13:20.080 So there are others who said, well, you know what? 13:20.080 --> 13:21.880 We'll do the scan faster. 13:21.880 --> 13:27.520 So we'll narrow the time that the scan needs to be done, and we'll finish it faster. 13:27.520 --> 13:29.940 Well, it's a good thing in theory. 13:29.940 --> 13:32.080 How many of you know NMAP? 13:32.080 --> 13:33.620 How many of you use NMAP? 13:33.620 --> 13:34.260 Cool. 13:35.040 --> 13:40.900 So someone can tell me what's the usual time that NMAP scans an element on a local network? 13:42.480 --> 13:43.760 Three seconds. 13:43.880 --> 13:45.660 How many packets does it send? 13:45.920 --> 13:46.920 1,500. 13:47.080 --> 13:48.560 So, let's see. 13:48.560 --> 13:53.720 If I scan my network, three seconds per element, 1,500 packets, that's a very bad thing to do. 13:53.720 --> 13:55.300 Try that on your local printer. 13:56.480 --> 14:02.340 Believe me, my printer cannot withstand that kind of faster scan. 14:02.540 --> 14:08.680 So whenever someone from my engineering team goes and uses NMAP by mistake, I know that I can't print. 14:08.680 --> 14:12.460 So I need to go to the printer, power it off, power it on, and then use it. 14:12.460 --> 14:18.060 And then see who's the engineer that was trying to play with network discovery on my network. 14:18.400 --> 14:23.580 So at the end of the day, this will cause disruptions on your network. 14:23.580 --> 14:26.400 Scanning faster is not the solution. 14:28.180 --> 14:32.780 And we go to the stability issues, which are the major ones. 14:33.820 --> 14:44.360 Basically, what those will cause, they will cause your machines to be unstable, like print servers, printers, other elements that cannot withstand a lot of traffic. 14:45.540 --> 14:51.640 And all of those, at the end of the day, will be denied of service. 14:51.640 --> 14:53.580 Doesn't help if I play with it, even. 14:53.800 --> 14:55.000 Sorry about that. 14:56.160 --> 15:05.740 This is because either the pace of the scan, the usage of non-RFC compliant packets, the type of information enumeration you're using. 15:05.740 --> 15:13.900 So if you're thinking that you can do network topology by taking the ARP tables from the routers, believe me, this is something that you do not want to do. 15:14.120 --> 15:26.560 You make the routers choke, you don't have connectivity to nowhere, and this is the last time that you will run an active tool on your network, because your CIO either will fire you or will tell you, this tool does not run on my network anymore. 15:29.520 --> 15:40.860 Some folks just forget that when they do invulnerability assessment, they shouldn't use those tests that actually cause denial of service. 15:40.940 --> 15:42.180 It's a bad thing. 15:42.900 --> 15:45.560 Against production machines, it's not a good thing as well. 15:45.560 --> 15:56.080 So sometimes the stability issues will arise just because there's the element between you and the scan target cannot withstand what you're doing. 15:56.080 --> 16:07.740 If you remember some of the old checkpoint and out-of-services where someone's scanning from the internal network, someone on the other end, what will happen is that all these state tables will be filled with information. 16:07.740 --> 16:12.960 They will wait for the timeout for the connections, but the state table is full. 16:12.960 --> 16:19.480 It cannot handle other legitimate connections, so what you have is a perfect denial of service that someone from the inside doing a pen test did. 16:20.180 --> 16:25.340 Also switches, they will be overhelmed by the number of connections and they will die. 16:25.620 --> 16:37.440 Believe me, it's very nice to, for example, I'll mention that later, if you span too much on a Cisco 3550, it's a party going on. 16:37.440 --> 16:41.080 It will send packets all over the place and you'll never understand networking in your life. 16:41.080 --> 16:42.220 You should see that. 16:42.660 --> 16:49.420 So, at the end of the day, the result is that some of the networks you have may be declared as active scan-free. 16:49.420 --> 17:08.000 You'll never be able to scan them at the end of the day because all of those other admins, the app admins, the network admins will come and say, well, we can't do this because you know that at the end of the day, I'll have denial of services and I don't want to do that in my production machine. 17:08.000 --> 17:15.700 So, there's a lot of production networks that are unable to be scanned because of these things. 17:15.700 --> 17:17.760 Nothing I do that helps me with this. 17:18.340 --> 17:28.260 So, we have some parts of your network unable to be scanned because people fear about active network discovery tools or previous history has proven them right about that. 17:28.700 --> 17:37.060 So, some people suggested that scanning, active scanning can be done in a different way. 17:37.060 --> 17:41.040 Let's see, let's have multiple machines scanning from the same place. 