1
00:00:00,417 --> 00:00:03,209
JOHN ORTIZ: All right.How is everybody doing today?

2
00:00:03,209 --> 00:00:04,292
It's great to be here.

3
00:00:04,292 --> 00:00:07,667
(Applause.)    JOHN ORTIZ: I developed this presentation

4
00:00:07,667 --> 00:00:11,584
and I hope that you all find the various tools

5
00:00:11,584 --> 00:00:16,918
on here interesting and most of all fun and useful, as useful

6
00:00:16,918 --> 00:00:19,999
as I have over the years.

7
00:00:19,999 --> 00:00:22,000
See, try that now.

8
00:00:22,501 --> 00:00:23,501
All right.

9
00:00:23,501 --> 00:00:24,501
There we go.

10
00:00:25,292 --> 00:00:28,125
Anybody know what that is a picture of on the screen?

11
00:00:28,125 --> 00:00:29,125
Raise your hands.

12
00:00:29,125 --> 00:00:30,209
Just kind of curious.

13
00:00:30,334 --> 00:00:31,918
One person, all right!

14
00:00:32,959 --> 00:00:35,501
And the audio did not work.

15
00:00:35,999 --> 00:00:38,250
Try that one more time.

16
00:00:38,250 --> 00:00:44,999
(Squealing sound, static.)    JOHN ORTIZ: That's what

17
00:00:44,999 --> 00:00:50,042
solitaire sounds like when you play it

18
00:00:50,042 --> 00:00:53,999
through a sound file.

19
00:00:54,501 --> 00:00:56,209
We'll get back to that.

20
00:00:56,375 --> 00:00:57,876
All right.

21
00:00:57,876 --> 00:00:59,918
So what can us defenders do?

22
00:00:59,999 --> 00:01:02,709
You know, sometimes I'm sure all of you had had malware attack

23
00:01:02,709 --> 00:01:04,125
your system.

24
00:01:04,709 --> 00:01:08,959
It does stuff, drops files, changes register keys, stuff like that.

25
00:01:08,959 --> 00:01:10,417
You want to know what happened.

26
00:01:11,584 --> 00:01:16,999
Another useful topic we'll talk today is file content type identification.

27
00:01:17,083 --> 00:01:20,959
Just because a file has an extension, that doesn't mean that's what it is.

28
00:01:20,959 --> 00:01:24,709
We will look a little deeper than looking at the magic numbers and so forth.

29
00:01:24,999 --> 00:01:28,125
A little bit of steganalysis, a little bit of XOR encryption.

30
00:01:30,999 --> 00:01:33,999
There's stego tools, they are all on the CD.

31
00:01:33,999 --> 00:01:34,999
I checked this morning and there's a couple

32
00:01:34,999 --> 00:01:37,959
of the analysis tools you'll get to see.

33
00:01:38,167 --> 00:01:45,792
Attackers have tools, packers, encryptors, wrappers -- I wrote that one.

34
00:01:45,792 --> 00:01:46,999
That's just for the fun.

35
00:01:46,999 --> 00:01:48,999
Various stego tools out there.

36
00:01:48,999 --> 00:01:49,999
A lot of them.

37
00:01:51,167 --> 00:01:54,209
Hex editors and strings, you know what that is.

38
00:01:54,250 --> 00:01:57,999
Footprint that's one I wrote that helps identify what malware did

39
00:01:57,999 --> 00:01:59,959
to your system.

40
00:01:59,999 --> 00:02:04,501
It takes a snapshot of files, registered keys and services.

41
00:02:04,959 --> 00:02:07,542
You can take a later shot and compare them.

42
00:02:08,083 --> 00:02:12,209
Write histogram which is a terrible title but I can't think

43
00:02:12,209 --> 00:02:17,417
of anything else to call it, takes an image of a final and also takes some

44
00:02:17,417 --> 00:02:19,626
basic statistics.

45
00:02:19,626 --> 00:02:22,209
You can learn a lot from just a few basic statistics.

46
00:02:22,542 --> 00:02:24,584
Then the statistical analyzer kind of combines the two

47
00:02:24,584 --> 00:02:26,417
and automates them.

48
00:02:26,417 --> 00:02:28,792
I don't have much time to talk about that one.

49
00:02:28,792 --> 00:02:29,876
It's there and if you want more information,

50
00:02:29,876 --> 00:02:32,876
my contact information is at the end of the presentation.

51
00:02:32,876 --> 00:02:35,709
A little bit about me.

52
00:02:35,709 --> 00:02:38,250
Instead of counting sheep, I count in powers of 2.

53
00:02:38,667 --> 00:02:40,542
I learned how to program at 14.

54
00:02:40,542 --> 00:02:43,083
I did have a couple of Atari games published.

55
00:02:43,459 --> 00:02:45,083
You haven't heard of them.

56
00:02:45,083 --> 00:02:47,125
It wasn't pack man or anything.

57
00:02:47,125 --> 00:02:49,959
I joined the Air Force, got my degrees and now I'm

58
00:02:49,959 --> 00:02:52,999
an engineer at Harris and part-time instructor

59
00:02:52,999 --> 00:02:54,375
at UTSA.

60
00:02:55,417 --> 00:02:57,999
Wrappers is just a small utility.

61
00:02:58,083 --> 00:03:01,250
It will take any file you want and wrap it up into a bitmap header

62
00:03:01,250 --> 00:03:03,334
or wav file header.

63
00:03:03,334 --> 00:03:04,334
Various types.

64
00:03:04,334 --> 00:03:05,501
A few options there.

65
00:03:06,542 --> 00:03:09,167
It's simple, good for demos.

66
00:03:09,959 --> 00:03:12,250
Here is a steg LSB tool.

67
00:03:12,709 --> 00:03:14,459
This one hides in the least significant bit which

68
00:03:14,459 --> 00:03:15,999
is common.

69
00:03:15,999 --> 00:03:17,709
This one has five bits hidden.

70
00:03:17,999 --> 00:03:20,709
First glance if you didn't see the original you might not notice,

71
00:03:20,709 --> 00:03:24,083
but the original, of course, looks a little better.

72
00:03:24,083 --> 00:03:27,292
Think about that, five out of eight bits, that's a lot of data.

73
00:03:28,626 --> 00:03:31,083
This one hides in jpgs.

74
00:03:31,250 --> 00:03:33,959
That's also on the CD.

75
00:03:33,999 --> 00:03:35,167
That's my dog.

76
00:03:35,542 --> 00:03:37,751
He texted me last night.

77
00:03:37,751 --> 00:03:38,751
He's lonely.

78
00:03:39,999 --> 00:03:41,999
You can't see anything, though.

79
00:03:41,999 --> 00:03:46,999
You can't see any artifacts between the original and that one.

80
00:03:47,083 --> 00:03:50,125
So you've got that tool on your CD as well.

81
00:03:50,125 --> 00:03:54,250
We'll show you how you can detect that, though.

82
00:03:54,250 --> 00:03:55,999
Malware effects as I mentioned.

83
00:03:55,999 --> 00:03:58,375
It does lots of different things to your system.

84
00:03:58,709 --> 00:04:00,999
Also sometimes you install these programs, trial programs

85
00:04:00,999 --> 00:04:04,334
or maybe programs you don't want anymore and you did the unregister,

86
00:04:04,334 --> 00:04:07,250
get rid of the register keys and files.

87
00:04:07,834 --> 00:04:13,083
Footprint can help you find out.

88
00:04:13,083 --> 00:04:16,083
It takes a snapshot of the system, stores it in a big log file.

89
00:04:16,209 --> 00:04:19,417
It can save it by size as well.

90
00:04:19,792 --> 00:04:21,999
And date, the date part isn't working yet.

91
00:04:22,167 --> 00:04:23,959
I have to get that one done.

92
00:04:23,959 --> 00:04:25,584
If anybody wants the upgraded version with date,

93
00:04:25,584 --> 00:04:27,375
you can e-mail me.

94
00:04:27,417 --> 00:04:28,999
That's good for finding files that were

95
00:04:28,999 --> 00:04:30,792
recently installed.

96
00:04:30,792 --> 00:04:33,250
Often malware will drop a bunch of files, maybe in different places

97
00:04:33,250 --> 00:04:35,999
but they all have the same date.

98
00:04:36,375 --> 00:04:39,751
This can identify stuff that just has been dropped on the system.

99
00:04:39,999 --> 00:04:43,584
If you like getting videos that they don't let you download

100
00:04:43,584 --> 00:04:47,626
or pictures that you can't save picture as, go to content folder,

101
00:04:47,626 --> 00:04:50,792
use this tool and it will find it.

102
00:04:50,834 --> 00:04:53,501
Regular Windows browser and searching doesn't search

103
00:04:53,501 --> 00:04:55,709
the content folder.

104
00:04:56,083 --> 00:04:58,999
If you get there and -- you don't have to get there.

105
00:04:58,999 --> 00:05:01,792
Write it from the C drive and it will list the files.

106
00:05:02,292 --> 00:05:05,876
And you can find that video and copy it from that folder

107
00:05:05,876 --> 00:05:08,792
to what you want to use it for.

108
00:05:09,626 --> 00:05:12,501
Footprint can compare the two different files.

109
00:05:12,584 --> 00:05:15,667
Log files, here is all the files.

110
00:05:15,667 --> 00:05:16,999
What has changed.

111
00:05:17,083 --> 00:05:18,542
Same thing with registry keys, same thing

112
00:05:18,542 --> 00:05:20,959
with processes and services.

