1 00:00:00,000 --> 00:00:02,125 SAM BOWNE: So I'm Sam Bowne. 2 00:00:02,125 --> 00:00:03,375 This is Matthew Prince. 3 00:00:05,459 --> 00:00:08,459 I'm the attack side which in my opinion is the most fun 4 00:00:08,459 --> 00:00:10,876 but the least practical. 5 00:00:10,876 --> 00:00:13,999 He is the guy that can actually save you from all this garbage. 6 00:00:13,999 --> 00:00:14,999 I just make trouble. 7 00:00:15,417 --> 00:00:18,292 And I'm hoping to have a few minutes at the end 8 00:00:18,292 --> 00:00:21,667 to show you something new about cookie reuse, hacking 9 00:00:21,667 --> 00:00:24,626 into American Express and Chase. 10 00:00:28,042 --> 00:00:31,751 I do not appear to be able to proceed to the next slide. 11 00:00:31,751 --> 00:00:35,209 So I will make this smaller and see if that works. 12 00:00:35,209 --> 00:00:36,709 I'm Sam Bowne. 13 00:00:36,709 --> 00:00:38,999 I teach at city College of San Francisco. 14 00:00:38,999 --> 00:00:40,250 This is Matthew Prince. 15 00:00:41,999 --> 00:00:44,000 Can't see the slide. 16 00:00:53,667 --> 00:00:57,375 SAM BOWNE: They had a problem with this before. 17 00:00:57,375 --> 00:00:58,626 Guys, I have no video. 18 00:00:59,999 --> 00:01:01,709 That's what I thought. 19 00:01:05,167 --> 00:01:07,792 By the way, I'm going to need your help and tell me when 20 00:01:07,792 --> 00:01:10,501 the video dies because I have to move to another machine later 21 00:01:10,501 --> 00:01:13,626 and the system appears to be have some defects. 22 00:01:13,626 --> 00:01:16,501 Do you see anything right? 23 00:01:16,999 --> 00:01:18,209 Well, I can tell you a story. 24 00:01:19,250 --> 00:01:21,375 I'm in contact with a lot of criminals which 25 00:01:21,375 --> 00:01:23,417 is really great because I'm on Twitter and 26 00:01:23,417 --> 00:01:26,501 they often tell me interesting information. 27 00:01:26,501 --> 00:01:27,459 In fact, I recently hired a felon even though he is not 28 00:01:27,459 --> 00:01:28,999 all that criminal. 29 00:01:30,250 --> 00:01:32,999 So I gave a talk with Matthew here two years ago 30 00:01:32,999 --> 00:01:35,876 about denial of service and I gave some criminal 31 00:01:35,876 --> 00:01:38,999 attacks a criminal saw those and he said, I was checking 32 00:01:38,999 --> 00:01:42,709 out your stuff and why do you teach BackTrack. 33 00:01:42,709 --> 00:01:43,876 That stuff is garbage. 34 00:01:43,876 --> 00:01:44,876 What are you lame? 35 00:01:44,999 --> 00:01:47,999 And socks tress is a great attack. 36 00:01:48,959 --> 00:01:53,209 I thought BackTrack was fine and I didn't know socks tress exist. 37 00:01:53,209 --> 00:01:56,083 Remember five years ago they said there was 38 00:01:56,083 --> 00:02:00,918 a new security attack that would kill eastbound that used HTTP routers 39 00:02:00,918 --> 00:02:04,417 and we thought it was the end of world. 40 00:02:04,417 --> 00:02:05,709 And then nothing. 41 00:02:05,709 --> 00:02:07,250 I couldn't find the source code. 42 00:02:07,584 --> 00:02:09,999 I thought that was just vaporware. 43 00:02:10,542 --> 00:02:13,292 It was real but the man who wrote it died 44 00:02:13,292 --> 00:02:16,667 before he could go to the CONs before he could do 45 00:02:16,667 --> 00:02:21,083 a dog and pony show and show everybody how it works. 46 00:02:21,083 --> 00:02:22,918 The black hats, some of them knew. 47 00:02:22,918 --> 00:02:23,918 And this guy knew. 48 00:02:23,918 --> 00:02:26,626 You can take down servers with sockstress and take it 49 00:02:26,626 --> 00:02:29,542 down permanently is a claim I have seen many 50 00:02:29,542 --> 00:02:31,250 people make. 51 00:02:31,250 --> 00:02:33,375 And I think I understand what that means. 52 00:02:33,834 --> 00:02:36,167 You could not take down a professional company. 53 00:02:36,167 --> 00:02:37,167 Do I have slides? 54 00:02:37,542 --> 00:02:39,751 Let me talk about how this works. 55 00:02:40,083 --> 00:02:41,709 Here's how TCP works? 56 00:02:41,709 --> 00:02:46,250 Slides! 57 00:02:46,250 --> 00:02:47,999 SAM BOWNE: All right. 58 00:02:47,999 --> 00:02:49,501 So TCP, TCP let's the receiver control 59 00:02:49,501 --> 00:02:51,876 the flow of information. 60 00:02:51,876 --> 00:02:55,709 So first you have to handshake to make sure the person is really there. 61 00:02:55,999 --> 00:02:58,209 The server sends you a syn ak. 62 00:02:59,999 --> 00:03:02,959 The data sends you packets of data and it waits for you 63 00:03:02,959 --> 00:03:04,999 to acknowledge them. 64 00:03:04,999 --> 00:03:08,751 So if your client is slow, it can control the rate of flow. 65 00:03:08,751 --> 00:03:10,459 So that's one form of flow control. 66 00:03:10,459 --> 00:03:11,459 It is good, right? 67 00:03:11,459 --> 00:03:12,459 No. 68 00:03:12,459 --> 00:03:13,751 SAM BOWNE: Died again? 69 00:03:15,417 --> 00:03:18,417 Well, anyway, I'm going to have to keep going. 70 00:03:19,334 --> 00:03:24,083 Hopefully did someone notice and doing something about it perhaps? 71 00:03:24,334 --> 00:03:25,999 Onward we go. 72 00:03:25,999 --> 00:03:26,999 Anyway ... 73 00:03:27,083 --> 00:03:30,083 so there is another form of flow control in TCP which 74 00:03:30,083 --> 00:03:33,083 is not commonly used but it exists. 75 00:03:33,083 --> 00:03:35,876 You can send a packet with a window size of 0. 76 00:03:35,999 --> 00:03:40,167 What that means is I can only accept zero more bytes. 77 00:03:40,250 --> 00:03:42,083 You have to stop sending me whatever you're 78 00:03:42,083 --> 00:03:44,792 sending me and wait to get it working. 79 00:03:44,999 --> 00:03:48,918 That is available so your client can say I have a buffer and my buffer is full, 80 00:03:48,918 --> 00:03:53,209 stop sending me whatever you're sending me until I can clear that out. 81 00:03:53,209 --> 00:03:54,626 But you can use it an attack and that's what 82 00:03:54,626 --> 00:03:56,209 Sockstress does. 83 00:03:56,209 --> 00:03:57,999 All you do is the TCP handshake. 84 00:03:57,999 --> 00:03:59,542 You send a syn to the server. 85 00:03:59,542 --> 00:04:03,542 The server sends back syn ak but the syn ak has a window size 86 00:04:03,542 --> 00:04:05,626 of the server. 87 00:04:05,626 --> 00:04:06,834 That means the server will start 88 00:04:06,834 --> 00:04:12,501 a process and prepare some memory to send you something and then wait. 89 00:04:12,501 --> 00:04:14,999 And in practice, it will wait for a really long time so all you have 90 00:04:14,999 --> 00:04:16,999 to do is make a lot of those connections and use 91 00:04:16,999 --> 00:04:19,250 up all the RAM on the server. 92 00:04:19,999 --> 00:04:24,501 If you keep it up for 20 minutes in practice from real attackers. 93 00:04:24,999 --> 00:04:30,792 It can damage the server so you have to pull the plug. 94 00:04:30,999 --> 00:04:33,999 This is why the Blacks tell me that this will kill servers 95 00:04:33,999 --> 00:04:36,375 and they're gone forever. 96 00:04:36,375 --> 00:04:37,834 You can't kill Yahoo! 97 00:04:37,834 --> 00:04:38,834 with a nuclear bomb. 98 00:04:39,375 --> 00:04:41,209 They have backups. 99 00:04:41,209 --> 00:04:44,999 So a professional place can't be taken down with an attack like this. 100 00:04:46,292 --> 00:04:53,876 On an amateur site with shared hosting, you could kill it. 101 00:04:53,876 --> 00:04:55,542 So we are trying again for video here which would be nice 102 00:04:55,542 --> 00:04:57,999 because I have demos to show you. 103 00:04:58,167 --> 00:05:00,667 The slides are more expendable than the demos. 104 00:05:00,999 --> 00:05:03,751 Anyway, let me get down here. 105 00:05:05,250 --> 00:05:07,167 That's the joy of Sockstress. 106 00:05:10,417 --> 00:05:12,292 Well, life is tough. 107 00:05:12,292 --> 00:05:13,292 (laughter). 108 00:05:14,083 --> 00:05:15,999 I don't think it's me. 109 00:05:19,751 --> 00:05:20,999 It's up. 110 00:05:22,375 --> 00:05:23,999 He got it. 111 00:05:27,999 --> 00:05:29,125 (applause). 112 00:05:29,125 --> 00:05:30,292 They fixed something. 