17:41.040 --> 17:42.620 It's actually called a cluster. 17:42.780 --> 17:43.220 Guess what? 17:43.220 --> 17:45.120 This doesn't help you actually. 17:45.120 --> 17:48.400 Because the scan is now distributed among several boxes. 17:48.440 --> 17:53.160 They scan the network at the same time and they send actually more traffic to the network. 17:53.160 --> 18:00.300 So, all of your denial of service conditions, all of your other problems are still there, but nothing is really a plus. 18:01.140 --> 18:06.360 Others were suggesting to put a proxy in each IP subnet or broadcast domain. 18:06.360 --> 18:12.180 That's actually a better idea because you can actually scan faster and you do not need to go through routers. 18:12.440 --> 18:18.820 But, at the end of the day, it doesn't give you any other advantage. 18:18.900 --> 18:22.100 Because, still, you need a pretty knowledge about what you have. 18:23.060 --> 18:29.360 The scan packet still might cause instabilities with the elements that are on the network. 18:29.360 --> 18:38.940 And, still, if you have firewall devices, not enabled devices and any other obstacles on your network, still, those packets will not go through those. 18:39.320 --> 18:47.680 So, basically, Active Network Discovery, at the end of the day, provides you with incomplete and, in some of the cases, inaccurate map of what you have on your infrastructure. 18:47.680 --> 18:49.120 Questions until this point? 18:51.960 --> 18:54.440 Because you have to understand what you have. 18:54.440 --> 18:59.380 The idea is that I don't want you to tell me what you have. 18:59.380 --> 19:02.240 I want my tool to discover it automatically. 19:02.240 --> 19:06.240 So, if you have something that you are not aware of, the tool will understand what it is. 19:09.980 --> 19:12.200 It depends what you want to take out of it. 19:12.200 --> 19:15.660 I mean, a segmented data is nice, but do you need the information to be current? 19:15.660 --> 19:26.520 If you need to manage something, if you need to be able to do something useful with the information that you uncover, you need this information to be real-time. 19:26.520 --> 19:28.840 And Active Network Discovery cannot be real-time. 19:29.520 --> 19:30.300 Yes. 19:46.040 --> 19:47.140 Exactly. 19:47.140 --> 19:48.020 Yes. 19:55.900 --> 19:57.020 Yeah. 19:57.360 --> 19:58.860 It's absolutely true. 20:00.320 --> 20:03.840 So, going fast to another area of invention. 20:03.840 --> 20:09.000 If you didn't know, Passive Network Discovery Systems were first introduced in the mid-1990s. 20:09.760 --> 20:13.420 Don't let other people tell you that they were invented last year. 20:13.940 --> 20:23.000 Basically, Passive Network Discovery System is merely a sniffer installed at the chock point of the network processing packets that were sent by active network elements on the network. 20:23.440 --> 20:25.500 That's actually one of its biggest problems. 20:25.500 --> 20:29.040 So, how can we look at the deployment? 20:30.780 --> 20:47.620 The system can be connected to the network using a tap, like this one, a span port, like this one, span port at the access layer, and span ports which are sent to one element. 20:47.620 --> 20:49.620 So, what kind of information can be harvested? 20:49.620 --> 20:53.180 Basically, the information is about active elements. 20:53.180 --> 21:09.300 Active elements that may have shown up in the inventory, active network services, the distances that those active network elements are from the monitoring point, the client-based software, the network utilization information, and, if possible, vulnerability information, 21:09.300 --> 21:11.560 if this passive network discovery tool is doing. 21:14.240 --> 21:34.620 The purpose of collecting the information would be to build the Layer 3 based topology, which is fairly problematic because what you need is actually the physical network topology, including the switches, including the hosts, to know exactly what you have and not just the Layer 3 one, 21:34.620 --> 21:46.660 the network utilization information, some network forensics, if the tool is able to do that, vulnerability discovery, to create some context about the network and to feed that information to other systems. 21:47.680 --> 22:11.360 The strengths of the system is merely the ability of the system to be real-time, to have no impact over the monitored network in the means that it doesn't send any type of traffic to the network and there it doesn't pose any kind of risk to the network when it runs on. 22:11.360 --> 22:20.840 It can process packets and can process information from all TCP IP layers and it can detect anything that is active on the network, even if it's for a short time period. 