113
00:05:20,959 --> 00:05:22,999
This is a sample output I'm going to go through quick

114
00:05:22,999 --> 00:05:27,083
to show you how it shows you if the file was deleted or added.

115
00:05:27,626 --> 00:05:29,999
It's a textual program.

116
00:05:30,334 --> 00:05:33,834
Here is what the file looks like when it's modified.

117
00:05:33,999 --> 00:05:36,250
It creates a big log file or small.

118
00:05:36,250 --> 00:05:40,751
There hasn't been any changes since the last footprint.

119
00:05:40,918 --> 00:05:42,626
File type characters.

120
00:05:42,626 --> 00:05:44,626
Malware often disguises itself.

121
00:05:44,626 --> 00:05:47,292
May be encrypted.

122
00:05:47,584 --> 00:05:48,999
This can help detect that.

123
00:05:51,209 --> 00:05:55,292
The write bit histogram map tool can do things.

124
00:05:55,292 --> 00:05:58,083
It can create a bitmap image as you saw in the beginning.

125
00:05:58,083 --> 00:05:59,999
That was solitaire.

126
00:05:59,999 --> 00:06:02,999
One person probably recognized that as executable.

127
00:06:03,292 --> 00:06:05,999
The chart on the right was a histogram.

128
00:06:05,999 --> 00:06:10,250
That's typical for a executable.

129
00:06:10,751 --> 00:06:14,584
And then before discussing the tools, you have to do a little bit of math.

130
00:06:14,999 --> 00:06:16,209
Once we get through the math -- there's a lot

131
00:06:16,209 --> 00:06:18,501
of slides in this presentation.

132
00:06:19,584 --> 00:06:22,501
So once we get through the math and you understand a little bit

133
00:06:22,501 --> 00:06:25,667
about the tools as it goes on and its uses, if we don't get finish,

134
00:06:25,667 --> 00:06:28,999
it will be easy for you to figure out on your own.

135
00:06:29,083 --> 00:06:32,375
Who has heard of entropy before and knows what it is?

136
00:06:32,999 --> 00:06:35,999
Okay, curious, looks like half or so.

137
00:06:35,999 --> 00:06:36,999
Very good.

138
00:06:37,334 --> 00:06:38,751
What about a histogram?

139
00:06:38,751 --> 00:06:40,250
You all know what a histogram is?

140
00:06:40,250 --> 00:06:41,999
About the same people.

141
00:06:42,459 --> 00:06:44,250
All right.

142
00:06:44,250 --> 00:06:47,584
Usually we consider, of course, bytes with considers, the 255.

143
00:06:47,709 --> 00:06:49,667
So the maximum entropy is the log base 2

144
00:06:49,667 --> 00:06:52,542
of the total number of symbols.

145
00:06:52,918 --> 00:06:57,167
So log base 2 of 256 different symbols is 8.

146
00:06:57,417 --> 00:07:00,375
The maximum entropy for a file can be 8.

147
00:07:00,709 --> 00:07:04,999
If that file is base 32 encoded, maximum entropy is going to be 5.

148
00:07:05,542 --> 00:07:07,999
I don't have an example in the slides this time,

149
00:07:07,999 --> 00:07:11,876
but you can actually tell if the base 32 encoding has encoded

150
00:07:11,876 --> 00:07:17,334
an encrypted file or if it's encoded a text file just by using this tool.

151
00:07:18,542 --> 00:07:24,792
And, well, of course, for base 64, that's a little quiz to -- two to the 6 is 64.

152
00:07:24,834 --> 00:07:26,542
Who got a gold star?

153
00:07:26,999 --> 00:07:28,250
One person.

154
00:07:28,250 --> 00:07:29,250
very good.

155
00:07:29,250 --> 00:07:30,250
Two.

156
00:07:30,709 --> 00:07:33,209
A little bit of statistics here.

157
00:07:33,417 --> 00:07:35,083
So P is the probability.

158
00:07:35,542 --> 00:07:39,876
The log is often abbreviated LG to mean log base two.

159
00:07:40,083 --> 00:07:42,999
That's simply two to what power equals X?

160
00:07:44,751 --> 00:07:49,876
Log base two of 64 -- log base two of eight is three and so on.

161
00:07:50,250 --> 00:07:55,334
We can estimate the probability in a file by counting.

162
00:07:55,334 --> 00:07:57,876
So you take a file, count how many zero bytes,

163
00:07:57,876 --> 00:08:01,999
count how many one bytes, how many 2 bytes, so on.

164
00:08:02,542 --> 00:08:05,083
That's the histogram, the frequency distribution

165
00:08:05,083 --> 00:08:08,292
of each byte is another way of putting it.

166
00:08:08,584 --> 00:08:11,083
So giving that count and the total number of bytes,

167
00:08:11,083 --> 00:08:14,959
we can compute the probability for each byte.

168
00:08:14,959 --> 00:08:17,999
So we can say, you know, zero up here, 25 times out of 100, we can say

169
00:08:17,999 --> 00:08:20,375
the probability is .25.

170
00:08:20,709 --> 00:08:24,292
And then we can plug into this nice nifty formula here which

171
00:08:24,292 --> 00:08:27,751
looks complicated but it's really just a four loop that

172
00:08:27,751 --> 00:08:31,999
is multiplying the probability times the log base 2 of the probability

173
00:08:31,999 --> 00:08:34,209
and adding it all up.

174
00:08:34,209 --> 00:08:36,250
You'll get a negative number out of that.

175
00:08:36,250 --> 00:08:38,626
I'll skip the log derivations for today.

176
00:08:39,250 --> 00:08:41,834
You add it up and get an entropy count.

177
00:08:41,834 --> 00:08:43,459
8 is the entropy.

178
00:08:43,792 --> 00:08:46,999
Encrypted files have the greatest entropy.

179
00:08:46,999 --> 00:08:50,083
Compressed files are next and so on.

180
00:08:50,083 --> 00:08:55,584
Every file type generally has some characteristic range of entropy.

181
00:08:55,584 --> 00:08:59,667
Twenty-four bit bitmaps I found have been very varied but executable files,

182
00:08:59,667 --> 00:09:04,751
text files, they are kind of in a range, compressed and encrypted files are

183
00:09:04,751 --> 00:09:07,209
in a very narrow range.

184
00:09:07,250 --> 00:09:09,999
You can identify a lot just by the entropy.

185
00:09:11,584 --> 00:09:15,999
So bottom line is, the higher the entropy, the more uncertainty.

186
00:09:15,999 --> 00:09:18,083
That's what you want in an encrypted file.

187
00:09:18,083 --> 00:09:18,999
You don't want the opponent, the attacker

188
00:09:18,999 --> 00:09:21,375
to know what you encrypted.

189
00:09:21,375 --> 00:09:25,375
You done want to have any kind of information about what symbols are.

190
00:09:25,542 --> 00:09:27,999
Compressed removes pattern.

191
00:09:27,999 --> 00:09:30,999
Once you remove pattern you get a randomized looking file, but it's not

192
00:09:30,999 --> 00:09:33,626
as random as an encrypted file.

193
00:09:34,876 --> 00:09:41,542
English text I found to be around 4.5, 4.6, 4.3, in a narrow range.

194
00:09:41,542 --> 00:09:43,292
You can identify that immediately.

195
00:09:44,083 --> 00:09:47,959
Now, of course, it does depend on having sufficient data.

196
00:09:47,999 --> 00:09:48,999
Okay?

197
00:09:48,999 --> 00:09:50,501
Very small files, the entropy counts are going

198
00:09:50,501 --> 00:09:52,083
to be skewed.

199
00:09:52,167 --> 00:09:55,417
I found that in practice around 4K is where it starts

200
00:09:55,417 --> 00:09:58,250
to get reasonably accurate.

201
00:09:58,250 --> 00:10:01,751
Of course, the more you have, the more accurate it looks.

202
00:10:02,999 --> 00:10:06,667
So histogram, I kind of talked about that already just on the chart,

203
00:10:06,667 --> 00:10:09,125
on the left side of the chart.

204
00:10:09,125 --> 00:10:10,999
That's going to be the zero count.

205
00:10:10,999 --> 00:10:13,167
On the right side of the chart is the 255 count.

206
00:10:13,167 --> 00:10:17,042
And the darker lines are at 16 value intervals.

207
00:10:17,042 --> 00:10:18,999
It's 16, the line is darker.

208
00:10:18,999 --> 00:10:22,125
Thirty-two, the line is darker, just to break it up a little bit.

209
00:10:22,834 --> 00:10:27,292
Many file types I discovered have unique histogram characteristics.

210
00:10:27,542 --> 00:10:29,292
So I use that.

211
00:10:29,292 --> 00:10:31,918
You can identify them very quickly in many cases.

212
00:10:32,125 --> 00:10:35,000
So of course, here is how you identify a file?

213
00:10:35,000 --> 00:10:36,167
You have this new file.

214
00:10:36,167 --> 00:10:37,167
What is it?

215
00:10:37,167 --> 00:10:40,626
You look at the extension, but that doesn't mean anything, right?

216
00:10:40,626 --> 00:10:41,999
You look at the magic number.

217
00:10:41,999 --> 00:10:45,000
That may mean something if it's not disguised as something.

218
00:10:45,000 --> 00:10:46,542
We can apply visualization.

219
00:10:46,542 --> 00:10:47,999
That's what this tool does.

220
00:10:47,999 --> 00:10:50,999
It will do the audioization, which is a strange word, but it

221
00:10:50,999 --> 00:10:53,501
is actually out there.

222
00:10:53,501 --> 00:10:55,999
And statistics.

223
00:10:56,999 --> 00:10:59,792
So here is where you check on the file.