113 00:05:30,292 --> 00:05:31,542 Good, great, thank you. 114 00:05:31,542 --> 00:05:33,083 So you can see it now. 115 00:05:33,083 --> 00:05:34,167 Life is good. 116 00:05:34,459 --> 00:05:35,459 All right. 117 00:05:35,459 --> 00:05:36,709 Can you see it now? 118 00:05:36,709 --> 00:05:38,167 I'm glad I brought up the slide. 119 00:05:38,542 --> 00:05:39,876 You have to use an old version of Slackware 120 00:05:39,876 --> 00:05:41,999 to make this thing really go. 121 00:05:43,083 --> 00:05:47,626 I kept saying this is garbage and the black hat said, No, it is not garbage. 122 00:05:47,626 --> 00:05:48,626 You are just stupid. 123 00:05:48,626 --> 00:05:49,626 He was right. 124 00:05:49,626 --> 00:05:51,417 With enough work I got it working. 125 00:05:51,417 --> 00:05:53,751 Let me show you this in all its glory. 126 00:05:54,501 --> 00:05:56,999 I have some virtual machines here. 127 00:06:01,209 --> 00:06:02,501 Okay. 128 00:06:04,250 --> 00:06:09,501 And so here's my attacker and here's my target. 129 00:06:09,959 --> 00:06:17,125 So (speaker off microphone.) SAM BOWNE: 130 00:06:17,125 --> 00:06:20,083 Yeah, yeah. 131 00:06:20,083 --> 00:06:22,375 I don't have a dog, ha. 132 00:06:22,999 --> 00:06:24,459 All right. 133 00:06:24,459 --> 00:06:26,834 Let me tell you something about this attack. 134 00:06:26,834 --> 00:06:27,999 There are two parts to it. 135 00:06:29,250 --> 00:06:32,209 Some of the software written by the people that designed this attack 136 00:06:32,209 --> 00:06:34,083 didn't work for me. 137 00:06:34,083 --> 00:06:35,876 I had to write it myself in Scapey. 138 00:06:35,876 --> 00:06:38,125 This is art poisoning of a very simple kind. 139 00:06:38,459 --> 00:06:40,667 Your target to get the effect that's really cool where you 140 00:06:40,667 --> 00:06:43,584 kill a target dead, the target has to be listening on many ports 141 00:06:43,584 --> 00:06:47,250 and you have to attack it from a whole botnet worth of I.P. 142 00:06:47,250 --> 00:06:48,250 addresses. 143 00:06:48,250 --> 00:06:50,417 But you can simulate it for testing vulnerability 144 00:06:50,417 --> 00:06:52,626 on a LAN this way. 145 00:06:52,626 --> 00:06:57,918 You run an art poisoning script here which will just tell anybody that asks 146 00:06:57,918 --> 00:06:59,459 any I.P. 147 00:06:59,459 --> 00:07:00,459 address is me. 148 00:07:00,459 --> 00:07:02,626 So I can pretend to be 127 I.P. 149 00:07:02,626 --> 00:07:03,834 addresses and it will just believe they're 150 00:07:03,834 --> 00:07:05,626 all on this machine. 151 00:07:05,999 --> 00:07:07,083 That's important. 152 00:07:07,083 --> 00:07:08,501 That simulates the botnet. 153 00:07:08,709 --> 00:07:10,626 And the attacker is over here. 154 00:07:11,999 --> 00:07:16,959 This is a normal handshake with a size of zero but it sends it 155 00:07:16,959 --> 00:07:19,667 from 126 possible I.P. 156 00:07:19,667 --> 00:07:21,751 addresses and to about a dozen ports so it can really 157 00:07:21,751 --> 00:07:24,083 make a lot of connections. 158 00:07:24,584 --> 00:07:26,459 Let me get my target here. 159 00:07:26,459 --> 00:07:28,417 And this looks good. 160 00:07:28,417 --> 00:07:32,459 This is a Windows 2012 Server, the latest version, 64 bit, 161 00:07:32,459 --> 00:07:35,125 and it has got 1 gig. 162 00:07:35,125 --> 00:07:37,209 As you can see it is using about a third of a gig right now 163 00:07:37,209 --> 00:07:40,792 and almost no CPU because it is just sitting there. 164 00:07:40,834 --> 00:07:45,083 So when I start this attack, let me get to my right window, okay, 165 00:07:45,083 --> 00:07:48,918 let's have these as visible as possible. 166 00:07:48,918 --> 00:07:49,918 Okay. 167 00:07:49,918 --> 00:07:50,918 The attack is here. 168 00:07:51,501 --> 00:07:54,292 You see this number of connections per second being made 169 00:07:54,292 --> 00:07:56,167 going up to 2,000. 170 00:07:56,167 --> 00:07:58,083 I have seen it get up to maybe 3 or 4,000 which you 171 00:07:58,083 --> 00:08:02,626 will never see unless you use Slackware and there's the effect. 172 00:08:02,667 --> 00:08:05,667 It just starts chewing up the available memory. 173 00:08:05,751 --> 00:08:08,667 You can run it against a server with 4 gigs. 174 00:08:08,667 --> 00:08:10,999 I have tried and I don't think there is a limit. 175 00:08:10,999 --> 00:08:12,751 You can run it against as many gigs as you want and it will use 176 00:08:12,751 --> 00:08:14,584 up all the RAM. 177 00:08:14,792 --> 00:08:16,999 When the attack stops, that RAM does not come back any 178 00:08:16,999 --> 00:08:18,542 time soon. 179 00:08:18,542 --> 00:08:19,876 It just stays consumed. 180 00:08:19,876 --> 00:08:22,167 If you wait until the RAM is all gone and let it keep going 181 00:08:22,167 --> 00:08:24,792 for 120 minutes the server becomes unresponsive 182 00:08:24,792 --> 00:08:27,959 and all you can do is pull out the plug. 183 00:08:27,959 --> 00:08:29,584 It works over the Internet. 184 00:08:29,584 --> 00:08:30,584 It is a layer 4. 185 00:08:30,751 --> 00:08:32,792 It is really scary. 186 00:08:34,375 --> 00:08:36,709 You can see under these conditions it has not taken 187 00:08:36,709 --> 00:08:39,834 long to use up all the RAM I have got available. 188 00:08:39,834 --> 00:08:42,667 Let me go back to my slides. 189 00:08:42,876 --> 00:08:47,167 And we'll that would stop the attack. 190 00:08:47,167 --> 00:08:48,292 As you can see the memory doesn't become 191 00:08:48,292 --> 00:08:50,083 available again. 192 00:08:50,334 --> 00:08:52,999 It seems to me this is a design flaw in the operating systems that 193 00:08:52,999 --> 00:08:56,417 they could have a garbage collection process going on. 194 00:08:56,417 --> 00:08:58,999 Almost any device that uses TCP is vulnerable 195 00:08:58,999 --> 00:09:02,959 because nobody popularized this attack. 196 00:09:03,083 --> 00:09:06,999 Everybody thought it wasn't real, the people I knew. 197 00:09:06,999 --> 00:09:08,792 That's one thing you should know. 198 00:09:08,792 --> 00:09:11,999 It is in current use by criminals to take down servers right now. 199 00:09:11,999 --> 00:09:12,999 I'm not aware of anybody paying attention of how 200 00:09:12,999 --> 00:09:14,501 to stop it. 201 00:09:14,501 --> 00:09:16,709 It seems to me you can block packets 202 00:09:16,709 --> 00:09:20,250 with small sizes at your firewall. 203 00:09:20,459 --> 00:09:23,292 You could patch your operating systems in various ways. 204 00:09:23,292 --> 00:09:25,584 It is time for people to pay attention to it. 205 00:09:26,292 --> 00:09:29,083 I made a version of it that runs on Kali. 206 00:09:29,999 --> 00:09:33,125 It runs at 1/3 the speed so it is not as dramatic but it is enough 207 00:09:33,125 --> 00:09:35,250 to test defense tools. 208 00:09:35,999 --> 00:09:40,292 The other thing I wanted to show you is the latest IPv6 attack which 209 00:09:40,292 --> 00:09:42,459 is good clean fun. 210 00:09:42,667 --> 00:09:44,876 As we all know, we ran out of I.P. 211 00:09:44,876 --> 00:09:45,999 addresses a while ago. 212 00:09:45,999 --> 00:09:47,501 It is a non renewable resource. 213 00:09:47,501 --> 00:09:48,125 In about a year North America will run 214 00:09:48,125 --> 00:09:50,876 out and more people should notice. 215 00:09:50,999 --> 00:09:54,501 Projected ARIN data is April 2014. 216 00:09:57,999 --> 00:10:00,417 IPv6 countdown counter. 217 00:10:00,918 --> 00:10:02,125 (laughter). 218 00:10:02,626 --> 00:10:05,584 As you can see we have got enough of them for a little while. 219 00:10:05,584 --> 00:10:07,999 That's why we are trying to move forward on this. 220 00:10:07,999 --> 00:10:09,959 That's live on my Web site, by the way. 221 00:10:09,959 --> 00:10:11,209 You can catch it count down. 222 00:10:11,250 --> 00:10:13,834 So I talked about this two years ago. 223 00:10:13,834 --> 00:10:15,334 This has been around for a while. 224 00:10:15,334 --> 00:10:18,000 This is the old, old fashioned attack from 2011. 