22:23.740 --> 22:41.760 It can also detect elements behind network obstacles, such as not-enabled devices, firewall elements, and also can provide you with network utilization information and can also be useful for network-related anomalies. 22:41.800 --> 22:47.320 Who is using a system that actually is based on anomaly detection? 22:48.640 --> 22:49.560 Cool. 22:49.560 --> 22:50.600 Are you happy with it? 22:50.600 --> 22:52.040 No, right? 22:52.100 --> 22:57.500 Because my anomaly is not your anomaly, it's not his anomaly, and that's the main problem. 22:58.520 --> 23:01.520 I'm not going to go into it, but I don't like it. 23:02.080 --> 23:03.120 Weaknesses. 23:03.200 --> 23:10.560 The first and biggest weakness of a passive network discovery system is that what you see is only what you get. 23:10.560 --> 23:20.860 So if you have an idle service, if you have an idle system, if you have an idle whatever, that kind of element, that kind of information will not be uncovered. 23:21.140 --> 23:26.840 If the information does not go through the monitoring point, it will not be uncovered. 23:27.640 --> 23:38.380 It means that at the end of the day, the discovery will be incomplete and inaccurate and non-granular because we cannot control what passes through the monitoring point. 23:38.380 --> 23:48.740 We cannot go to the client and say, you know what, we need you now to browse because we need the type of information that your browser sent to the network in order to build something or to conclude about something. 23:48.740 --> 23:50.980 We don't have any kind of control. 23:50.980 --> 23:52.640 We don't control the stimulus. 23:53.620 --> 24:01.740 So passive network discovery cannot detect all assets and cannot detect all protocols and services and cannot detect all ports. 24:01.740 --> 24:17.060 We cannot control what we see and in order for us to detect something, well, you know what, sometimes we cannot detect it because the kind of information that discloses the type of information that we need may never pass the monitoring point. 24:18.400 --> 24:24.510 So, another interesting subject. 24:24.510 --> 24:26.110 This is actually getting worse. 24:28.690 --> 24:30.010 Shut it off. 24:32.990 --> 24:34.030 Sorry? 24:39.280 --> 24:41.980 Where's the projector thing? 24:44.580 --> 24:46.280 You want to try this? 24:46.840 --> 24:47.840 Oh, he's recording. 24:47.840 --> 24:49.060 Yeah, you can do it. 24:50.020 --> 24:55.760 Nobody's here to press it, so just feel free to... 24:55.760 --> 24:59.340 Hey, it gets everything in all of those... 24:59.340 --> 25:01.260 Yeah, now we'll see... 25:01.980 --> 25:03.800 No, we don't want to do that. 25:05.320 --> 25:05.960 Sorry? 25:06.860 --> 25:07.540 Yeah. 25:14.440 --> 25:16.600 Okay, did you power it on? 25:16.600 --> 25:17.700 Okay, I'll continue. 25:17.700 --> 25:20.800 I have some modifications to the presentation of the problem. 25:21.600 --> 25:44.200 So, basically, when it tries to build the topology, what it will do, it will look at the distances the elements are from the monitoring point and it will look at the time to leave field value with the packets it receives and that actually would be the information that it will use in order to build the Layer 3 topology. 25:44.200 --> 25:45.220 And you know what? 25:45.220 --> 25:46.280 Guess what? 25:46.620 --> 26:11.960 That actually does not help me because if I see where the elements are and how are they located and what is their position according to my system, I cannot actually build everything because I will have islands of information and I will not be able to uncover the exact routers that are actually operating on my network. 26:11.960 --> 26:18.200 And the only thing that I will be able to detect is those systems that actually send traffic to the network. 26:19.660 --> 26:22.020 Okay, now this projector doesn't work at all. 26:22.020 --> 26:23.000 That's nice. 26:26.510 --> 26:28.290 It's always the messenger. 26:29.190 --> 26:30.030 Okay. 26:31.290 --> 26:36.810 So, if we have routing not done through the monitoring point. 26:36.810 --> 26:39.750 Okay, it seems to be trying to work. 26:40.090 --> 26:40.470 Wow 26:46.640 --> 26:47.340 . 26:47.440 --> 26:49.320 Yeah, it's encrypted stream. 26:53.940 --> 26:58.460 I'm not mirroring and it's 640x480. 26:58.660 --> 27:01.220 And I'll try to detect again. 27:01.220 --> 27:02.320 Oh, yeah. 27:02.940 --> 27:05.040 Refresh rate is down. 27:08.760 --> 27:10.460 Yeah, buy something else. 27:10.460 --> 27:11.760 That always works. 