224
00:10:59,792 --> 00:11:00,792
What's in it?

225
00:11:00,792 --> 00:11:02,125
Does it match its extension?

226
00:11:02,125 --> 00:11:03,501
Does it have unusual data?

227
00:11:03,501 --> 00:11:05,751
Does it have hidden or appear pended data?

228
00:11:05,751 --> 00:11:07,125
Is part of it compressed?

229
00:11:07,125 --> 00:11:08,459
We can tell a lot.

230
00:11:09,292 --> 00:11:10,667
All right.

231
00:11:10,667 --> 00:11:13,542
That's just a command line for using the histogram tool.

232
00:11:13,542 --> 00:11:15,417
All of the tools have usage functions.

233
00:11:15,417 --> 00:11:16,999
I'm sure you can figure them out.

234
00:11:17,501 --> 00:11:18,834
Here is a text file.

235
00:11:18,834 --> 00:11:20,375
On the left is what it looks like.

236
00:11:20,375 --> 00:11:23,501
You can see it's dark because the text is all below 28.

237
00:11:23,542 --> 00:11:25,626
It's all the darker shades of gray.

238
00:11:25,834 --> 00:11:28,167
On the right you can see the histogram.

239
00:11:28,459 --> 00:11:30,959
What character is this, do you think?

240
00:11:30,999 --> 00:11:32,751
(Speaker away from microphone.)    JOHN ORTIZ:

241
00:11:32,751 --> 00:11:35,999
Right, space is the most common character in text.

242
00:11:35,999 --> 00:11:38,083
Followed by the E and the T.

243
00:11:38,083 --> 00:11:41,083
These are lower case.

244
00:11:41,083 --> 00:11:42,999
Upper case is hard to see in this one.

245
00:11:42,999 --> 00:11:44,167
Not much upper case.

246
00:11:44,417 --> 00:11:47,999
You can see the pairing, character turn line feed.

247
00:11:48,417 --> 00:11:50,125
Those are all the same size there.

248
00:11:50,542 --> 00:11:52,083
You can see that.

249
00:11:52,083 --> 00:11:55,626
This is the text output of the program.

250
00:11:55,626 --> 00:11:58,250
So that gives you like the exact numbers.

251
00:11:58,250 --> 00:11:59,999
So you can see the exact counts.

252
00:11:59,999 --> 00:12:02,501
Sometimes it's useful because, of course, the visual one

253
00:12:02,501 --> 00:12:04,584
is scaled, right?

254
00:12:04,584 --> 00:12:06,999
You can't necessarily see the difference between a few values

255
00:12:06,999 --> 00:12:08,999
on a large histogram.

256
00:12:09,834 --> 00:12:11,584
Here is HTML.

257
00:12:11,584 --> 00:12:14,792
So you see that has some textual characteristics but it also has

258
00:12:14,792 --> 00:12:16,667
a lot of pairings.

259
00:12:16,667 --> 00:12:19,792
HTML has all the tags with the braces and so forth.

260
00:12:19,999 --> 00:12:21,083
You can see that here.

261
00:12:21,125 --> 00:12:22,999
C source code, Java code and stuff shows

262
00:12:22,999 --> 00:12:24,999
up the same way.

263
00:12:24,999 --> 00:12:28,083
You get pairings, so you can see the difference between C++,.

264
00:12:31,250 --> 00:12:36,999
Here is the bitmap, a bitmap of a bitmap.

265
00:12:36,999 --> 00:12:39,959
It kind of gets out of synchronization there.

266
00:12:39,959 --> 00:12:42,626
But you can see that it's smooth.

267
00:12:42,626 --> 00:12:45,501
That's the characteristic of a natural bitmap.

268
00:12:45,501 --> 00:12:46,834
All of them are smooth.

269
00:12:46,834 --> 00:12:50,999
If they are not fairly smooth, then something is going on.

270
00:12:51,209 --> 00:12:55,959
Now, eight-bit gray scale is very spikey, just like that.

271
00:12:55,959 --> 00:12:58,751
As well as a eight-bit color bitmap.

272
00:12:58,999 --> 00:13:02,999
We don't know where the spikes are, which values are the most common,

273
00:13:02,999 --> 00:13:05,459
but they all look spikey.

274
00:13:05,459 --> 00:13:07,334
Of course, for some of you that know gray scale,

275
00:13:07,334 --> 00:13:12,542
eight bit gray scale and eight bit color is the same in terms of the file content.

276
00:13:12,542 --> 00:13:14,542
It's just the pallet that's different.

277
00:13:15,375 --> 00:13:16,959
Speech.

278
00:13:17,167 --> 00:13:21,459
All eight bit wave files that are natural wav files look like this.

279
00:13:21,999 --> 00:13:24,626
Waves os late around the central ac six.

280
00:13:25,501 --> 00:13:28,792
As you go out towards the edges you get fewer values.

281
00:13:28,959 --> 00:13:31,999
Music is fewer than speech.

282
00:13:31,999 --> 00:13:34,375
You get the central spike.

283
00:13:35,250 --> 00:13:39,834
Sixteen-bit speech, it's a little tough to notice at first, but you get -- where

284
00:13:39,834 --> 00:13:41,501
is my cursor?

285
00:13:41,501 --> 00:13:43,876
You get a U-shape, very open U there

286
00:13:43,876 --> 00:13:48,999
because there's very little in the upper extremities.

287
00:13:48,999 --> 00:13:50,709
These are the upper extremities.

288
00:13:50,709 --> 00:13:52,375
There's very few samples up there.

289
00:13:52,375 --> 00:13:55,999
When you get music like that, you get a Fuller U shape.

290
00:13:56,125 --> 00:13:59,918
Fit doesn't have a U-shape, it's not 16-bit audio.

291
00:13:59,999 --> 00:14:03,709
You can take anything, just like I did with the solitaire program

292
00:14:03,709 --> 00:14:08,792
and wrap it up in a wav file header and you will not get this histogram.

293
00:14:08,959 --> 00:14:10,209
It will not look like this.

294
00:14:10,209 --> 00:14:15,501
Natural audio all has a U-type or pointed type shape if it's eight bits.

295
00:14:16,083 --> 00:14:19,250
Jpg, this one has a lot of zeros.

296
00:14:19,250 --> 00:14:23,792
It's uniform over here and fairly flat over there.

297
00:14:23,792 --> 00:14:25,250
That's characteristic of jpg.

298
00:14:25,250 --> 00:14:27,709
Some of them are more spikey than others, but they all have

299
00:14:27,709 --> 00:14:31,125
a reasonably uniform distribution across the top.

300
00:14:31,709 --> 00:14:36,209
PE files typically have large numbers of zeros and large numbers of FF

301
00:14:36,209 --> 00:14:38,918
and various values here.

302
00:14:39,083 --> 00:14:41,584
The thing about the PE file that is very characteristic

303
00:14:41,584 --> 00:14:43,999
is that it has different sections.

304
00:14:43,999 --> 00:14:46,999
So it looks like a text section and which is the actual code

305
00:14:46,999 --> 00:14:51,459
and then various sections in here of different data types.

306
00:14:51,459 --> 00:14:54,334
They all have kind of a striped look.

307
00:14:54,918 --> 00:14:57,999
Encrypted, I use a program called AX crypt which

308
00:14:57,999 --> 00:15:00,999
is available for free download.

309
00:15:00,999 --> 00:15:02,751
It has been out there a few years.

310
00:15:02,751 --> 00:15:03,999
You can see this, you can't really see

311
00:15:03,999 --> 00:15:07,584
the difference between the jpg, but this you can.

312
00:15:07,584 --> 00:15:08,667
It's very, very flat.

313
00:15:08,667 --> 00:15:11,375
It gets flatter as the file gets larger.

314
00:15:12,999 --> 00:15:14,501
All right.

315
00:15:14,501 --> 00:15:16,167
So file type identification.

316
00:15:16,167 --> 00:15:17,375
That's kind the overview of some of the things,

317
00:15:17,375 --> 00:15:21,083
the tools that you would be looking for when you use them.

318
00:15:21,209 --> 00:15:22,626
So here is this one.

319
00:15:22,626 --> 00:15:24,626
Can you tell, compressed or encrypted?

320
00:15:24,626 --> 00:15:26,751
Just by looking at the picture of the file.

321
00:15:26,999 --> 00:15:27,999
Not really.

322
00:15:27,999 --> 00:15:31,250
But from the histogram, and especially the entropy value, this

323
00:15:31,250 --> 00:15:34,250
is the entropy calculation over here.

324
00:15:34,709 --> 00:15:35,999
It's easy to tell.

325
00:15:35,999 --> 00:15:39,626
Ebb entropy .99997 for the encrypted file.

326
00:15:39,999 --> 00:15:42,999
Unless the files are pretty small you can use this to distinguish

327
00:15:42,999 --> 00:15:45,375
between compressed and encrypted.

328
00:15:45,375 --> 00:15:47,876
Even if they are small, the entropy for the encrypted will go

329
00:15:47,876 --> 00:15:51,959
down but the entropy for the compressed will go even further.

330
00:15:52,999 --> 00:15:54,918
Packed or unpacked.

331
00:15:55,250 --> 00:15:56,751
Here is executable.

332
00:15:57,083 --> 00:15:58,167
Is it packed?

333
00:15:58,167 --> 00:16:00,417
You can't tell by looking at a hex editor.

334
00:16:00,751 --> 00:16:02,999
Here it is looking smooth to me.

335
00:16:03,250 --> 00:16:05,083
Has a large number of zeros which throws

336
00:16:05,083 --> 00:16:09,292
the entropy down, but this looks fairly uniform there.