225 00:10:18,751 --> 00:10:20,125 In I.P. 226 00:10:20,125 --> 00:10:21,626 version 4 if you want an I.P. 227 00:10:21,626 --> 00:10:23,959 address, you boot up the laptop, get the I.P. 228 00:10:23,959 --> 00:10:26,125 from the router and that's the end of the game. 229 00:10:26,209 --> 00:10:28,918 In IPv6, you send router advertisements from the router and 230 00:10:28,918 --> 00:10:31,417 they are sent multicast to all nodes which is what 231 00:10:31,417 --> 00:10:35,999 a normal person would call broadcast if they are a little bit sloppy. 232 00:10:36,042 --> 00:10:39,501 Every ping that receives that packet has to create an I.P. 233 00:10:39,501 --> 00:10:41,375 address and join the network, which amounts to the same thing 234 00:10:41,375 --> 00:10:43,584 under normal conditions but if you send a lot 235 00:10:43,584 --> 00:10:46,000 of router advertisements the clients are all burdened 236 00:10:46,000 --> 00:10:48,417 by making up a lot of addresses and joining a lot 237 00:10:48,417 --> 00:10:51,501 of networks which burdens them far more than any sensible person 238 00:10:51,501 --> 00:10:53,000 would think. 239 00:10:53,000 --> 00:10:56,042 I would think making up a numbers in only a few clock cycles 240 00:10:56,042 --> 00:10:59,999 but Windows can only do five of these per second without using 241 00:10:59,999 --> 00:11:04,292 up 100% CPI and that's true of one of the BSD versions. 242 00:11:05,834 --> 00:11:09,626 It is a IPv6 packet going to FF02:1. 243 00:11:10,792 --> 00:11:14,375 And it has a prefix telling it what network to join. 244 00:11:14,459 --> 00:11:19,459 If you run this flood for a while, then your Windows machine will use 245 00:11:19,459 --> 00:11:24,209 up a lot of CPU and that was the old attack in 2011. 246 00:11:24,542 --> 00:11:28,834 Now that draws 100% CPU and no effect on Linux or Mac, 247 00:11:28,834 --> 00:11:35,167 which ignored all the advertising after the first ten addresses or so. 248 00:11:35,999 --> 00:11:38,125 And Microsoft all right. 249 00:11:38,125 --> 00:11:39,292 That was the old flood. 250 00:11:39,459 --> 00:11:41,918 And so then Microsoft came out with Windows 8 251 00:11:41,918 --> 00:11:44,918 and Web Server 2012 and the chaos communication 252 00:11:44,918 --> 00:11:47,209 in Germany came out with a new version 253 00:11:47,209 --> 00:11:49,542 of this attack tool. 254 00:11:49,626 --> 00:11:52,834 The person that wrote the tool told Microsoft that Web server 255 00:11:52,834 --> 00:11:56,959 2008 and Server 2012 were much more resistant to the flood. 256 00:11:57,167 --> 00:11:59,626 This is something I found out because I have a student who 257 00:11:59,626 --> 00:12:02,709 is nuts and set up a real IPv6 lab and a lot of real equipment 258 00:12:02,709 --> 00:12:04,834 and would not stop he had everything going 259 00:12:04,834 --> 00:12:06,999 the way it was to use it. 260 00:12:07,125 --> 00:12:10,083 We found things that only happen under those conditions. 261 00:12:10,083 --> 00:12:12,167 So now this is the new version of the tool. 262 00:12:12,167 --> 00:12:15,999 Each router advertisement packet can advertise more than one router. 263 00:12:15,999 --> 00:12:16,999 I don't know why. 264 00:12:16,999 --> 00:12:17,999 But they allow. 265 00:12:17,999 --> 00:12:22,999 So now it allows it now advertises 17 routes and 18 prefixes in every packet. 266 00:12:22,999 --> 00:12:25,626 So every one of those packets is like 35 of the previous ones 267 00:12:25,626 --> 00:12:29,751 if you send a lot of those in, it is quite dramatic. 268 00:12:29,918 --> 00:12:32,626 If you just turn on that flood alone and send it to Windows 8 269 00:12:32,626 --> 00:12:35,834 and Web Server 2012, it doesn't do much. 270 00:12:35,999 --> 00:12:38,626 There is some kind of defense built into them, but it doesn't work 271 00:12:38,626 --> 00:12:40,999 if you're actually using I.P. 272 00:12:40,999 --> 00:12:41,999 version 6. 273 00:12:41,999 --> 00:12:44,375 So let me just demonstrate this thing. 274 00:12:44,375 --> 00:12:45,375 It is good clean fun. 275 00:12:46,626 --> 00:12:48,999 You can do this run from BackTrack. 276 00:12:49,751 --> 00:12:52,542 Get rid of these unnecessary machines. 277 00:12:54,876 --> 00:12:56,417 And this one. 278 00:12:56,999 --> 00:12:59,250 All right. 279 00:12:59,834 --> 00:13:01,167 Here's good old BackTrack. 280 00:13:01,999 --> 00:13:04,375 And I have got a target here. 281 00:13:05,209 --> 00:13:07,459 All right. 282 00:13:07,459 --> 00:13:09,083 I'm going to show you the attacker and then I will move the cable 283 00:13:09,083 --> 00:13:10,918 all to the target. 284 00:13:10,918 --> 00:13:12,999 I don't know what will happen to the video. 285 00:13:12,999 --> 00:13:15,751 I will need your help to tell me if the video dies. 286 00:13:15,792 --> 00:13:19,999 So I am I have got a cable here. 287 00:13:19,999 --> 00:13:20,999 I will pull this out. 288 00:13:20,999 --> 00:13:22,709 This is very important, by the way. 289 00:13:22,709 --> 00:13:23,999 This attack will kill a Mac. 290 00:13:23,999 --> 00:13:26,417 It will kill the host underneath my VM. 291 00:13:26,417 --> 00:13:28,292 That interferes with my testing. 292 00:13:28,375 --> 00:13:30,501 The solution is to use a USB nick. 293 00:13:30,999 --> 00:13:34,334 When you plug it in, you get this happy message popping 294 00:13:34,334 --> 00:13:39,250 up, or so I would like to see, asking me where it goes. 295 00:13:39,999 --> 00:13:44,459 To get out to my Mac and plug it in again, if it continues 296 00:13:44,459 --> 00:13:48,501 to annoy me it asks me where to send it. 297 00:13:48,501 --> 00:13:50,334 I can send the USB to Kali Linux which 298 00:13:50,334 --> 00:13:53,834 is a good idea because the traffic that passes 299 00:13:53,834 --> 00:13:59,417 through the Mac ethernet will be USB and it won't kill the Mac. 300 00:13:59,584 --> 00:14:01,999 If it was using VMware networking and passing the network 301 00:14:01,999 --> 00:14:04,584 through the host, it would kill the host. 302 00:14:05,999 --> 00:14:09,167 So now that I have got networking in my virtual machine, 303 00:14:09,167 --> 00:14:11,459 let's see what I have. 304 00:14:13,959 --> 00:14:16,709 My config is deprecated. 305 00:14:18,876 --> 00:14:19,999 I.P. 306 00:14:19,999 --> 00:14:21,125 address shows eth1. 307 00:14:21,417 --> 00:14:24,876 This is my connection to this Web Server 2012 machine. 308 00:14:24,876 --> 00:14:29,999 So to make this attack work, you have to send some packets first. 309 00:14:29,999 --> 00:14:31,999 I'm going to put a zero here. 310 00:14:31,999 --> 00:14:33,999 I have got defco3o here. 311 00:14:33,999 --> 00:14:37,751 I'm advertising a network starting with defco3o. 312 00:14:37,999 --> 00:14:40,709 Let me show you what happens to the target. 313 00:14:43,250 --> 00:14:44,709 Okay. 314 00:14:47,250 --> 00:14:52,375 So hopefully let's see, this might work. 315 00:14:52,375 --> 00:14:55,375 Hopefully you are now seeing a Web Server 2012 desktop. 316 00:14:55,375 --> 00:14:56,375 Is it happening? 317 00:14:56,375 --> 00:14:57,999 It's of course not happening. 318 00:14:58,083 --> 00:15:02,834 I don't think it's necessary, but I will give it a try. 319 00:15:03,375 --> 00:15:09,083 How about now? 320 00:15:09,999 --> 00:15:14,083 Yeah! 321 00:15:14,083 --> 00:15:18,501 SAM BOWNE: Oh, good. 322 00:15:18,751 --> 00:15:19,751 That's good. 323 00:15:19,751 --> 00:15:20,999 I appreciate your help. 324 00:15:20,999 --> 00:15:24,959 Now, so I go to my glorious Power Shell window 325 00:15:24,959 --> 00:15:31,834 which is the replacement for command prompt and do I.P. 326 00:15:31,999 --> 00:15:35,083 config which is not deprecated, thank God. 327 00:15:37,167 --> 00:15:39,209 If I can only spell. 328 00:15:39,209 --> 00:15:40,209 Okay. 329 00:15:40,209 --> 00:15:41,209 All right. 330 00:15:41,209 --> 00:15:44,209 And now I have joined a network called def3oc3. 