27:17.680 --> 27:18.420 Yeah. 27:39.380 --> 27:41.240 Yeah, I'll do that one second. 27:49.580 --> 27:50.240 Yeah. 27:50.340 --> 27:50.780 At 29:15.960 --> 29:19.060 least it works with Windows, right? 30:28.220 --> 30:29.820 See, I got an upgrade. 30:29.820 --> 30:31.200 So, now I'm using Windows. 30:34.530 --> 30:35.950 Thanks for the help. 30:36.050 --> 30:38.770 A round of applause for the guy that donated his machine. 30:42.660 --> 30:43.600 Yeah, I want it back. 30:43.600 --> 30:44.640 Okay, here it is. 30:44.760 --> 30:47.020 Should I go to JD Travel and see what's in it? 30:47.020 --> 30:47.500 Nah. 31:01.660 --> 31:02.300 Nice. 31:11.160 --> 31:12.440 Yeah, do it by telephone. 31:12.440 --> 31:13.460 That would be nice. 31:29.740 --> 31:30.380 Okay. 31:43.640 --> 31:45.180 Start from the beginning. 31:57.180 --> 31:58.680 At least you can see it now, right? 32:06.870 --> 32:07.510 Okay. 32:08.150 --> 32:17.010 So, basically, if this is my network and I want the passive network discovery system to draw it, this would be the result. 32:17.470 --> 32:18.590 Similar, right? 32:19.790 --> 32:22.090 I had this and now I've got this. 32:22.090 --> 32:24.910 The problem is that I wouldn't be able to uncover the switches. 32:25.270 --> 32:29.650 I would not be able to uncover which machine is connected to which switch. 32:30.130 --> 32:32.330 And at the end of the day, I get this thing. 32:32.330 --> 32:33.090 I have a router. 32:33.090 --> 32:33.830 I have systems. 32:34.410 --> 32:36.370 But actually, it's not my system. 32:36.370 --> 32:37.590 It's not my network. 32:39.630 --> 32:43.710 The problem is that we need to be deployed as close as possible to the access layer. 32:43.710 --> 32:46.910 We need to see latitude traffic. 32:46.910 --> 32:50.690 In order to do so, it means that we need a lot of moving boxes. 32:50.850 --> 32:58.330 And to do this in a complete coverage, it means a lot of boxes and a lot of moving parts. 32:58.330 --> 33:05.270 So, another weakness is that I'm unable to monitor the state of network services. 33:06.210 --> 33:09.110 If this is an idle service, I cannot monitor it. 33:09.110 --> 33:12.230 If the service goes down, I cannot monitor it. 33:12.590 --> 33:16.070 At the end of the day, no service monitoring. 33:16.270 --> 33:21.770 So, for example, I might see traffic for a certain port. 33:21.770 --> 33:23.710 I may declare it as an open. 33:23.830 --> 33:26.010 The guy would close the port. 33:26.010 --> 33:28.050 I will never know it. 33:28.650 --> 33:35.290 So, the less obvious weaknesses are the fact that I can inject whatever I want to the network. 33:35.290 --> 33:35.750 And guess what? 33:35.750 --> 33:39.090 The passive network discovery system will take it. 33:39.350 --> 33:45.630 The problem is that there is no way for the passive network discovery system to actually validate the information. 33:45.910 --> 33:51.430 This is since the only traffic it sees, well, goes through the monitoring point. 33:51.430 --> 33:52.550 It can't do anything. 33:52.550 --> 33:57.250 So, at the end of the day, that leaves it with the inability to validate it. 34:01.310 --> 34:06.950 The problem with it is that it's not only influencing the passive network discovery system. 34:06.950 --> 34:19.890 If there are other systems which rely on the type of information that the passive network discovery system actually provides in order to draw other conclusions, to do other things like network intrusion detection systems or even network intrusion prevention systems, 34:19.890 --> 34:23.710 that might be something which we don't want to be happening. 34:25.470 --> 34:44.350 This would actually cause the kind of information that will be taken from a passive network discovery system will cause other management systems that actually get the information from passive network discovery systems to produce even more inaccurate and incomplete information when they process the information the system provides them. 34:44.350 --> 34:49.530 A very simple example to show you how this works. 34:49.530 --> 34:53.030 Let's say we have a Windows-based machine like the one here. 34:54.190 --> 35:12.070 And a passive network discovery system might have some kind of counter or it might have some abilities to say, well, until I'm not detecting the operating system itself, I'm not trusting the information that actually is being sent through the different field values. 35:12.070 --> 35:18.450 So unless I understand that this is a Windows machine, I'm not going to trust the time-to-leave field value. 35:18.590 --> 35:22.750 So what I've done is that I only played with one field. 35:23.390 --> 35:25.370 I played with the time-to-leave field value. 