337
00:16:09,417 --> 00:16:12,083
I'm going to say it's more than likely packed unless it's full

338
00:16:12,083 --> 00:16:14,083
of compressed data.

339
00:16:14,083 --> 00:16:18,125
Maybe you have an executable full of jpgs as resources.

340
00:16:19,918 --> 00:16:21,751
Packed or not packed?

341
00:16:22,083 --> 00:16:23,584
Quite a difference, right?

342
00:16:23,709 --> 00:16:24,667
Now, this is thrown off a little bit

343
00:16:24,667 --> 00:16:27,083
because of the large number of zeros.

344
00:16:27,083 --> 00:16:28,375
All this has to be scaled.

345
00:16:28,375 --> 00:16:29,501
It's just a spikey.

346
00:16:29,501 --> 00:16:30,834
You can see the different patterns going

347
00:16:30,834 --> 00:16:32,667
throughout there.

348
00:16:32,876 --> 00:16:35,876
I use this to examine a RAM one time and there was -- ROM

349
00:16:35,876 --> 00:16:37,250
one time.

350
00:16:37,250 --> 00:16:39,999
There was one area that was all white.

351
00:16:40,083 --> 00:16:44,250
That was the area that was the RAM on the firm water.

352
00:16:44,250 --> 00:16:48,792
It was like a firmware download, it was the RAM on the, where it's blank.

353
00:16:50,083 --> 00:16:54,959
Here is a histogram with the zeros going off the scale.

354
00:16:54,999 --> 00:16:57,626
It looks kind of like an executable.

355
00:16:57,626 --> 00:17:00,834
However, you can see a little bit of uniformity down there, kind

356
00:17:00,834 --> 00:17:02,834
of in the bottom.

357
00:17:02,959 --> 00:17:05,834
So I would say that maybe this has some packed data in it that

358
00:17:05,834 --> 00:17:08,542
the whole thing isn't packed up.

359
00:17:09,999 --> 00:17:11,250
All right.

360
00:17:11,250 --> 00:17:13,999
So histograms and entropy aren't always effective.

361
00:17:14,083 --> 00:17:17,999
This is the full color bitmap that you saw earlier in black and white.

362
00:17:17,999 --> 00:17:19,459
You see how it's fairly smooth.

363
00:17:19,918 --> 00:17:21,876
Let's see if we are hiding something.

364
00:17:21,876 --> 00:17:23,626
Data appended to the end of the file.

365
00:17:23,626 --> 00:17:25,959
Statistics don't tell you much about it.

366
00:17:25,999 --> 00:17:29,999
However, if you look at the histogram, you can see that.

367
00:17:30,334 --> 00:17:34,209
That's unusual for a 24 bitmap to have these kind of spikes in there.

368
00:17:35,083 --> 00:17:37,542
Some of that comes from experience.

369
00:17:37,542 --> 00:17:39,918
I have done this on hundreds and hundreds of bitmaps and looked

370
00:17:39,918 --> 00:17:42,792
at them over the years in preparing several other talks

371
00:17:42,792 --> 00:17:44,417
and so forth.

372
00:17:44,667 --> 00:17:46,167
Here is the bitmap showing the picture

373
00:17:46,167 --> 00:17:49,584
of it and then you can see some data hiding at the end, okay,

374
00:17:49,584 --> 00:17:53,417
because that's got a different characteristic there.

375
00:17:53,459 --> 00:17:55,501
So that can reveal something.

376
00:17:56,709 --> 00:17:58,959
Are we using steganography?

377
00:17:58,999 --> 00:18:01,999
LSB steganography hides the least significant bit.

378
00:18:01,999 --> 00:18:04,999
Very difficult to see if the number is less than four.

379
00:18:04,999 --> 00:18:09,250
There are images where you can see them, but others where you can't.

380
00:18:09,709 --> 00:18:12,751
Sometimes even at four bit -- at four bits in a normal picture you can't

381
00:18:12,751 --> 00:18:14,125
even tell.

382
00:18:14,125 --> 00:18:16,709
Five bits is where you can really start to tell.

383
00:18:17,083 --> 00:18:19,083
What about with the histogram?

384
00:18:19,542 --> 00:18:22,083
Of course, otherwise I wouldn't bring it up, right?

385
00:18:23,542 --> 00:18:25,999
Okay, here is honey bee, the original.

386
00:18:26,125 --> 00:18:29,375
You can see a fairly smooth histogram there, 7.55,

387
00:18:29,375 --> 00:18:33,083
we go to one bit of randomized data.

388
00:18:33,083 --> 00:18:35,834
Tough to tell on that one, right?

389
00:18:36,542 --> 00:18:41,083
That would not raise my alert flag there, looking at that histogram.

390
00:18:41,083 --> 00:18:43,667
It's a little spikey, but not too much.

391
00:18:43,999 --> 00:18:45,375
We go to two bits.

392
00:18:46,626 --> 00:18:48,292
Three bits.

393
00:18:49,417 --> 00:18:51,083
Four bits.

394
00:18:51,334 --> 00:18:53,250
It's getting easy to tell.

395
00:18:53,667 --> 00:18:56,584
The picture, however, can you tell by the picture?

396
00:18:56,584 --> 00:19:00,999
I think on this particular image the background is a little blurred.

397
00:19:00,999 --> 00:19:02,626
So you've got some smoothness.

398
00:19:02,626 --> 00:19:05,083
You can actually tell in the picture a little bit.

399
00:19:05,083 --> 00:19:08,709
Go back to three and look at the green background and go to four.

400
00:19:08,999 --> 00:19:11,999
You can see little bits of discoloration there.

401
00:19:12,167 --> 00:19:16,083
In the fore ground where there's lots of detail, you don't really see that.

402
00:19:16,083 --> 00:19:17,959
However, the histogram is clear.

403
00:19:18,459 --> 00:19:23,083
This is not a histogram of a 24-bit bitmap.

404
00:19:23,501 --> 00:19:24,999
Neither is this one.

405
00:19:24,999 --> 00:19:28,125
And that one, that one would raise my suspicion.

406
00:19:28,125 --> 00:19:29,292
So would two-bit.

407
00:19:29,834 --> 00:19:31,584
Let's see if we have five on here.

408
00:19:31,959 --> 00:19:35,083
Oh, yeah, it becomes obvious at that point, right?

409
00:19:35,167 --> 00:19:36,959
You can even tell by the picture.

410
00:19:37,209 --> 00:19:40,999
Even though I didn't know what a honey bee looked like, then that ...

411
00:19:41,125 --> 00:19:44,792
six bits and seven bits.

412
00:19:45,999 --> 00:19:47,334
(Laughter.)    JOHN ORTIZ: Anyone want to guess what kind

413
00:19:47,334 --> 00:19:48,999
of data we're hiding?

414
00:19:48,999 --> 00:19:51,999
It's randomized data, right, because it's flat over here.

415
00:19:51,999 --> 00:19:57,918
We're hiding text data and it gets text look to the histogram at this point.

416
00:19:57,999 --> 00:19:59,709
Then eight bits.

417
00:19:59,709 --> 00:20:03,459
(Laughter.)    JOHN ORTIZ: Now you don't have a bitmap at all, right?

418
00:20:05,250 --> 00:20:07,292
How about jpg?

419
00:20:07,292 --> 00:20:08,292
Does this work?

420
00:20:09,334 --> 00:20:13,417
Here is my favorite pet, Mandy.

421
00:20:14,918 --> 00:20:17,667
She actually looks kind of annoyed.

422
00:20:17,667 --> 00:20:21,250
(Chuckles.)    JOHN ORTIZ: I mean, like why are you taking this picture?

423
00:20:21,999 --> 00:20:24,751
And that's the histogram of the jpg.

424
00:20:24,751 --> 00:20:27,999
Entropy is fairly high, but it's not like an encrypted file.

425
00:20:28,000 --> 00:20:33,250
Here is Mandy with 146,256 bytes of hidden data.

426
00:20:35,876 --> 00:20:37,792
She still looks annoyed.

427
00:20:38,000 --> 00:20:40,042
But you can't really tell.

428
00:20:40,042 --> 00:20:41,125
I can't tell.

429
00:20:41,167 --> 00:20:43,999
I can't tell even if I flip between the two of those.

430
00:20:44,459 --> 00:20:46,999
The entropy is a bit higher, though.

431
00:20:46,999 --> 00:20:48,000
7.97.

432
00:20:48,334 --> 00:20:49,334
Right?

433
00:20:49,334 --> 00:20:50,876
So that gets a little higher.

434
00:20:50,999 --> 00:20:54,334
Still you might find jpgs with that much entropy.

435
00:20:54,751 --> 00:20:56,876
How about an image of the jpg?

436
00:20:57,083 --> 00:20:58,334
That doesn't work.

437
00:20:59,334 --> 00:21:03,542
However, if we decompose the jpg into its DCT coefficients

438
00:21:03,542 --> 00:21:07,709
and take a histogram of that, which is where we're hiding,

439
00:21:07,709 --> 00:21:12,417
then it's quite obvious that on this side it's very matching, which

440
00:21:12,417 --> 00:21:14,959
is normal for a jpg.

441
00:21:14,959 --> 00:21:16,125
They don't match exactly.

442
00:21:16,125 --> 00:21:17,999
I know these look like they're exact, but if you look at the raw numbers,

443
00:21:17,999 --> 00:21:19,751
they are not exact.

444
00:21:19,751 --> 00:21:20,959
They are close.