331 00:15:44,417 --> 00:15:46,918 This machine is receiving IPv6 router advertisements 332 00:15:46,918 --> 00:15:48,876 and obeying them. 333 00:15:48,918 --> 00:15:50,667 Let me turn this around because it is facing you 334 00:15:50,667 --> 00:15:52,999 because the next part is fun. 335 00:16:00,999 --> 00:16:02,584 That's looking good. 336 00:16:02,918 --> 00:16:03,999 It is not subtle. 337 00:16:03,999 --> 00:16:05,751 So if you are seeing it from the back row, 338 00:16:05,751 --> 00:16:08,125 the point should be clear. 339 00:16:08,125 --> 00:16:10,584 I have joined a network and sending some router 340 00:16:10,584 --> 00:16:14,876 advertisements and now I just send a flood which is as many packets 341 00:16:14,876 --> 00:16:18,876 as it can possible send of those new router advertisements that 342 00:16:18,876 --> 00:16:22,125 advertise 35 routes and prefixes each. 343 00:16:22,125 --> 00:16:24,292 What happens is in about 30 seconds this thing should 344 00:16:24,292 --> 00:16:26,375 die a gruesome death. 345 00:16:28,999 --> 00:16:30,542 7, 8. 346 00:16:30,751 --> 00:16:31,999 I can't see it. 347 00:16:33,083 --> 00:16:37,999 I have to move this thing around. 348 00:16:37,999 --> 00:16:38,999 All right. 349 00:16:38,999 --> 00:16:40,417 Now, by the way just check it. 350 00:16:52,999 --> 00:16:54,334 Okay. 351 00:16:54,334 --> 00:16:55,542 Been about 15 seconds. 352 00:16:55,542 --> 00:16:56,999 Now, the mouse moves but I.P. 353 00:16:56,999 --> 00:16:59,125 addresses cannot change Windows in front. 354 00:16:59,125 --> 00:17:00,667 I click and nothing happens. 355 00:17:00,667 --> 00:17:01,083 Pretty soon the mouth won't move and then it dies 356 00:17:01,083 --> 00:17:03,501 a horrible blue screen of death. 357 00:17:03,792 --> 00:17:05,999 Anyway, that's what I wanted to show you. 358 00:17:05,999 --> 00:17:07,375 Those are two scary attacks. 359 00:17:07,375 --> 00:17:08,375 (applause). 360 00:17:08,375 --> 00:17:09,584 SAM BOWNE: Oh, good. 361 00:17:09,584 --> 00:17:10,584 Thank you. 362 00:17:17,209 --> 00:17:19,083 I'm glad it worked. 363 00:17:19,083 --> 00:17:22,083 So the that's kind of rude. 364 00:17:22,083 --> 00:17:25,083 So my point is Microsoft has to go back to the drawing board. 365 00:17:25,083 --> 00:17:25,999 They put out an update but the update works 366 00:17:25,999 --> 00:17:28,542 for Windows 7 and Web server R2. 367 00:17:28,667 --> 00:17:31,501 They didn't put it on 2012 or Windows 8 368 00:17:31,501 --> 00:17:34,999 because they thought it was not vulnerable but it 369 00:17:34,999 --> 00:17:40,999 is under the right conditions which I really owe that to a student. 370 00:17:40,999 --> 00:17:42,584 I was just going out of my mind. 371 00:17:42,584 --> 00:17:43,918 It would work sometimes. 372 00:17:43,918 --> 00:17:46,250 Try to record a YouTube video, it wouldn't work. 373 00:17:46,250 --> 00:17:47,250 Then it would work. 374 00:17:47,250 --> 00:17:50,250 He said it only works when the real router is on the network. 375 00:17:50,250 --> 00:17:51,250 That's true. 376 00:17:52,918 --> 00:17:55,292 I have tested it against Android phones including 377 00:17:55,292 --> 00:17:56,792 the Mac. 378 00:18:01,542 --> 00:18:03,834 Ubuntu sales right through. 379 00:18:06,125 --> 00:18:10,083 Apple and Google could fix their junk. 380 00:18:10,250 --> 00:18:12,667 It is possible to survive this attack. 381 00:18:12,834 --> 00:18:14,501 You just ignore all the router advertisements 382 00:18:14,501 --> 00:18:16,459 after the first 10 or so. 383 00:18:16,459 --> 00:18:17,459 All right. 384 00:18:17,459 --> 00:18:19,999 And I got a bunch of video showing you how to do it. 385 00:18:19,999 --> 00:18:21,876 If you want to mitigate it, of course, you can turn off IPv6 386 00:18:21,876 --> 00:18:24,375 but that's not very practical anymore. 387 00:18:24,375 --> 00:18:27,083 And you could filter this with your switch or your router 388 00:18:27,083 --> 00:18:29,709 or your firewall, only let router advertisements come 389 00:18:29,709 --> 00:18:31,999 through from trusted sources. 390 00:18:31,999 --> 00:18:33,959 I should mention the existing mitigations 391 00:18:33,959 --> 00:18:37,999 in the industry like RA Guard and Cisco switches are effective 392 00:18:37,999 --> 00:18:39,459 but weak. 393 00:18:39,459 --> 00:18:40,999 It is trivial to get past them. 394 00:18:40,999 --> 00:18:42,250 All you have to do is put extension headers 395 00:18:42,250 --> 00:18:44,125 on the router advertisements and the switch 396 00:18:44,125 --> 00:18:47,999 will not recognize them anymore and let them go right through. 397 00:18:47,999 --> 00:18:48,999 So that's true of almost the first generation 398 00:18:48,999 --> 00:18:50,959 of every security device. 399 00:18:50,959 --> 00:18:52,250 It is very flimsy. 400 00:18:52,250 --> 00:18:53,250 Anyway ... 401 00:18:53,292 --> 00:18:55,751 So I think that's enough of this. 402 00:18:55,918 --> 00:18:57,751 And I'm going to pass it on to Matthew tell you 403 00:18:57,751 --> 00:19:00,999 about defense and hopefully a few minutes to talk about cookies 404 00:19:00,999 --> 00:19:02,459 at the end. 405 00:19:05,167 --> 00:19:06,626 (applause). 406 00:19:09,334 --> 00:19:12,083 MATTHEW PRINCE: Thank you, Sam. 407 00:19:14,876 --> 00:19:22,999 Let's see if I can get video. 408 00:19:22,999 --> 00:19:24,083 SAM BOWNE: Exactly. 409 00:19:24,083 --> 00:19:25,417 Let me go take a look. 410 00:19:25,417 --> 00:19:26,417 Nothing yet. 411 00:19:26,417 --> 00:19:28,375 MATTHEW PRINCE: Give me one second. 412 00:19:28,375 --> 00:19:29,375 How's that? 413 00:19:29,375 --> 00:19:30,375 No? 414 00:19:30,375 --> 00:19:36,709 Yeah, okay, let's try it one more time. 415 00:19:36,709 --> 00:19:38,709 SAM BOWNE: This is the hardest part. 416 00:19:38,709 --> 00:19:40,751 MATTHEW PRINCE: Apologize for this. 417 00:19:40,751 --> 00:19:41,751 Any better? 418 00:19:41,751 --> 00:19:43,083 SAM BOWNE: No. 419 00:19:43,083 --> 00:19:46,584 MATTHEW PRINCE: I'm going to try changing the screen resolution. 420 00:19:46,584 --> 00:19:47,584 (applause). 421 00:19:47,584 --> 00:19:48,959 SAM BOWNE: There you go. 422 00:19:48,959 --> 00:19:51,999 MATTHEW PRINCE: Just have to select scare it into behaving. 423 00:19:52,209 --> 00:19:53,209 Okay. 424 00:19:53,501 --> 00:19:56,501 So I gave this talk at Blackhat which was lessons 425 00:19:56,501 --> 00:20:01,375 from surviving a 300 gigabyte denial of service attack. 426 00:20:01,417 --> 00:20:05,876 And I don't know about all of you, but Blackhat is kind 427 00:20:05,876 --> 00:20:08,709 of a dull conference. 428 00:20:09,042 --> 00:20:13,083 (laughter) So I wanted to sort of retool it and Sam has been telling me 429 00:20:13,083 --> 00:20:17,250 that it's a lot more fun to attack than defend so in that spirit, 430 00:20:17,250 --> 00:20:21,834 I thought I would teach you how to break the Internet. 431 00:20:23,250 --> 00:20:24,709 (applause). 432 00:20:26,125 --> 00:20:30,834 MATTHEW PRINCE: So you don't have to be as smart as Sam 433 00:20:30,834 --> 00:20:33,959 is it turns out to do this. 434 00:20:33,959 --> 00:20:35,918 We actually went through a practice run of this 435 00:20:35,918 --> 00:20:37,999 a little while ago. 436 00:20:37,999 --> 00:20:41,834 So back from March 18th to March 25th I had a series 437 00:20:41,834 --> 00:20:44,417 of really bad days. 438 00:20:44,792 --> 00:20:46,999 There was a series of very high volume denial 439 00:20:46,999 --> 00:20:49,999 of service attacks in one of our customers. 440 00:20:49,999 --> 00:20:54,167 It was publicized in a media and it was Spamhaus which 441 00:20:54,167 --> 00:20:58,876 we had a love/hate relationship with. 442 00:20:58,999 --> 00:21:02,334 They do some good things and once upon a time I used 443 00:21:02,334 --> 00:21:04,626 to be their lawyer. 444 00:21:05,125 --> 00:21:09,626 On Monday, March 18th, this was what their Web site looked 445 00:21:09,626 --> 00:21:13,999 like because they pissed off the wrong person. 