35:25.370 --> 35:30.730 I changed it from default value of 128 to default value of 126. 35:30.930 --> 35:34.970 And all in all, that is still a valid Microsoft Windows machine. 35:34.970 --> 35:42.230 But for the passive network discovery system, it is now being located two hops down. 35:42.770 --> 35:44.410 I didn't do anything, actually. 35:44.410 --> 35:45.550 I didn't move it. 35:45.550 --> 35:50.690 I didn't have to actually physically disconnect it from the place that it is being connected to. 35:51.110 --> 35:58.550 This is because passive network discovery system, in this case, is unable to go to the switch and ask the switch, OK, who is connected to you? 35:59.710 --> 36:05.250 So a simple example to show you that it is very easy to trick the system. 36:05.250 --> 36:16.210 All you need to do is to understand the methodology and the way the system works in order to just put some decoys and deception and remove your system. 36:17.970 --> 36:27.590 Other weaknesses, denial of services, mainly because you need to take the information, open it up, and understand what you're seeing. 36:27.590 --> 36:30.250 Other examples of even remote code execution. 36:30.650 --> 36:38.530 Usually you will see this against Ethereal, which is a great tool, one of the best network analyzers out there. 36:38.630 --> 36:43.790 But some remote code execution is possible against it in its different versions. 36:45.330 --> 36:50.510 So, as some of you, I was in charge of a network and I had a problem. 36:50.790 --> 36:53.050 I had a problem that I couldn't understand what I have. 36:53.050 --> 36:55.070 I couldn't understand what I need to defend. 36:55.070 --> 37:02.390 I couldn't understand where are my elements so I can understand what are the differences that I need to do. 37:02.450 --> 37:07.290 I cannot build walls without understanding first what I need to defend. 37:07.930 --> 37:24.810 I've actually been doing this for the past several years and actually analyzed whatever there is to analyze regarding active network discovery, passive network discovery, and actually figured out that both of them will never help you if you want real intimate knowledge, 37:24.810 --> 37:27.510 complete and accurate about your infrastructure. 37:27.670 --> 37:42.570 Another interesting point is that there is many theoretical researches out there that actually they cannot be working on live environments, real world environments. 37:42.570 --> 37:47.570 If you remember the NAT researches, those are good for paper. 37:47.570 --> 37:51.590 They don't really work on the real world, unfortunately. 37:52.930 --> 38:11.850 So, the goals of the research were to have this kind of complete and accurate information, to have it in real time, to not have agents to detect and react to changes in real time, and basically not allow someone to send decoys that will be taken, but to understand that we have them and to ignore them, 38:11.850 --> 38:14.170 and to cover the entire IP address range of a network. 38:14.170 --> 38:18.550 And, of course, to have some other things like topology, which is really important. 38:19.190 --> 38:23.290 So, what I've come up to is with a technology called dynamic infrastructure discovery. 38:23.590 --> 38:30.870 Basically, this is a technology that combines, tightly integrates, actually, between active and passive network discovery. 38:30.870 --> 38:45.490 And by tightly integrating between them, it has new discovery abilities that are not able to be made with each and every one of those, if you use them solely. 38:47.270 --> 38:52.470 This technology, actually, is adjustable to any type of network that you are using. 38:52.470 --> 39:01.630 This is because it is able to balance between the information that is being harvested from a passive link to the amount of traffic it needs to send through an active link. 39:01.630 --> 39:07.750 It means that it works by listening to traffic that goes through a certain monitoring point on the network. 39:07.850 --> 39:15.390 It starts to build profile of the elements, data profile of the elements that are working on the network. 39:15.390 --> 39:35.270 And after a certain time had passed, and it seemed that some pieces of data that were not being collected, or there are some pieces of data that cannot be collected through using passive means, it's actually calling the active side and surgically inserting packets into the network in order to get the missing pieces of information. 39:35.270 --> 39:40.250 So, for example, if you want to know where your elements are, you need to talk to the switch. 39:40.250 --> 39:41.450 You can't do that passively. 39:41.450 --> 39:46.430 Or if you want to validate the type of information that you've seen passively, you do that actively. 