445
00:21:21,083 --> 00:21:25,125
This is one, two, three -- this is like a plus eight and minus eight

446
00:21:25,125 --> 00:21:26,999
or something.

447
00:21:28,999 --> 00:21:30,792
The generally the plus coefficients match

448
00:21:30,792 --> 00:21:32,834
the minus coefficients.

449
00:21:32,959 --> 00:21:35,959
One and negative one, two and negative two and so forth.

450
00:21:36,083 --> 00:21:39,999
When you start messing with those and hiding, they don't match anymore.

451
00:21:40,999 --> 00:21:44,709
And it's easy to figure out why.

452
00:21:44,709 --> 00:21:47,209
If you are hiding something in a negative one and you change

453
00:21:47,209 --> 00:21:51,125
the least significant bit, what does that number become?

454
00:21:54,626 --> 00:21:56,375
(There is no response.)    JOHN ORTIZ: No,

455
00:21:56,375 --> 00:22:00,334
no, you have a negative one and you change the least significant bit.

456
00:22:00,334 --> 00:22:01,667
AUDIENCE: (Speaker away from microphone.)    JOHN ORTIZ:

457
00:22:01,667 --> 00:22:03,250
Negative two, right?

458
00:22:03,250 --> 00:22:06,626
If you have a one and you change the least significant bit it becomes

459
00:22:06,626 --> 00:22:07,999
a zero.

460
00:22:08,667 --> 00:22:11,292
Even if you change one and negative one evenly,

461
00:22:11,292 --> 00:22:13,584
they are off balance.

462
00:22:13,751 --> 00:22:14,751
Okay?

463
00:22:14,959 --> 00:22:18,334
So that one is a little bit, takes a little more work to hide.

464
00:22:18,334 --> 00:22:21,417
There are some stego programs that try to balance those out.

465
00:22:21,417 --> 00:22:24,542
The one you have will produce the histogram like this.

466
00:22:24,626 --> 00:22:26,999
Doesn't try to balance them out.

467
00:22:27,792 --> 00:22:31,083
AUDIENCE: (Speaker away from microphone.)    JOHN ORTIZ:

468
00:22:31,083 --> 00:22:34,918
Yeah, the tool that I provided on the DEF CON CD for hiding a jpg

469
00:22:34,918 --> 00:22:38,751
will do the hiding that you've seen here, but it doesn't do anything

470
00:22:38,751 --> 00:22:41,417
to balance the DCT histograms.

471
00:22:41,999 --> 00:22:43,375
Okay?

472
00:22:43,959 --> 00:22:46,083
Wow, we might actually have time for demos.

473
00:22:46,083 --> 00:22:48,542
I didn't think I would get through it this fast.

474
00:22:48,542 --> 00:22:49,959
There are so many slides, people said you are not going

475
00:22:49,959 --> 00:22:52,999
through 75 to 80 slides in just 45 minutes.

476
00:22:53,083 --> 00:22:54,667
There's lots of pictures.

477
00:22:56,667 --> 00:22:58,876
Am I going too fast?

478
00:22:59,250 --> 00:23:00,417
Okay, all right.

479
00:23:00,417 --> 00:23:04,209
Let me try some demos reversing XOR.

480
00:23:04,375 --> 00:23:05,999
I would have put more in this if I had known I would get

481
00:23:05,999 --> 00:23:07,751
through this fast.

482
00:23:12,083 --> 00:23:15,626
Something XORed with zero will be itself.

483
00:23:15,999 --> 00:23:18,959
I don't think I wrote it up here, but the reason that XOR

484
00:23:18,959 --> 00:23:22,083
is so popular in encryptgraphy, when you XOR something

485
00:23:22,083 --> 00:23:24,999
with a key you get cypher text.

486
00:23:24,999 --> 00:23:28,584
When you X over the cypher text with the key, you get the original.

487
00:23:28,584 --> 00:23:32,167
XORing it twice retrieves the original.

488
00:23:32,959 --> 00:23:36,125
Notice this, this is an interesting property of XOR.

489
00:23:36,125 --> 00:23:41,999
A lot of malware will use basic encryption to hide stuff.

490
00:23:41,999 --> 00:23:46,334
Something XORed with a space will change the letter.

491
00:23:52,083 --> 00:23:56,999
If you XOR a capital letter -- it becomes an upper case letter and of course,

492
00:23:56,999 --> 00:23:59,667
that's typically the most common character

493
00:23:59,667 --> 00:24:02,083
in the English language.

494
00:24:02,417 --> 00:24:05,584
XORing with a single character doesn't even change

495
00:24:05,584 --> 00:24:08,999
the entropy F you use a one-key XOR and XOR the thing

496
00:24:08,999 --> 00:24:12,542
with the key, the entropy stays the same.

497
00:24:12,542 --> 00:24:13,918
Gets shifted a little bit.

498
00:24:14,626 --> 00:24:19,167
Here is a text file that has been XORed with some character.

499
00:24:19,667 --> 00:24:23,751
You get the same characteristic spikes kind of grouped together.

500
00:24:23,999 --> 00:24:25,792
You get a brighter visual because now

501
00:24:25,792 --> 00:24:28,626
all these values are upper side of the bit values

502
00:24:28,626 --> 00:24:31,083
instead of the lower side.

503
00:24:31,209 --> 00:24:35,876
But it's still kind of looks like a permuted English text histogram.

504
00:24:36,083 --> 00:24:37,999
So that can be revealed.

505
00:24:39,626 --> 00:24:42,876
So this kind of looks like an executable.

506
00:24:42,876 --> 00:24:44,501
The image does, right?

507
00:24:44,501 --> 00:24:47,083
It looks like this is fairly union tomorrow in here.

508
00:24:47,626 --> 00:24:51,542
So entropy, 7.2, suggests some type of compression or encryption

509
00:24:51,542 --> 00:24:53,959
or weak encryption.

510
00:24:53,999 --> 00:24:56,125
That's another thing I should point out.

511
00:24:56,834 --> 00:25:00,542
The encryption in order for it to have the 7.9999 entropy has

512
00:25:00,542 --> 00:25:02,999
to be good encryption.

513
00:25:02,999 --> 00:25:04,999
If you use weak encryption, you get the same effect

514
00:25:04,999 --> 00:25:07,250
as if it were compressed.

515
00:25:07,292 --> 00:25:08,751
I discovered that once.

516
00:25:08,751 --> 00:25:09,999
A client brought us some stuff and said here,

517
00:25:09,999 --> 00:25:13,584
tell us what you can tell about the network packets.

518
00:25:13,584 --> 00:25:14,584
We said okay.

519
00:25:14,584 --> 00:25:16,083
We did a lot of examination on it.

520
00:25:16,083 --> 00:25:17,501
One of the things I came back with, it says it looks

521
00:25:17,501 --> 00:25:19,959
like you're using weak encryption.

522
00:25:20,125 --> 00:25:21,459
How do you know?

523
00:25:21,667 --> 00:25:23,083
Like this.

524
00:25:24,999 --> 00:25:26,959
Oh, I should back up.

525
00:25:26,959 --> 00:25:31,792
So knowing that the first two bytes in an executable is MZ and that zero

526
00:25:31,792 --> 00:25:36,999
is prevalent can also help you a little bit with that.

527
00:25:36,999 --> 00:25:37,999
Excuse me.

528
00:25:37,999 --> 00:25:40,999
So in the target file we found that two bytes or DNN looking

529
00:25:40,999 --> 00:25:47,292
at the textual histogram we found C, A, N and D are more prevalent than others.

530
00:25:47,292 --> 00:25:50,209
We can start guessing one those might be a space.

531
00:25:50,292 --> 00:25:51,626
One of those might be an E.

532
00:25:51,626 --> 00:25:52,792
One might be a T.

533
00:25:52,792 --> 00:25:57,250
I kind of did some hand waving here because I didn't think I would get

534
00:25:57,250 --> 00:25:59,334
to these slides.

535
00:25:59,709 --> 00:26:04,083
So there's a little bit more to it than that, but the point is that you can use

536
00:26:04,083 --> 00:26:07,167
the entropy and the histograms and the visual tool

537
00:26:07,167 --> 00:26:10,083
to help reverse XOR encryption.

538
00:26:11,999 --> 00:26:13,959
Statistical analyzer.

539
00:26:13,959 --> 00:26:17,375
This takes the footprint perhaps and combines it

540
00:26:17,375 --> 00:26:22,709
with the histogram tool to automate the analysis.

541
00:26:22,709 --> 00:26:25,083
So you set it loose on a directory.

542
00:26:25,083 --> 00:26:26,999
It will iterate through all the subdirectories

543
00:26:26,999 --> 00:26:31,125
and run like ten different statistics, not just entropy.

544
00:26:31,709 --> 00:26:34,125
It will create histograms and bitmap images if you want

545
00:26:34,125 --> 00:26:36,584
and compare it to a baseline.

546
00:26:37,167 --> 00:26:40,834
You compare it to a baseline and it will pop out and spit

547
00:26:40,834 --> 00:26:43,834
out any anomalies that you have.

548
00:26:43,876 --> 00:26:46,250
This one says it's jpg but doesn't look eight it.

549
00:26:48,250 --> 00:26:50,209
It has high entropy.

550
00:26:51,083 --> 00:26:53,999
And I have presented on that particular tool before,

551
00:26:53,999 --> 00:26:55,959
a few years ago.

552
00:26:55,999 --> 00:26:58,709
So I didn't obviously include the whole presentation on that here,

553
00:26:58,709 --> 00:27:02,083
but if anybody is more interested, my contact information is at the end

554
00:27:02,083 --> 00:27:04,334
of the slide presentation.