446 00:21:14,501 --> 00:21:17,999 They called us and signed up for CloudFlare and CloudFlare 447 00:21:17,999 --> 00:21:21,375 is good at stopping some of these attacks. 448 00:21:21,667 --> 00:21:24,083 From March 18th to March 21st we saw annoyance 449 00:21:24,083 --> 00:21:27,167 attacks which is anything that sets off an alarm 450 00:21:27,167 --> 00:21:30,918 in our system which takes about 10 gigs. 451 00:21:31,999 --> 00:21:34,834 We got 156 of those last week. 452 00:21:34,999 --> 00:21:37,876 We're pretty good at stopping attacks of this size. 453 00:21:38,083 --> 00:21:41,417 To give you some scale, big DoS attacks that knocked 454 00:21:41,417 --> 00:21:45,083 the banks offline was around 60 gigs. 455 00:21:45,375 --> 00:21:48,083 These are not trivial attacks but this is pretty big. 456 00:21:48,083 --> 00:21:49,876 This is what it looks like. 457 00:21:49,876 --> 00:21:51,751 This is a couple ports on our network. 458 00:21:51,999 --> 00:21:55,751 The blue line represents egress traffic out of our network. 459 00:21:55,751 --> 00:21:56,250 It should always because we are 460 00:21:56,250 --> 00:21:59,334 a caching proxy it should be higher than the green line. 461 00:21:59,334 --> 00:22:02,417 This is ingress traffic coming into our network. 462 00:22:02,417 --> 00:22:06,542 This is what a 75 gigabyte DDoS attack looks like. 463 00:22:06,542 --> 00:22:10,083 There is no real software we write lots of cool software. 464 00:22:10,125 --> 00:22:13,542 These are simply volume based attacks. 465 00:22:13,834 --> 00:22:15,792 They are simply filling the pipe. 466 00:22:15,792 --> 00:22:17,792 You're dead at layer 3 under one of these attacks and we do a lot 467 00:22:17,792 --> 00:22:19,751 of things to stop it. 468 00:22:19,751 --> 00:22:21,667 But it is not cleverness that stops it. 469 00:22:21,667 --> 00:22:24,083 It is actually the size of the pipe that you have. 470 00:22:24,083 --> 00:22:26,999 And unfortunately that means it is really hard to patch. 471 00:22:27,167 --> 00:22:29,292 And so then it got real. 472 00:22:30,083 --> 00:22:34,375 So from March 24th to March 25th, this is traffic coming 473 00:22:34,375 --> 00:22:38,999 into our network that got up to about the peak 309 gigabytes 474 00:22:38,999 --> 00:22:40,751 per second. 475 00:22:40,751 --> 00:22:44,083 That probably wasn't all of the traffic hitting our network 476 00:22:44,083 --> 00:22:47,334 because some of it was congesting upstream 477 00:22:47,334 --> 00:22:49,999 and causing problems. 478 00:22:50,292 --> 00:22:56,501 And so those are UTC time. 479 00:22:56,501 --> 00:22:59,999 On March 23rd, I was on a date in little restaurant on Fulsom Street 480 00:22:59,999 --> 00:23:01,999 in San Francisco. 481 00:23:02,083 --> 00:23:05,125 And I should have actually brought the woman I was on a date 482 00:23:05,125 --> 00:23:09,209 with to tell you how much dinner that night sucked. 483 00:23:09,584 --> 00:23:12,792 But it sucked in a lot of different ways. 484 00:23:12,792 --> 00:23:14,999 It sucked because our team was calling us. 485 00:23:14,999 --> 00:23:15,250 It sucked because our upstream providers were 486 00:23:15,250 --> 00:23:19,375 calling us saying, You have a problem, it is starting to become our problem. 487 00:23:19,834 --> 00:23:21,751 And it sucked because I spent the entire time writing emails 488 00:23:21,751 --> 00:23:23,792 and talking on the phone. 489 00:23:23,792 --> 00:23:28,501 And as I will explain later, talking to lawyers makes any dinner suck. 490 00:23:28,709 --> 00:23:30,083 One of my (laughter). 491 00:23:30,125 --> 00:23:32,709 I'm a recovering lawyer so I can say that. 492 00:23:33,209 --> 00:23:37,125 One of my favorite emails from that period of time came 493 00:23:37,125 --> 00:23:42,083 from a network engineer at Google who I'm friends with. 494 00:23:42,083 --> 00:23:43,999 And he wrote the following: He said: I've often said 495 00:23:43,999 --> 00:23:47,999 we don't have to prepare for the largest possible attack. 496 00:23:47,999 --> 00:23:48,999 We just have to prepare for the largest attack 497 00:23:48,999 --> 00:23:51,709 the Internet can send without causing massive collateral 498 00:23:51,709 --> 00:23:53,709 damage to the others. 499 00:23:53,709 --> 00:23:55,751 It looks like you've reached that point. 500 00:23:55,751 --> 00:23:56,834 So congratulations. 501 00:23:56,999 --> 00:24:01,876 (laughter) MATTHEW PRINCE: This, by the way, if I ever call you 502 00:24:01,876 --> 00:24:06,792 and am freaking out is not a comforting message. 503 00:24:07,999 --> 00:24:11,209 So, you know, again, since we think that we've decided that 504 00:24:11,209 --> 00:24:14,792 we're going to be the bad guys, not the good guys and it is fun 505 00:24:14,792 --> 00:24:18,999 to destroy things, not create them, I want to tell you exactly what you need 506 00:24:18,999 --> 00:24:22,083 to launch this attack because all of you can do it probably 507 00:24:22,083 --> 00:24:23,709 from here. 508 00:24:23,709 --> 00:24:25,999 What you don't need are botnets because they're sort of a pain 509 00:24:25,999 --> 00:24:27,999 in the ass to build. 510 00:24:27,999 --> 00:24:29,667 You don't need a lot of people coordinated anonymous 511 00:24:29,667 --> 00:24:34,167 attacks are relatively trivial compared with some of the things we see. 512 00:24:34,167 --> 00:24:38,209 You also don't need a ton of technical skill in order to launch this. 513 00:24:38,209 --> 00:24:41,292 Instead what you need is a list of open DNS resolvers and this 514 00:24:41,292 --> 00:24:45,584 is something that's fairly easy to find these days and you need servers 515 00:24:45,584 --> 00:24:48,626 running on network that allow I.P. 516 00:24:48,626 --> 00:24:52,501 address spoofing and you don't need very many of these servers. 517 00:24:52,501 --> 00:24:54,959 Let me describe what these two things are so I know a lot of you 518 00:24:54,959 --> 00:24:57,999 in the audience have a sense but I want to make sure everybody 519 00:24:57,999 --> 00:24:59,959 is on the same page. 520 00:24:59,959 --> 00:25:01,834 What is an open DNS resolver. 521 00:25:05,876 --> 00:25:08,334 This is not Google DNS. 522 00:25:08,334 --> 00:25:13,834 This is misconfigured DNS resolvers which are running on the network. 523 00:25:13,834 --> 00:25:16,999 And Google DNS has great limits so you can't abuse it in this way. 524 00:25:16,999 --> 00:25:19,083 But, you know, Google should be slightly ashamed 525 00:25:19,083 --> 00:25:22,250 of the fact that, you know, how do you create 526 00:25:22,250 --> 00:25:26,834 an open DNS resolver if you have an Android phone in your pocket 527 00:25:26,834 --> 00:25:31,250 and you turn it on to WiFi as a WiFi sharing point. 528 00:25:31,250 --> 00:25:34,667 It by default becomes an open DNS resolver. 529 00:25:34,667 --> 00:25:36,626 So if you have a publicly routable I.P. 530 00:25:36,626 --> 00:25:38,667 address, you have just contributed one more ingredient 531 00:25:38,667 --> 00:25:41,751 to helping create these kinds of attacks. 532 00:25:41,751 --> 00:25:43,751 There are a number of home WiFi devices that have 533 00:25:43,751 --> 00:25:45,375 these things. 534 00:25:45,375 --> 00:25:47,834 And then people who say, wow, it would be fun to install BIND 535 00:25:47,834 --> 00:25:49,999 but don't set it up correctly can create 536 00:25:49,999 --> 00:25:52,125 all kinds of problems. 537 00:25:52,167 --> 00:25:55,918 So these are these misconfigured DNS servers running on the Internet. 538 00:25:55,918 --> 00:25:57,999 I think of them as slutty DNS servers. 539 00:25:57,999 --> 00:26:02,542 They respond to anything you send to them. 540 00:26:03,999 --> 00:26:07,999 What you need to take down the Internet is amplification. 541 00:26:07,999 --> 00:26:08,999 You only have certain resources and you need 542 00:26:08,999 --> 00:26:11,792 to make those resources significantly better. 543 00:26:11,792 --> 00:26:14,999 Here's how it works with open DNS resolvers. 