39:46.810 --> 39:55.230 So at the end of the day, it balances between the type of information that it sees going through the monitoring point, which can be good, can be bad, and can be great. 39:55.230 --> 40:00.990 It all depends on the time of the day that you operate on or that you are at. 40:00.990 --> 40:07.350 For example, when your users are coming to work, 8 o'clock, 9 o'clock, everything is working, right? 40:07.350 --> 40:10.710 They do email, they browse the web, everything is fine. 40:11.450 --> 40:14.630 12 o'clock, everybody at lunch, nothing works. 40:15.070 --> 40:16.890 6 o'clock, everybody works. 40:16.890 --> 40:23.330 A lot of elements basically disappear from the network because people shut down their machines and go home. 40:23.590 --> 40:27.670 2 a.m., you might see a lot of backup activity on a network. 40:27.670 --> 40:34.770 So at different times of the day, you see different things on a network that you are able to take different things from them about the elements. 40:34.770 --> 40:38.190 But at the end of the day, you need that information to be complete. 40:38.190 --> 40:42.210 So the balance comes from using the active site, surgically probing. 40:43.610 --> 40:57.230 Other things that are unique, for example, you can detect what are the guest machines of a certain host machine of VMware or any virtual machine. 40:57.270 --> 40:58.950 You are able to tie them together. 40:59.130 --> 41:04.150 It's easier to detect not-enabled devices and wireless access points using this technology. 41:04.150 --> 41:14.130 Basically, any piece of information that can be gathered either passively or actively can be gathered using this technology. 41:16.050 --> 41:19.730 You can build your asset management. 41:19.730 --> 41:32.450 You can do physical network topology because you are able to take the information that comes from the passive site, combine it with the information you are able to take from the switches and combine them into physical network topology where you show where the hosts are actually connected, 41:32.450 --> 41:35.030 the switch connectivity and the routers. 41:35.030 --> 41:37.290 This is something that you can actually work with. 41:37.850 --> 41:39.470 You have a real-time change detection. 41:39.470 --> 41:44.130 You operate in real-time because you have that from the passive site. 41:44.130 --> 41:51.930 You don't require any agents to be installed on the machines because your monitoring point provides you with all the information in the world that you have. 41:54.450 --> 41:56.490 I already talked about this. 41:57.710 --> 42:03.550 One of the things that I like about this is that you are able to triangulate between user, host and location. 42:03.550 --> 42:16.270 One of the biggest problems of managing and securing enterprise network is the inability to locate or the inability to say who is the exact user that is actually doing this and where actually his machine is being located at. 42:16.270 --> 42:33.010 So when you have the physical location information, when you have the host name and you have the user name of the actual user that's actually been using this, it's very easy to come to someone and say, you are the one that actually did this and that because you have all the information that triangulates that user to his machine. 42:33.950 --> 42:51.290 From using only surgical probing, this technology does not pose any kind of risk to production environment because you do not need to use a lot of packets in order to probe elements on the network for getting the information from. 42:51.290 --> 42:59.350 And therefore, all the information is being either harvested passively or by using surgical active packets. 42:59.350 --> 43:02.970 So the number of packets they actually insert into the network is very low. 43:02.970 --> 43:08.790 The packets are RFC compliant and there is no risk of using those against production environments. 43:10.910 --> 43:12.690 Some limitations. 43:12.690 --> 43:20.350 The only limitation that this technology actually have is that you can't really scan a network for 65,000 something ports. 43:20.510 --> 43:26.490 So you might not uncover all the services that are actually working on that system. 43:26.610 --> 43:27.850 Some usages. 43:28.390 --> 43:31.030 I'm being brief because I need to finish. 43:31.670 --> 43:35.030 You have clear visibility into your infrastructure. 43:35.030 --> 43:44.350 Everything that is on the network is being detected from storage devices to host machines to network-enabled, not-enabled devices to wireless access points, everything. 43:44.350 --> 43:54.690 The accuracy level of the technology, let's say when we're doing OS detection, is less than 0.25% of false positives. 