555
00:27:04,334 --> 00:27:07,626
All right.

556
00:27:07,626 --> 00:27:09,459
I hope you learned something useful.

557
00:27:09,459 --> 00:27:11,999
Looks like we do have some time.

558
00:27:11,999 --> 00:27:14,250
So I can do a few demos for you.

559
00:27:14,626 --> 00:27:16,501
There's my contact information.

560
00:27:16,626 --> 00:27:18,918
And you can e-mail me if you want.

561
00:27:18,999 --> 00:27:21,459
Here is some blogs at Harris@relevant.

562
00:27:22,834 --> 00:27:25,999
Reversing XOR encryption, somebody else wrote that.

563
00:27:25,999 --> 00:27:30,250
And here you go, this is what I added to it.

564
00:27:30,667 --> 00:27:35,375
Then here is some irrelevant blogs at Harris that I wrote.

565
00:27:35,375 --> 00:27:37,125
That's actually a serious article.

566
00:27:37,125 --> 00:27:39,999
It is not, you know, anything that -- they wouldn't let me publish one that

567
00:27:39,999 --> 00:27:41,918
was bad, right?

568
00:27:41,918 --> 00:27:42,918
All right.

569
00:27:43,584 --> 00:27:47,083
And I do want to thank Mr. Greg Conti.

570
00:27:47,083 --> 00:27:48,876
He presented at Black Hat before.

571
00:27:48,876 --> 00:27:53,667
He gave me the idea in 2005 of the whole visualization concept.

572
00:27:53,667 --> 00:27:56,375
That's where a lot of this stuff was born from.

573
00:27:57,459 --> 00:27:58,959
All right.

574
00:27:58,999 --> 00:28:01,083
So anybody want to see demos?

575
00:28:01,209 --> 00:28:02,542
(Shouts of "yes."

576
00:28:02,542 --> 00:28:06,250
)    JOHN ORTIZ: All right.

577
00:28:06,250 --> 00:28:07,999
Let me find my screen again here.

578
00:28:13,083 --> 00:28:14,209
Okay.

579
00:28:14,209 --> 00:28:15,542
So what do you want to see?

580
00:28:15,542 --> 00:28:16,999
The steg program?

581
00:28:21,167 --> 00:28:22,834
What demos?

582
00:28:22,834 --> 00:28:23,999
Any preferences there?

583
00:28:25,375 --> 00:28:26,999
No, I know, it's.

584
00:28:29,125 --> 00:28:30,999
AUDIENCE: (Speaker away from microphone.)    JOHN ORTIZ:

585
00:28:30,999 --> 00:28:32,209
There we go.

586
00:28:32,375 --> 00:28:33,918
It's on the screen.

587
00:28:34,125 --> 00:28:35,999
Let me find the ...

588
00:28:35,999 --> 00:28:38,083
AUDIENCE: Look under your favorites.

589
00:28:38,083 --> 00:28:39,959
JOHN ORTIZ: My favorites?

590
00:28:39,959 --> 00:28:41,999
Let's see what we have.

591
00:28:46,999 --> 00:28:51,501
My favorites are the stego tools, really.

592
00:28:51,667 --> 00:28:53,999
I like to do those as well.

593
00:28:53,999 --> 00:28:54,999
All right.

594
00:28:54,999 --> 00:29:02,417
I'll pull out the -- and where is that?

595
00:29:02,417 --> 00:29:03,542
Steg jpg, okay.

596
00:29:05,334 --> 00:29:06,876
All right.

597
00:29:13,751 --> 00:29:16,792
And then I just need a little media file here.

598
00:29:16,999 --> 00:29:19,959
Find some jpgs here.

599
00:29:20,250 --> 00:29:24,167
I'll try to pull out some, more of president interesting ones.

600
00:29:25,292 --> 00:29:30,834
Oh, yeah, this is one of my favorite jpgs to hide in.

601
00:29:32,083 --> 00:29:36,417
I actually had heard on the news about this -- I heard

602
00:29:36,417 --> 00:29:40,959
about this device sold by a particular company, which I

603
00:29:40,959 --> 00:29:45,250
will not mention, that was supposed to detect like porn

604
00:29:45,250 --> 00:29:48,751
on your computer or something.

605
00:29:48,999 --> 00:29:53,834
So I decided to -- see if I can move this one over there.

606
00:29:55,125 --> 00:29:58,083
It doesn't want to -- I have to figure out.

607
00:29:58,083 --> 00:29:59,292
I'm sorry, I apologize.

608
00:30:01,375 --> 00:30:03,501
AUDIENCE: You want to duplicate?

609
00:30:05,000 --> 00:30:12,125
JOHN ORTIZ: Yeah, we can duplicate.

610
00:30:12,626 --> 00:30:17,292
That will work better.

611
00:30:17,292 --> 00:30:18,292
Thank you.

612
00:30:18,292 --> 00:30:19,292
I appreciate it.

613
00:30:20,417 --> 00:30:21,834
Okay.

614
00:30:21,999 --> 00:30:25,584
So this is supposedly, I put this thing on my laptop.

615
00:30:25,709 --> 00:30:30,959
And it divided the pictures into three categories.

616
00:30:30,959 --> 00:30:33,876
Like suspicious, highly suspicious, or not suspicious.

617
00:30:33,999 --> 00:30:37,209
This is the one that was most highly suspicious.

618
00:30:37,501 --> 00:30:41,125
(Laughter.)    JOHN ORTIZ: Now, if I find that,

619
00:30:41,125 --> 00:30:44,999
that's not what I'm looking for.

620
00:30:44,999 --> 00:30:49,792
Let me find my -- okay, let me get to this directory.

621
00:30:57,999 --> 00:31:02,999
And so here is, let me change the prompt so it's nice and short.

622
00:31:04,334 --> 00:31:07,751
So here is the steg jpg one.

623
00:31:07,876 --> 00:31:09,375
Just show you that in action.

624
00:31:09,542 --> 00:31:12,999
And it has a number of different features to play with.

625
00:31:12,999 --> 00:31:15,083
I mean, it can take randomized input and create it

626
00:31:15,083 --> 00:31:18,292
from a pseudorandom number generator.

627
00:31:18,292 --> 00:31:19,999
You can add that.

628
00:31:19,999 --> 00:31:21,834
There's several parameters here.

629
00:31:22,167 --> 00:31:27,459
Typically just keep A and U, like four to eight, and quality is pretty high.

630
00:31:27,459 --> 00:31:29,999
That gets you the best file hiding.

631
00:31:30,417 --> 00:31:33,083
We will try to hide this one in there.

632
00:31:34,999 --> 00:31:37,083
75K and 209K.

633
00:31:37,083 --> 00:31:38,083
All right.

634
00:31:38,083 --> 00:31:40,626
We'll try to hide the flower in the baboon there.

635
00:31:42,083 --> 00:31:43,751
Do that.

636
00:31:43,834 --> 00:31:45,959
Tell it dash hide.

637
00:31:46,292 --> 00:31:49,209
We need a cover file which is the jpg.

638
00:31:49,334 --> 00:31:53,083
It will take either bitmap or jpg as a cover file and convert that

639
00:31:53,083 --> 00:31:55,250
to a jpg on output.

640
00:31:55,375 --> 00:31:57,876
The message file is the flower.

641
00:31:57,999 --> 00:32:00,959
It may not fit, but we'll give it a try here.

642
00:32:00,959 --> 00:32:02,083
One hundred quality.

643
00:32:02,083 --> 00:32:03,876
I'll go for the max.

644
00:32:03,876 --> 00:32:06,876
AUDIENCE: (Speaker away from microphone.)    JOHN ORTIZ:

645
00:32:06,876 --> 00:32:08,250
On what?

646
00:32:08,250 --> 00:32:11,375
AUDIENCE: (Speaker away from microphone.)    JOHN ORTIZ: The

647
00:32:11,375 --> 00:32:14,834
message file can be any arbitrary thing.

648
00:32:15,292 --> 00:32:16,999
It doesn't care.

649
00:32:16,999 --> 00:32:19,834
Reads it as a stream of bits and hides it.

650
00:32:19,876 --> 00:32:22,999
For questions, please come to the microphone.

651
00:32:22,999 --> 00:32:24,999
JOHN ORTIZ: Yeah, I'm sorry.

652
00:32:24,999 --> 00:32:27,918
The question was what kind of files can you hide?

653
00:32:27,918 --> 00:32:29,459
Does it have to be a picture file?

654
00:32:29,459 --> 00:32:31,584
No, it can be any arbitrary file.

655
00:32:34,959 --> 00:32:39,250
The steg program, you have to give it the dash LSB option.

656
00:32:39,584 --> 00:32:42,626
It has a special demo mode.

657
00:32:42,626 --> 00:32:43,999
But all right.

658
00:32:44,083 --> 00:32:46,083
So here is what it said.

659
00:32:46,083 --> 00:32:48,999
It said our storage capacity was 146,000 bytes.

660
00:32:49,334 --> 00:32:52,501
The message size was 759 fix.

661
00:32:52,542 --> 00:32:55,999
So we can look at the resulting file here.

662
00:32:56,501 --> 00:32:58,375
Can't tell anything.

663
00:32:58,876 --> 00:33:00,999
Isn't that a pretty baboon?

664
00:33:01,584 --> 00:33:04,709
I took that picture in Africa.

665
00:33:04,709 --> 00:33:05,959
All right.

666
00:33:05,959 --> 00:33:07,167
So you can't see anything.

667
00:33:07,167 --> 00:33:11,626
Now, of course, no steganography is complete without extraction, right?