544 00:26:14,999 --> 00:26:15,999 So that I.P. 545 00:26:17,459 --> 00:26:22,209 address, 63.217.84.76 as of, I don't know, noon today was 546 00:26:22,209 --> 00:26:26,999 an open DNS resolver runs on PCCW's network. 547 00:26:26,999 --> 00:26:28,584 There are a lot of these. 548 00:26:28,584 --> 00:26:29,876 They are not hard to find. 549 00:26:29,876 --> 00:26:31,834 This is just a DNS query. 550 00:26:31,834 --> 00:26:32,999 For those of you who are Windows people 551 00:26:32,999 --> 00:26:35,626 in the audience, one, I'm sorry. 552 00:26:35,626 --> 00:26:38,250 And, two, this is sort of the equivalent of NS lookup. 553 00:26:38,250 --> 00:26:42,459 And so what it returns is it returns all of the resources. 554 00:26:42,459 --> 00:26:44,250 So dissecting this query and returns any 555 00:26:44,250 --> 00:26:48,667 of the DNS records that's there, EDNS equals zero means give me 556 00:26:48,667 --> 00:26:52,999 all of the things like DNSSEC and everything else. 557 00:26:53,083 --> 00:26:57,167 TCP says send it all over UDP and set your buffer size to 4096, 558 00:26:57,167 --> 00:27:02,083 is the largest buffer you can set for a UDP packet, meaning give me 559 00:27:02,083 --> 00:27:04,459 as much as you can. 560 00:27:05,334 --> 00:27:07,999 It is a 64 byte query. 561 00:27:08,501 --> 00:27:12,501 This is what it results in when you query it. 562 00:27:12,626 --> 00:27:17,626 So that's a 3,363 byte response. 563 00:27:17,626 --> 00:27:21,209 In other words, it is a 50X amplification factor. 564 00:27:21,209 --> 00:27:23,375 You send a little bit up. 565 00:27:23,375 --> 00:27:25,999 You get 50 times as much back at you. 566 00:27:26,292 --> 00:27:29,125 The second thing that you need if you just if you are 567 00:27:29,125 --> 00:27:32,584 like Sam and you just want to knock your own computers offline 568 00:27:32,584 --> 00:27:36,959 all day, then you have got everything you need at this point. 569 00:27:37,125 --> 00:27:39,667 If, on the other hand, you want to attack other people's networks, 570 00:27:39,667 --> 00:27:43,083 then what you need is a network that allows source I.P. 571 00:27:43,083 --> 00:27:44,083 address spoofing. 572 00:27:44,083 --> 00:27:47,083 And as, you know, probably good networks and "good" 573 00:27:47,083 --> 00:27:50,459 in quotations because we are on the dark side, 574 00:27:50,459 --> 00:27:54,334 good networks don't let originating I.P. 575 00:27:55,501 --> 00:27:59,459 addresses, they don't let egress out of their network. 576 00:27:59,459 --> 00:28:00,999 They don't let them leave it. 577 00:28:00,999 --> 00:28:03,959 This is BCP38. 578 00:28:03,959 --> 00:28:06,417 BCP is best common practice. 579 00:28:06,417 --> 00:28:07,542 It has been the best common practice 580 00:28:07,542 --> 00:28:09,709 since the early 2000s. 581 00:28:10,292 --> 00:28:12,584 Good for us, again. 582 00:28:12,626 --> 00:28:14,417 There are a lot of networks however that don't follow 583 00:28:14,417 --> 00:28:17,792 the best common practice and we will enumerate some. 584 00:28:17,834 --> 00:28:20,125 Many networks are naughty, in other words. 585 00:28:20,959 --> 00:28:23,999 And UDP has no handshake. 586 00:28:23,999 --> 00:28:26,209 So unlike TCP which is really hard to spoof the source addresses of, 587 00:28:26,209 --> 00:28:30,999 with UDP you simply say, the source is this and everyone goes, yeah, cool. 588 00:28:30,999 --> 00:28:32,834 As long as the router is on the network announcing that, 589 00:28:32,834 --> 00:28:35,459 you can pretend to be anyone you want. 590 00:28:35,459 --> 00:28:36,999 In other words, that's an I.P. 591 00:28:36,999 --> 00:28:38,751 address on CloudFlare's network that Spamhaus again 592 00:28:38,751 --> 00:28:42,584 as of noon today sat behind, although it moves around. 593 00:28:42,584 --> 00:28:46,083 If you run that dig and again you set it to no TCP which means UDP only, 594 00:28:46,083 --> 00:28:50,709 what it is going to be is it will result in that response getting sent back 595 00:28:50,709 --> 00:28:52,501 to the source. 596 00:28:52,501 --> 00:28:54,167 In fact, you have reflected the attack back 597 00:28:54,167 --> 00:28:57,999 at your intended victim and your attack is 50 times the size 598 00:28:57,999 --> 00:29:01,876 of whatever volume you're able to generate. 599 00:29:01,876 --> 00:29:04,083 If you can generate a gig of traffic, that means you can generate 50 gigs 600 00:29:04,083 --> 00:29:05,584 of attack. 601 00:29:05,584 --> 00:29:07,250 This is sort of similar to the old Smurf attacks 602 00:29:07,250 --> 00:29:09,751 if people remember them. 603 00:29:09,751 --> 00:29:11,709 IMCP packet that is are bounced off. 604 00:29:11,709 --> 00:29:12,918 The good news with smurf attacks 605 00:29:12,918 --> 00:29:17,334 because vendors were consolidated they could patch them. 606 00:29:17,834 --> 00:29:21,334 You don't see many IMCP smurf attacks anymore. 607 00:29:21,334 --> 00:29:25,292 Because any idiot can install BIND and misconfigure it, this 608 00:29:25,292 --> 00:29:28,209 is a significant problem. 609 00:29:28,209 --> 00:29:32,292 So how common are these particular ingredients? 610 00:29:32,292 --> 00:29:34,083 Like, is this something that will take a lot of exotic skill 611 00:29:34,083 --> 00:29:35,999 a bunch of time? 612 00:29:35,999 --> 00:29:38,918 Generally people are lazy so we want to make this easy. 613 00:29:38,999 --> 00:29:41,834 The good news is for us as of the time of the attack, 614 00:29:41,834 --> 00:29:45,417 there were about 21 million of these open resolvers running 615 00:29:45,417 --> 00:29:47,709 across the Internet. 616 00:29:47,709 --> 00:29:49,999 In fact, not coincidentally on March 25th, 617 00:29:49,999 --> 00:29:53,999 the open resolver project was launched. 618 00:29:53,999 --> 00:29:56,999 It was essentially the nuclear option for the good guys which said, 619 00:29:56,999 --> 00:29:59,918 we've always been terrified of publishing the list 620 00:29:59,918 --> 00:30:04,167 of open resolvers because then the bad guys will have them. 621 00:30:04,334 --> 00:30:05,792 Over the last weekend it became completely 622 00:30:05,792 --> 00:30:08,083 clear the bad guys do have them. 623 00:30:08,083 --> 00:30:10,083 So damn the torpedoes. 624 00:30:10,292 --> 00:30:13,584 So you would think four straight days of "New York Times" coverage might 625 00:30:13,584 --> 00:30:15,751 get people cleaning this up and so this would be 626 00:30:15,751 --> 00:30:17,876 a less effective attack. 627 00:30:17,876 --> 00:30:20,792 What I'm happy to report is that today they're actually (laughter) 628 00:30:20,792 --> 00:30:24,375 there are actually 28 million open resolvers. 629 00:30:25,626 --> 00:30:26,999 (applause). 630 00:30:26,999 --> 00:30:28,709 MATTHEW PRINCE: So have at it. 631 00:30:28,959 --> 00:30:31,792 You can also with not much challenge, there is a little bit of protection 632 00:30:31,792 --> 00:30:33,999 on the open resolver project. 633 00:30:33,999 --> 00:30:36,999 You can sleeves put a/24 at a time and all kinds of things. 634 00:30:36,999 --> 00:30:39,918 If you don't want to query the Internet because that's hard, 635 00:30:39,918 --> 00:30:43,792 you can write a crawler to crawl the open resolver project and pull 636 00:30:43,792 --> 00:30:47,542 down the list of open resolvers so there you go. 637 00:30:47,542 --> 00:30:49,667 The other piece and this is a little bit harder to find is that, 638 00:30:49,667 --> 00:30:53,709 you know, you want to see we need to find a network that allows I.P. 639 00:30:53,709 --> 00:30:55,999 address spoofing and Comcast and big eyeball networks, you 640 00:30:55,999 --> 00:30:58,999 will have to look around a little bit. 641 00:30:58,999 --> 00:31:00,375 But the good news again is that almost 25% 642 00:31:00,375 --> 00:31:03,083 of networks AS numbers surveyed on the Internet 643 00:31:03,083 --> 00:31:07,542 of 10% that have been surveyed so far, this is according to a MIT project, 644 00:31:07,542 --> 00:31:09,999 do allow network spoofing. 