43:54.690 --> 44:06.710 The ability to locate any device on the network, see its properties, see its whereabouts, understand what is being done in real time is something that you need as a context. 44:07.070 --> 44:10.890 And when you have physical network topology, you can locate everything. 44:11.030 --> 44:19.870 And when you have all this information that allows you to see whatever everybody or that particular element is doing, you are able to understand what is happening. 44:19.870 --> 44:22.690 And if there is a problem on the network, you are able to locate it easily. 44:22.690 --> 44:28.350 So let's say that you are an admin and there is a new patch for a certain service. 44:29.650 --> 44:37.330 Usually what you'll do is you'll scan your network and understand where it is and try to understand what are the services that need to be patched first. 44:38.090 --> 44:48.190 When you have current and real-time information, what you only need to do is just to have a search under your inventory for the open port. 44:48.630 --> 44:49.970 You get the list instantly. 44:49.970 --> 44:54.590 So you save the IT hassle of going and looking for that type of information. 44:54.590 --> 44:57.490 You instantly have the information that you need in order to work against. 44:57.490 --> 44:59.690 And that saves you a considerable amount of time. 45:00.570 --> 45:04.550 You can take the information and feed it to other systems. 45:05.870 --> 45:09.250 For example, you can do target-based vulnerability assessment. 45:09.250 --> 45:16.390 One of the biggest problems of vulnerability assessment tools is that they need to do active network discovery. 45:16.390 --> 45:25.870 So what you do is you're able to take a list of your Windows machines or Windows 2000 machines and instantly feed it to a vulnerability assessment tool. 45:25.870 --> 45:33.490 And that vulnerability assessment tool may need to do only the Windows 2000-based test against those machines. 45:33.490 --> 45:34.730 And that's it for it. 45:34.730 --> 45:46.030 So you actually are able to make those tools work better and solve the 80-20 problem for them by feeding them with contextual information about the network. 45:46.030 --> 45:53.330 There's also the ability to baseline the knowledge about the elements that operate on the network because you see them all the time. 45:53.330 --> 45:59.470 So you're able to actually say what's unauthorized and what's not authorized because you see everything. 46:00.010 --> 46:12.610 Until this point, if you're using an active tool, like this gentleman had said, if I do a scan once in 24 hours, I can't do anything with the information because I don't see the changes. 46:12.610 --> 46:19.530 There are some users that might bring their laptops from home and take it in between, and I'll never know that they're actually existing. 46:22.910 --> 46:31.510 I think the most important thing about the technology, about the dynamic infrastructure discovery technology, is that you finally have control. 46:31.510 --> 46:44.810 You can achieve control of what you have because you understand what you have, you understand the layout, you understand you have strong auditing capabilities, and you understand to use it for the first time and not just saying, okay, I have partial information, 46:44.810 --> 46:47.910 I have complete information, I have control, I have everything that I need. 46:49.190 --> 46:49.990 Questions? 46:50.850 --> 46:52.650 Yes, the gentleman here. 46:56.060 --> 46:57.220 This is working. 46:57.220 --> 47:00.760 If you want more details, I'll give it to you at the end of the presentation. 47:01.580 --> 47:02.540 Other questions? 47:07.280 --> 47:10.760 If you'll talk to me after the presentation, I'll answer the question. 47:11.580 --> 47:12.460 Yes. 47:23.650 --> 47:27.230 The only switches that you actually know that they exist are your core switches. 47:27.230 --> 47:39.610 I mean, in all the companies that I was talking to or working at or consulting to, what they know is they have a firewall that connects them to the Internet, and they have those nice core switches because they cost them a lot of money. 47:39.850 --> 47:45.930 And usually when you hook this up to the core switch, you get all the information that you need from the core switch and you go from there. 47:45.930 --> 47:57.790 Sure, it's something that you need to install on X number of places in a distributed manner in order to see the complete visibility because it needs to see traffic between Layer 2 to Layer 3. 47:57.950 --> 48:01.510 But at the end of the day, you still see complete visibility. 48:01.510 --> 48:06.970 Say that you want to have an IDS system, an IPS system, they all have the same problem. 