668
00:33:11,626 --> 00:33:14,792
You can always say yeah, it's hidden in there, right?

669
00:33:15,083 --> 00:33:16,999
So let's see what we can do with that.

670
00:33:16,999 --> 00:33:18,959
We have a stego file.

671
00:33:18,959 --> 00:33:20,626
That will be the hid file.

672
00:33:20,959 --> 00:33:22,792
And then it should pick up the quality okay,

673
00:33:22,792 --> 00:33:26,667
but these parameters, dash A and dash U have to match.

674
00:33:26,918 --> 00:33:28,292
And let's see.

675
00:33:28,999 --> 00:33:31,501
Oh, I need to tell it to extract.

676
00:33:31,876 --> 00:33:34,375
The command line is very archaic.

677
00:33:34,375 --> 00:33:36,125
This would be much better with a GUI.

678
00:33:36,125 --> 00:33:37,999
If anybody likes developing Windows GUIs and they want to develop one,

679
00:33:37,999 --> 00:33:39,999
great, send it to me.

680
00:33:39,999 --> 00:33:43,083
I'd appreciate it.

681
00:33:43,083 --> 00:33:44,083
That's a good sign.

682
00:33:44,083 --> 00:33:45,792
It found the same message size.

683
00:33:46,626 --> 00:33:48,417
And let's see.

684
00:33:48,417 --> 00:33:49,417
Where is it?

685
00:33:49,417 --> 00:33:51,918
It extracted that to this.

686
00:33:51,959 --> 00:33:54,501
Now, how did it know the file name?

687
00:33:54,501 --> 00:33:58,250
Well, I have to put in, in addition to the file data, I put in the size

688
00:33:58,250 --> 00:34:02,667
and I went ahead and stored a annual term -- no determinative file

689
00:34:02,667 --> 00:34:05,626
name and the rest of the data.

690
00:34:06,125 --> 00:34:09,626
I add a .jpg extension on this this one.

691
00:34:09,626 --> 00:34:12,375
You'll be able to see.

692
00:34:16,751 --> 00:34:17,876
I do ...

693
00:34:17,876 --> 00:34:19,209
there is the flower picture.

694
00:34:23,999 --> 00:34:25,999
(Applause.)    JOHN ORTIZ: You know, I should have shown you

695
00:34:25,999 --> 00:34:27,709
the original, right?

696
00:34:27,709 --> 00:34:28,999
There is the original.

697
00:34:28,999 --> 00:34:30,999
You're like oh, yeah, it works!

698
00:34:30,999 --> 00:34:33,542
I could have extracted anything.

699
00:34:38,250 --> 00:34:39,417
Now, let's --    AUDIENCE: (Speaker away

700
00:34:39,417 --> 00:34:42,999
from microphone.)    JOHN ORTIZ: Let's do the WBH thing right there.

701
00:34:42,999 --> 00:34:46,083
This one is a simple command line tool also.

702
00:34:46,250 --> 00:34:50,083
We'll put the hid jpg file there and the dash B option creates

703
00:34:50,083 --> 00:34:52,167
the image of it.

704
00:34:52,584 --> 00:34:54,292
So there it is.

705
00:34:54,292 --> 00:34:58,709
By the way, this bit entropy, I tried that out with zeros and ones.

706
00:34:58,751 --> 00:35:00,584
It doesn't tell anything.

707
00:35:00,584 --> 00:35:01,584
Yes?

708
00:35:01,584 --> 00:35:05,083
AUDIENCE: (Off microphone.)    JOHN ORTIZ: It is exactly the same,

709
00:35:05,083 --> 00:35:06,999
byte for byte.

710
00:35:10,083 --> 00:35:12,083
Oh, thank you.

711
00:35:12,626 --> 00:35:14,999
The question was, does the recovered file have

712
00:35:14,999 --> 00:35:17,999
the exact checksum as the original?

713
00:35:17,999 --> 00:35:20,125
The answer is yes because the original file is stored

714
00:35:20,125 --> 00:35:22,999
in there exactly byte for byte.

715
00:35:22,999 --> 00:35:23,999
There is no loss.

716
00:35:23,999 --> 00:35:25,751
Thank you.

717
00:35:25,918 --> 00:35:28,459
So the bit entropy here, that was experimental.

718
00:35:28,459 --> 00:35:29,999
That didn't work out too well.

719
00:35:30,083 --> 00:35:33,918
We see 7.97 with the hidden data.

720
00:35:33,918 --> 00:35:34,999
We've taken compressed data and hidden it

721
00:35:34,999 --> 00:35:37,083
in another compressed file.

722
00:35:37,459 --> 00:35:40,083
We can look at the textual histogram just

723
00:35:40,083 --> 00:35:42,292
for grins there.

724
00:35:42,709 --> 00:35:44,876
So you can kind of scroll down and you can see

725
00:35:44,876 --> 00:35:47,918
the exact counts in the exact distribution, so forth,

726
00:35:47,918 --> 00:35:49,209
of that.

727
00:35:49,375 --> 00:35:50,667
Okay?

728
00:35:51,083 --> 00:35:54,667
And then the -- where is it?

729
00:35:54,667 --> 00:35:58,501
The histogram, the bitmap histogram, okay?

730
00:35:58,792 --> 00:36:02,250
It's very uniform here except for a lot of zeros.

731
00:36:02,501 --> 00:36:05,709
If you want, we can use the tool to get a closer look at this.

732
00:36:05,709 --> 00:36:10,417
So like I will use what is called the zoom feature.

733
00:36:10,417 --> 00:36:12,083
I'll run the same thing again.

734
00:36:12,083 --> 00:36:16,834
This time I'll use dash Z and 5, okay?

735
00:36:16,834 --> 00:36:21,834
And now we have one -- let me stretch this out a little bit with a Z5.

736
00:36:21,834 --> 00:36:22,834
That's what that is.

737
00:36:23,292 --> 00:36:25,709
I over-zoomed a little bit.

738
00:36:26,083 --> 00:36:27,999
Let's try 3.

739
00:36:28,918 --> 00:36:34,999
So very easily I can do 3 and then go to the zoom 3.

740
00:36:35,083 --> 00:36:38,167
And now you can kind of get a closer look at that area.

741
00:36:38,292 --> 00:36:40,375
In fact, that would be actually a good one to use

742
00:36:40,375 --> 00:36:42,375
on an executable, right?

743
00:36:42,375 --> 00:36:43,792
It's not quite as uniform.

744
00:36:43,792 --> 00:36:46,083
We are do WBH of itself.

745
00:36:47,667 --> 00:36:48,999
All right.

746
00:36:48,999 --> 00:36:50,792
And then take a look at that one.

747
00:36:51,334 --> 00:36:54,959
And here is the histogram of WBH at zoom 1.

748
00:36:55,999 --> 00:37:01,083
Zero and 255 kind of mask out some of those.

749
00:37:01,459 --> 00:37:03,209
So we can use the zoom feature.

750
00:37:04,999 --> 00:37:07,626
And dash Z and 3.

751
00:37:12,626 --> 00:37:15,083
And now you can see that a little closer.

752
00:37:15,542 --> 00:37:16,918
Okay?

753
00:37:16,959 --> 00:37:20,083
The image, where did we put that one?

754
00:37:20,083 --> 00:37:22,417
That one was the baboon.

755
00:37:22,417 --> 00:37:23,417
This one here.

756
00:37:24,292 --> 00:37:27,792
That's the image of the jpg with the hidden data.

757
00:37:27,792 --> 00:37:29,918
You can't really tell anything from that.

758
00:37:29,918 --> 00:37:34,292
AUDIENCE: Would you show a picture where we can actually see

759
00:37:34,292 --> 00:37:37,334
the flower and the baboon?

760
00:37:37,334 --> 00:37:38,999
JOHN ORTIZ: It is with the bitmap where you see

761
00:37:38,999 --> 00:37:41,626
the flower behind it or whatever?

762
00:37:42,792 --> 00:37:44,250
I have time.

763
00:37:44,250 --> 00:37:46,999
I've got -- we have the technology.

764
00:37:49,751 --> 00:37:51,999
AUDIENCE: (Speaker away from microphone.)    JOHN ORTIZ:

765
00:37:51,999 --> 00:37:55,083
These two folders here, by the way, are on your disk.

766
00:37:55,584 --> 00:37:58,999
I included tools that you can download for free just like I did.

767
00:37:58,999 --> 00:38:00,999
Here is the steg LSB one.

768
00:38:02,459 --> 00:38:06,417
We'll take that over to the demo area here.

769
00:38:06,417 --> 00:38:11,375
Let me clear out some of these other things just to make room.

770
00:38:12,834 --> 00:38:14,083
Okay.

771
00:38:14,083 --> 00:38:15,918
So now I have steg LSB in there.

772
00:38:15,918 --> 00:38:17,542
Now all I need are bitmaps.

773
00:38:17,626 --> 00:38:19,667
Let me grab some of those.

774
00:38:23,083 --> 00:38:25,083
These, let's see here.

775
00:38:25,375 --> 00:38:26,375
There we go.

776
00:38:26,375 --> 00:38:27,375
All right.

777
00:38:27,375 --> 00:38:30,375
The only thing is, for this picture in a picture, steganography,

778
00:38:30,375 --> 00:38:32,792
it's not really useful.

779
00:38:32,999 --> 00:38:35,501
I mean, as far as just for playing with, right?

780
00:38:35,667 --> 00:38:39,292
Because everything has to be the exact same size so that I'm going

781
00:38:39,292 --> 00:38:42,417
to take the upper four bits of one picture and stuff it

782
00:38:42,417 --> 00:38:45,999
in the bottom four bits of the other picture.