645 00:31:09,999 --> 00:31:12,375 So, again, talk to your neighbors. 646 00:31:12,375 --> 00:31:15,999 Chances are one of you is running on a network that allows this to happen. 647 00:31:15,999 --> 00:31:17,167 So, you know, if we go back to a case study 648 00:31:17,167 --> 00:31:20,999 of the Spamhaus attack and we look at what was actually involved, first 649 00:31:20,999 --> 00:31:23,792 of all, again, if you're fearing that you don't have 650 00:31:23,792 --> 00:31:26,792 the technical skills involved to launch this, this is one 651 00:31:26,792 --> 00:31:30,083 of the individuals that was involved with it. 652 00:31:30,083 --> 00:31:32,250 Not exactly a brain trust. 653 00:31:32,250 --> 00:31:34,542 My evidence that he wasn't a brain trust is he talked on record 654 00:31:34,542 --> 00:31:37,125 to "The New York Times" about launching a giant denial 655 00:31:37,125 --> 00:31:39,083 of service attack. 656 00:31:39,999 --> 00:31:42,125 Again, this is a really interesting thing. 657 00:31:42,125 --> 00:31:43,751 At one point, they stopped targeting us 658 00:31:43,751 --> 00:31:46,125 and targeted the London Internet Exchange, 659 00:31:46,125 --> 00:31:48,999 which counts as infrastructure. 660 00:31:48,999 --> 00:31:51,125 Which targeting it is a terrorist offense. 661 00:31:51,584 --> 00:31:55,542 So those eyebrows, I love them. 662 00:31:55,542 --> 00:31:56,542 (laughter). 663 00:31:56,542 --> 00:31:58,334 MATTHEW PRINCE: So the Spamhaus ingredients, 664 00:31:58,334 --> 00:32:00,709 how hard was it? 665 00:32:00,709 --> 00:32:02,459 Again, what did this brain trust do? 666 00:32:02,459 --> 00:32:06,584 Spamhaus generate 309 gigabytes for 28 minutes. 667 00:32:06,584 --> 00:32:10,083 They use 30,956 open resolver I.P. 668 00:32:10,083 --> 00:32:11,209 addresses and they only use three networks that 669 00:32:11,209 --> 00:32:12,999 allowed spoofing. 670 00:32:13,501 --> 00:32:15,626 So, again, not so tough, right? 671 00:32:15,626 --> 00:32:18,999 So, in other words, there's one attacker with one laptop. 672 00:32:18,999 --> 00:32:20,501 It actually turns out it wasn't the Sven guy, 673 00:32:20,501 --> 00:32:25,584 but I can't tell you who it was which is sad because it is a great story. 674 00:32:25,584 --> 00:32:26,999 There were five to seven compromised servers 675 00:32:26,999 --> 00:32:29,999 on three networks that allowed spoofing. 676 00:32:29,999 --> 00:32:33,999 They sent about 9 gigabytes of DNS requests to 0.1% 677 00:32:33,999 --> 00:32:41,083 of the open resolvers and resulted in a 300 gigabyte per second attack that 678 00:32:41,083 --> 00:32:43,250 was painful. 679 00:32:44,292 --> 00:32:48,417 You can see, though, how there's opportunity here. 680 00:32:48,834 --> 00:32:53,125 So create .2% and you are at 600 gigs. 681 00:32:53,125 --> 00:32:56,083 Get up to 1% and you can send three terabytes. 682 00:32:56,209 --> 00:32:58,876 8% and is 12 terabytes. 683 00:32:59,334 --> 00:33:01,709 The entire U.S. 684 00:33:01,709 --> 00:33:03,999 Internet backbone is 24 terabytes. 685 00:33:05,250 --> 00:33:08,125 So someone may notice that. 686 00:33:08,709 --> 00:33:09,876 (laughter). 687 00:33:10,167 --> 00:33:12,999 And you don't need to necessarily like we are pain in the ass 688 00:33:12,999 --> 00:33:17,709 to realize because we use Anycast and do things that make it tough. 689 00:33:17,876 --> 00:33:19,999 The attack was against our I.P. 690 00:33:19,999 --> 00:33:21,125 addresses at first. 691 00:33:21,125 --> 00:33:23,999 But most people don't correctly configure their networks, 692 00:33:23,999 --> 00:33:27,626 you can actually target intra networks. 693 00:33:28,959 --> 00:33:31,834 You can actually address the I.P.s inside someone's network, 694 00:33:31,834 --> 00:33:33,667 not just the edge. 695 00:33:33,667 --> 00:33:37,292 Like, the London Internet Exchange, that's a routable I.P. 696 00:33:37,292 --> 00:33:40,501 You can send the traffic to the choke points on the Internet 697 00:33:40,501 --> 00:33:45,209 and it turns out that the biggest, baddest router that Juniper Cisco buys 698 00:33:45,209 --> 00:33:47,459 has 100 gig ports. 699 00:33:47,459 --> 00:33:50,918 How many of those can you take offline with a 12 terabyte attack? 700 00:33:52,667 --> 00:33:56,542 So an alternative talk, which we could give, would be how 701 00:33:56,542 --> 00:33:59,417 to stop Internet Armageddon. 702 00:33:59,417 --> 00:34:02,209 Again, I gave some version of this at Blackhat. 703 00:34:02,417 --> 00:34:04,999 Implement BCP38 if you are running a network, clean 704 00:34:04,999 --> 00:34:07,083 up the open resolvers, clean up your upstream, 705 00:34:07,083 --> 00:34:09,125 work with CloudFlare. 706 00:34:09,125 --> 00:34:11,501 These are all good suggestions (laughter). 707 00:34:11,501 --> 00:34:15,999 MATTHEW PRINCE: But frankly blah, blah, blah, blah, blah. 708 00:34:15,999 --> 00:34:20,083 And so let's give something a little more DEF CONy. 709 00:34:20,083 --> 00:34:24,334 I want to return to dinner on March 23rd which, again, sucked. 710 00:34:24,959 --> 00:34:27,999 And on March 23rd, I got a bunch of calls. 711 00:34:27,999 --> 00:34:30,125 Got a call from a bunch of different people. 712 00:34:30,125 --> 00:34:30,542 At one point I got a call from one of the people 713 00:34:30,542 --> 00:34:33,959 on our systems engineering team and they said I have a solution. 714 00:34:34,292 --> 00:34:36,999 And I said, oh? 715 00:34:37,209 --> 00:34:42,792 And he said, we could just make all the open resolvers attack each other. 716 00:34:42,792 --> 00:34:43,792 (laughter). 717 00:34:47,626 --> 00:34:50,083 And so I called our lawyer. 718 00:34:54,167 --> 00:34:55,334 (laughter). 719 00:34:55,334 --> 00:34:57,959 We have a really cool lawyer. 720 00:34:57,999 --> 00:35:03,876 Like, Sam Coates at Cooley is pretty good. 721 00:35:03,876 --> 00:35:06,542 I can't exactly tell you what his advice was. 722 00:35:06,542 --> 00:35:09,709 It wasn't yeah, absolutely, go for it. 723 00:35:09,999 --> 00:35:12,542 But it wasn't exactly no under no circumstance you should 724 00:35:12,542 --> 00:35:13,959 do it. 725 00:35:13,999 --> 00:35:15,999 And thankfully the attack didn't get much bigger 726 00:35:15,999 --> 00:35:18,501 and we could stop a 300 gig attack. 727 00:35:18,501 --> 00:35:21,918 But if it had gotten to a terabyte, it would have been interesting. 728 00:35:23,918 --> 00:35:28,792 So we created this little C program called self destruct.c which, again, 729 00:35:28,792 --> 00:35:33,959 the lawyers told me I can't give out the code but here it is. 730 00:35:33,999 --> 00:35:34,999 (laughter). 731 00:35:34,999 --> 00:35:36,083 (applause). 732 00:35:36,125 --> 00:35:38,751 MATTHEW PRINCE: It's 50 lines of c. 733 00:35:38,751 --> 00:35:41,209 It's nothing, right? 734 00:35:41,209 --> 00:35:43,959 So, you know, again, I don't necessarily want 735 00:35:43,959 --> 00:35:48,834 to actively challenge you to solve this problem yourself. 736 00:35:48,834 --> 00:35:50,999 But if you decide that you want to in about 50 lines 737 00:35:50,999 --> 00:35:53,999 of C you may save the Internet. 738 00:35:54,125 --> 00:35:56,334 And this is kind of the beauty of it. 739 00:35:56,334 --> 00:35:57,999 You will break it in the meantime. 740 00:35:57,999 --> 00:35:58,999 (laughter). 741 00:35:58,999 --> 00:36:03,542 MATTHEW PRINCE: So, you know, use some discretion. 742 00:36:03,626 --> 00:36:06,709 Anyway, thanks for having me, Sam. 743 00:36:06,709 --> 00:36:08,792 It is always fun to give your talks. 744 00:36:08,792 --> 00:36:11,542 I will let you talk a little bit more about cookie reuse. 745 00:36:12,667 --> 00:36:13,999 (applause). 746 00:36:15,876 --> 00:36:18,167 SAM BOWNE: Great. 