48:07.770 --> 48:15.190 But this system actually can take traffic from multiple networks into one place and not just see one network at a time. 48:17.730 --> 48:23.350 If you have a Layer 3 barrier that you cannot pass, you need to install another system. 48:27.970 --> 48:33.990 Well, when you have a management server, you are able to connect everything and all the dots and you have complete information about everything. 48:35.590 --> 48:36.550 Yes. 49:22.620 --> 49:29.760 You must use SNMP to take information from the switches because there is no other way to understand where the elements are if you are not using SNMP. 49:29.760 --> 49:36.440 The idea is that you don't need to know the connectivity and you build the connectivity automatically using other algorithms. 49:36.440 --> 49:47.020 There are several researchers that were talking about how you build your topology by just taking the information from the switches and trying to connect the switches without using proprietary protocols. 49:47.020 --> 49:49.680 Some of them have some holes in it. 49:49.760 --> 49:51.780 Some of them are incomplete. 49:51.780 --> 49:55.220 But at the end of the day, you can learn a lot from those researchers. 49:56.980 --> 50:03.380 What I did with this technology is you must understand where the elements actually are connected to. 50:03.380 --> 50:12.640 And what you are able to do is just to say, okay, if this element is something that, for example, is unknown, I am able to say which switch and which switch port is actually being connected to. 50:12.640 --> 50:17.820 You can use that information and you can say, okay, now I won't go and tell the SSH and kill this port. 50:17.920 --> 50:20.640 The idea is to have the visibility. 50:21.080 --> 50:34.440 There are some switches that can send you an SNMP trap, for example, when the information about the source MAC that is being registered to the port changes. 50:35.700 --> 50:37.280 Not all of them are able to do that. 50:37.280 --> 50:40.580 The new Cisco 2950 are able to do that. 50:40.580 --> 50:44.600 But at the end of the day, if you want to start to do log aggregation, be my guest. 50:44.600 --> 50:50.820 I mean, there are other products that do log aggregations and other open source tools. 50:50.820 --> 50:55.080 But if you don't know what you are doing with the information, then it's just a big pile of logs. 50:57.600 --> 50:58.400 Yes? 51:03.380 --> 51:04.600 You said what? 51:05.920 --> 51:08.800 Yes, it is possible in several cases to detect subs. 51:10.200 --> 51:17.920 Basically, the issue is that if you have a port which you see multiple MAC addresses and is not connected to any other switch, then guess what? 51:17.920 --> 51:19.100 You have a hub. 51:19.100 --> 51:24.760 Of course, it might be a 4 port or a 6 port or a 16 port, but no more than that. 51:24.860 --> 51:26.180 A hub is merely a guess. 51:26.180 --> 51:31.120 But if you don't have any other switch connected to that port, you basically have a hub there. 51:32.700 --> 51:33.860 Of course. 51:33.860 --> 51:41.480 You must be connected as close as possible to the access layer in order to do anything in networking and security these days. 51:41.920 --> 51:42.820 Yes? 51:58.960 --> 52:02.400 If you are using TTL, it means that you are going to fail. 52:02.540 --> 52:06.700 That's something very easy to change and you don't want to use that. 52:06.700 --> 52:09.920 Look at the example that I put here. 52:10.700 --> 52:13.300 You have two ways of doing that. 52:13.300 --> 52:16.500 You have a bridge mode and you have a NAT mode. 52:16.700 --> 52:20.700 Both of them, you need to have different ways in understanding that you have VMware. 52:20.700 --> 52:26.000 I mean, it's very easy to understand that an element is a VMware machine just by looking at the MAC address and it's VMware, right? 52:26.200 --> 52:35.660 But the thing that you need to do is that you need to actually understand where it is being connected to and that's other algorithms that I'm using to do that. 52:37.160 --> 52:40.160 Okay, so they need to... yeah, one other question. 52:45.670 --> 52:46.550 No. 52:47.910 --> 52:51.950 This works against whatever you put and if you have VLANs, that's not a problem. 52:52.210 --> 52:56.030 If this wasn't working with VLANs, then I guess it was a major problem. 52:56.270 --> 52:59.190 It is working with VLANs with everything they have on the network. 53:00.950 --> 53:06.390 So, I would like to thank you that you have stayed with me through all of the problems that we had today. 53:06.390 --> 53:09.050 Starting late, replacing laptops. 53:10.950 --> 53:13.810 And staying up until 5 minutes to 9 p.m. 53:13.810 --> 53:15.350 Thank you very much for having me here. 53:15.350 --> 53:16.410 I enjoyed this.