783
00:38:45,999 --> 00:38:46,999
Okay?

784
00:38:46,999 --> 00:38:48,751
So let's see here.

785
00:38:48,751 --> 00:38:53,834
We have, that one is 36, 1711 -- I don't know.

786
00:38:54,459 --> 00:38:55,999
Let's see.

787
00:38:55,999 --> 00:38:57,999
I have top find the right media file.

788
00:38:57,999 --> 00:38:58,999
Seventy-six by 512.

789
00:38:58,999 --> 00:38:59,999
No.

790
00:39:02,083 --> 00:39:04,626
I may not have the right size there.

791
00:39:04,959 --> 00:39:07,083
These are all different sizes, apparently.

792
00:39:07,999 --> 00:39:09,209
Hmm.

793
00:39:10,167 --> 00:39:14,667
Well, I might have to do LSB on that one for now.

794
00:39:14,959 --> 00:39:18,334
I'll show you how to do it but it will come back and tell me that

795
00:39:18,334 --> 00:39:21,999
the files aren't the right matching size.

796
00:39:21,999 --> 00:39:23,584
I'm trying to think.

797
00:39:23,584 --> 00:39:25,584
I know I have files on here somewhere.

798
00:39:28,292 --> 00:39:30,999
I can try my backup disk here.

799
00:39:31,209 --> 00:39:34,459
AUDIENCE: (Speaker away from microphone.)    JOHN ORTIZ:

800
00:39:34,459 --> 00:39:36,959
Yeah, I could do that.

801
00:39:36,959 --> 00:39:39,834
It has to match, you have to match exactly.

802
00:39:39,999 --> 00:39:48,751
So I'm sure that I have one, you know -- maybe not.

803
00:39:48,751 --> 00:39:51,417
I really didn't expect to get done as fast as I did.

804
00:39:51,542 --> 00:39:53,417
I appreciate your patience with this.

805
00:39:53,417 --> 00:39:55,542
I went to the wrong ...

806
00:39:55,709 --> 00:40:01,292
no, that's going to be the same thing as what I have here.

807
00:40:03,375 --> 00:40:06,459
Well, let me just show, since we have a couple of minutes,

808
00:40:06,459 --> 00:40:09,999
let me show the files and we can meet later on.

809
00:40:09,999 --> 00:40:10,999
You had a question?

810
00:40:10,999 --> 00:40:12,501
AUDIENCE: When somebody ...

811
00:40:33,375 --> 00:40:34,751
(Speaker away from microphone.)    JOHN ORTIZ: If it

812
00:40:34,751 --> 00:40:37,542
wasn't messed with, it wouldn't have anything hidden.

813
00:40:37,542 --> 00:40:41,417
AUDIENCE: I want something and I post it to flipper or something.

814
00:40:41,417 --> 00:40:44,667
Somebody grabs a copy of the Twitter picture

815
00:40:44,667 --> 00:40:48,999
to make a thumbnail for their website.

816
00:40:49,250 --> 00:40:52,584
JOHN ORTIZ: Right.

817
00:41:00,334 --> 00:41:02,334
AUDIENCE: I feel like after they've done that,

818
00:41:02,334 --> 00:41:05,125
the stuff I hid in my original picture is not visible -- (Speaker away

819
00:41:05,125 --> 00:41:08,083
from microphone.)    JOHN ORTIZ: The question is, if I do a transcoding,

820
00:41:08,083 --> 00:41:10,292
like when you post stuff to Facebook and Flickr, a lot

821
00:41:10,292 --> 00:41:14,167
of times they'll change it for you or change the quality and shrink it.

822
00:41:14,501 --> 00:41:17,876
You can't recover your data but can you tell something is hidden?

823
00:41:17,876 --> 00:41:23,792
No, because the coefficients get scrambled up again and made a new.

824
00:41:23,792 --> 00:41:24,792
You have a question?

825
00:41:24,792 --> 00:41:27,292
AUDIENCE: (Speaker away from microphone.)    JOHN ORTIZ:

826
00:41:27,292 --> 00:41:28,792
I have!

827
00:41:28,792 --> 00:41:31,626
AUDIENCE: Another one --    JOHN ORTIZ: Sure.

828
00:41:35,959 --> 00:41:39,918
AUDIENCE: So in your example you used two images

829
00:41:39,918 --> 00:41:43,999
that had no relationship to each other.

830
00:41:43,999 --> 00:41:48,334
Let's say we're talking about somebody, like a journalist in a conflict area

831
00:41:48,334 --> 00:41:51,584
and they have a picture that is like the street

832
00:41:51,584 --> 00:41:55,751
before the demonstration and the street after.

833
00:41:55,751 --> 00:41:57,375
There's a lot of overlaps.

834
00:41:57,709 --> 00:42:01,083
Is it possible to use steganography to's tensionally

835
00:42:01,083 --> 00:42:05,334
re-reuse the cover agency as part of the steganography,

836
00:42:05,334 --> 00:42:08,667
so you encode the deltas and take advantage

837
00:42:08,667 --> 00:42:14,751
of the original image where there are exact or close similarities?

838
00:42:14,876 --> 00:42:20,709
JOHN ORTIZ: You can certainly encode a delta.

839
00:42:20,709 --> 00:42:23,334
There might not be any reason to.

840
00:42:23,501 --> 00:42:26,999
When you take two different pictures, the way the camera is going

841
00:42:26,999 --> 00:42:30,542
to encode it, the way the light hits, everything.

842
00:42:30,542 --> 00:42:34,083
You are going to have very high probability

843
00:42:34,083 --> 00:42:40,459
of having very likely, completely different images.

844
00:42:40,459 --> 00:42:43,584
AUDIENCE: Not yet, not yet -- (Cheers

845
00:42:43,584 --> 00:42:49,167
and applause.)    JOHN ORTIZ: Mathematically you'll have very

846
00:42:49,167 --> 00:42:52,501
different images anyway.

847
00:42:52,501 --> 00:42:54,584
You can hide both of those in two different images

848
00:42:54,584 --> 00:42:57,417
or hide them both in the same image and you can't tell

849
00:42:57,417 --> 00:43:00,125
that they are related in any way.

850
00:43:00,125 --> 00:43:02,999
AUDIENCE: So you can't take advantage of any similar runs

851
00:43:02,999 --> 00:43:07,125
of --    JOHN ORTIZ: In a jpg there won't be much common.

852
00:43:07,250 --> 00:43:10,918
If they were both bitmaps, you would be able

853
00:43:10,918 --> 00:43:14,083
to find some commonality.

854
00:43:14,083 --> 00:43:17,334
I did not cover in this presentation the math behind the jpg.

855
00:43:18,292 --> 00:43:23,209
It's easy once you know how to use it, but it looks very complex.

856
00:43:23,209 --> 00:43:25,292
Multiply that summation by cosines and stuff and it gets

857
00:43:25,292 --> 00:43:27,209
to be very complex.

858
00:43:27,501 --> 00:43:29,751
Everything is interdependent.

859
00:43:29,751 --> 00:43:32,709
You would have an eight by matrix and run it through a bunch of math

860
00:43:32,709 --> 00:43:37,209
at different frequency, a frequency correlation of your image.

861
00:43:37,626 --> 00:43:41,667
You change one little thing in there, it goes this way and this way

862
00:43:41,667 --> 00:43:45,999
and get et cetera to be very different in bitmap.

863
00:43:46,792 --> 00:43:48,792
You have blue sky.

864
00:43:49,083 --> 00:43:51,999
With jpg, if you're off by one, no.

865
00:43:52,999 --> 00:43:54,209
Yes?

866
00:43:54,209 --> 00:44:01,459
AUDIENCE: (Speaker away from microphone.)    JOHN ORTIZ:

867
00:44:01,459 --> 00:44:12,584
Well, we are out of time for today and I don't have that file on the disk.

868
00:44:12,584 --> 00:44:13,751
It's confusing and ...

869
00:44:15,999 --> 00:44:20,709
if you e-mail me I'll see how I can get it to you.

870
00:44:20,709 --> 00:44:22,459
I don't have a problem giving it out.

871
00:44:22,542 --> 00:44:24,459
It's fairly complex to use.

872
00:44:24,459 --> 00:44:25,459
Yeah?

873
00:44:25,459 --> 00:44:28,542
AUDIENCE: (Speaker away from microphone.)    JOHN ORTIZ:

874
00:44:28,542 --> 00:44:30,918
Sure, I can do that.

875
00:44:30,959 --> 00:44:31,999
It's fairly easy.

876
00:44:31,999 --> 00:44:34,417
It's just a stego@STAX.com.

877
00:44:34,417 --> 00:44:38,459
MODERATOR: You have time for one more question.

878
00:44:38,459 --> 00:44:41,083
AUDIENCE: You mentioned wanting a GUI.

879
00:44:41,083 --> 00:44:42,209
Is this open source?

880
00:44:42,209 --> 00:44:45,999
JOHN ORTIZ: You have on the disk some of the source code.

881
00:44:45,999 --> 00:44:48,999
I honestly don't remember which source code I put on there.

882
00:44:48,999 --> 00:44:51,167
I put the wrapper course code and the WBH.

883
00:44:51,501 --> 00:44:52,999
They were written by me.

884
00:44:52,999 --> 00:44:57,876
If the source code is not in there and you want it, just e-mail me.

885
00:45:01,459 --> 00:45:03,626
Well, thank you very much.

886
00:45:03,626 --> 00:45:04,626
I appreciate it.