747 00:36:19,999 --> 00:36:21,501 Well, good. 748 00:36:21,501 --> 00:36:22,667 I'm glad we're managing on the time 749 00:36:22,667 --> 00:36:26,083 despite the technical difficulties because I have another thing 750 00:36:26,083 --> 00:36:27,918 to show you. 751 00:36:27,918 --> 00:36:29,417 And I'm glad Matthew put something on the screen that 752 00:36:29,417 --> 00:36:32,083 he really shouldn't show you because I'm really showing you stuff 753 00:36:32,083 --> 00:36:34,584 that I really shouldn't show you. 754 00:36:35,167 --> 00:36:36,751 Is it working? 755 00:36:36,751 --> 00:36:37,751 No. 756 00:36:37,751 --> 00:36:39,083 SAM BOWNE: Of course not. 757 00:36:39,083 --> 00:36:40,083 Let's try Yes! 758 00:36:40,083 --> 00:36:41,083 SAM BOWNE: Good. 759 00:36:41,083 --> 00:36:42,083 So. 760 00:36:42,250 --> 00:36:43,250 That's fine. 761 00:36:43,250 --> 00:36:45,083 This only takes about three minutes. 762 00:36:45,083 --> 00:36:46,375 I did this at Besides. 763 00:36:46,375 --> 00:36:48,709 And my talk is not online yet because they're worried they need 764 00:36:48,709 --> 00:36:51,542 to blur it out before they can publish it. 765 00:36:51,542 --> 00:36:54,083 This is my chase Manhattan credit card statement. 766 00:36:54,459 --> 00:36:57,125 I'm logged in for my online banking. 767 00:36:58,834 --> 00:37:01,250 Let me just show you what happens here. 768 00:37:01,250 --> 00:37:02,250 I'm logged in. 769 00:37:02,250 --> 00:37:04,999 This is Sam Bowne and there's stuff about my account. 770 00:37:04,999 --> 00:37:07,626 And I'm going to take the cookie off of this site with this is chrome 771 00:37:07,626 --> 00:37:11,542 and I got the extension that it is easy to get the cookies. 772 00:37:11,792 --> 00:37:15,751 It is something called "get this cookie." 773 00:37:15,999 --> 00:37:17,999 Now the cookie is in a clipboard. 774 00:37:18,417 --> 00:37:20,542 I will log off. 775 00:37:20,709 --> 00:37:22,667 And they would like me to click that button 776 00:37:22,667 --> 00:37:26,751 as if it was actually doing something but it is not doing anything. 777 00:37:26,751 --> 00:37:28,918 It's just there to waste my time. 778 00:37:28,918 --> 00:37:30,209 The only thing it does is that Matthew comes up and uses 779 00:37:30,209 --> 00:37:32,999 the computer he can't get into my account. 780 00:37:34,459 --> 00:37:37,209 Now, if I try to go back to my Chase Manhattan 781 00:37:37,209 --> 00:37:39,375 personalized page. 782 00:37:39,792 --> 00:37:41,709 It says you have to log in, which was what I wanted 783 00:37:41,709 --> 00:37:44,959 to accomplish by clicking that log off button. 784 00:37:44,959 --> 00:37:50,334 But I did not accomplish it because if I just put the cookie back in, 785 00:37:50,334 --> 00:37:55,250 which is there, and then try to go to that link, I'm back 786 00:37:55,250 --> 00:38:00,459 in my account authenticated without my password. 787 00:38:00,459 --> 00:38:01,584 Now, this is wrong! 788 00:38:01,584 --> 00:38:02,584 (applause). 789 00:38:05,959 --> 00:38:08,542 And, by the way, since everything is working, 790 00:38:08,542 --> 00:38:12,542 here's American Express and the same thing is true. 791 00:38:12,792 --> 00:38:16,584 If I export the cookie from American Express and then I hit 792 00:38:16,584 --> 00:38:21,417 that log out button just tempting me to click it if that was going 793 00:38:21,417 --> 00:38:26,334 to protect my security in some way and then I bring the cookie back 794 00:38:26,334 --> 00:38:30,334 and then I go back to my personalized American Express 795 00:38:30,334 --> 00:38:33,999 page, hey, whoa, that's interesting. 796 00:38:33,999 --> 00:38:35,125 This one timed out. 797 00:38:35,334 --> 00:38:37,083 That's only fair. 798 00:38:37,083 --> 00:38:40,667 These two credit card companies do a 10 minute timeout on the cookies. 799 00:38:41,083 --> 00:38:45,459 I was trying to keep it alive down there, then you time out. 800 00:38:45,459 --> 00:38:47,250 That's defense in depth. 801 00:38:47,250 --> 00:38:48,876 They have multiple controls. 802 00:38:48,876 --> 00:38:50,999 One compensates for a control that failed. 803 00:38:51,417 --> 00:38:53,501 This is a bad idea. 804 00:38:53,501 --> 00:38:55,083 The point that log out button should cancel the cookie 805 00:38:55,083 --> 00:38:56,834 on the server. 806 00:38:56,834 --> 00:38:59,876 When I click that button, my intention is nobody should get in here again 807 00:38:59,876 --> 00:39:02,876 from this device without a password. 808 00:39:02,876 --> 00:39:04,999 So I started testing other ones. 809 00:39:04,999 --> 00:39:07,083 This came from a hacker news article. 810 00:39:07,083 --> 00:39:08,584 Everything is on my Web site. 811 00:39:10,751 --> 00:39:12,334 I made some videos. 812 00:39:12,334 --> 00:39:14,375 Gave these guys a week to fix it. 813 00:39:14,501 --> 00:39:16,626 They told me they would get back in 24 hours and 814 00:39:16,626 --> 00:39:18,834 they never got back to me. 815 00:39:18,999 --> 00:39:22,999 I put it on YouTube and they never did something. 816 00:39:22,999 --> 00:39:26,999 I said maybe if I show it at DEF CON they will fix it. 817 00:39:27,709 --> 00:39:29,959 I tried a lot of sites. 818 00:39:29,959 --> 00:39:32,209 There are a lot of good ones and a lot of bad ones. 819 00:39:32,999 --> 00:39:35,542 I checked CloudFlare and they were vulnerable and 820 00:39:35,542 --> 00:39:37,375 they patched it. 821 00:39:37,709 --> 00:39:38,999 They do that pretty often. 822 00:39:38,999 --> 00:39:39,999 (applause). 823 00:39:39,999 --> 00:39:42,999 SAM BOWNE: The only person that has ever moved from the bad side 824 00:39:42,999 --> 00:39:45,334 to the good side. 825 00:39:45,626 --> 00:39:48,417 But, anyway, I'm hoping they will write a blog explaining 826 00:39:48,417 --> 00:39:51,542 to these other persons of questionable efficiency how 827 00:39:51,542 --> 00:39:56,209 to do it because it's perhaps that they don't know how to do it. 828 00:39:56,209 --> 00:39:58,709 I'm afraid that it's more that they don't care. 829 00:39:58,709 --> 00:39:59,834 There is a lot of them. 830 00:39:59,834 --> 00:40:02,626 One that really surprised me Gmail was not vulnerable. 831 00:40:03,459 --> 00:40:05,999 Some other people tried other Google services. 832 00:40:05,999 --> 00:40:07,999 And the Chrome app store is vulnerable. 833 00:40:08,334 --> 00:40:10,999 I cloud is completely vulnerable. 834 00:40:11,250 --> 00:40:14,999 Microsoft office 365, you can log out and then change your password 835 00:40:14,999 --> 00:40:19,292 and wait till tomorrow and the old cookie still works. 836 00:40:20,083 --> 00:40:21,999 So that is really rude because you know it is easy 837 00:40:21,999 --> 00:40:23,667 to steal cookies. 838 00:40:23,667 --> 00:40:25,250 My students to do it for homework. 839 00:40:25,999 --> 00:40:28,584 It is better to have the cookie than the password. 840 00:40:29,999 --> 00:40:32,999 This is wrong. 841 00:40:33,501 --> 00:40:36,999 If you would like to help, please send in more reports. 842 00:40:36,999 --> 00:40:40,667 Test Web sites, tweet them to me at Sam Bowne. 843 00:40:40,667 --> 00:40:43,083 You can gain eternal fame like some other people. 844 00:40:43,375 --> 00:40:46,250 I have a bunch of notes who tested it. 845 00:40:46,250 --> 00:40:49,501 So we might as well make a list of shame. 846 00:40:49,501 --> 00:40:51,999 I should mention, of course, it is not original. 847 00:40:51,999 --> 00:40:52,999 It is not new. 848 00:40:52,999 --> 00:40:54,918 This is the same thing fire sheep did. 849 00:40:54,918 --> 00:40:57,792 Cookie reuse is an endless annoying problem that we 850 00:40:57,792 --> 00:41:00,999 have to keep pounding on people. 851 00:41:01,584 --> 00:41:03,999 I have five minutes left. 852 00:41:04,083 --> 00:41:06,167 I have said everything I had to said. 853 00:41:06,209 --> 00:41:08,709 I go he is we are done. 854 00:41:08,709 --> 00:41:09,999 If you want to ask questions, meet us outside in the hall and we 855 00:41:09,999 --> 00:41:11,999 will go find some place. 856 00:41:11,999 --> 00:41:12,999 Okay. 857 00:41:12,999 --> 00:41:13,999 Very well. 858 00:41:13,999 --> 00:41:14,999 (Applause).