1 00:00:00,000 --> 00:00:04,880 My name is Andrew Hay. Very, very high level background about 2 00:00:04,880 --> 00:00:09,220 me. I learned graph theory so that I could understand what the 3 00:00:09,220 --> 00:00:12,860 hell my researchers were telling me. Because they were way and 4 00:00:12,860 --> 00:00:18,200 they are way smarter than me. So this was at open DNS where I was 5 00:00:18,880 --> 00:00:24,280 expanding and growing and managing the data science team 6 00:00:24,280 --> 00:00:29,060 and the analysts. So I would be talking to people and I don't 7 00:00:29,060 --> 00:00:32,720 know, some of you may know Diya Majub but he's got a Ph.D. in 8 00:00:32,720 --> 00:00:36,260 graph theory. So one, I didn't know that was a thing. And then 9 00:00:36,260 --> 00:00:40,180 in talking to him I realized he is way smarter than I would ever 10 00:00:40,180 --> 00:00:44,040 care to be as it pertains to graph theory. So I gleaned as 11 00:00:44,040 --> 00:00:47,920 much information as I could which was a big challenge because 12 00:00:47,920 --> 00:00:53,640 I have always been incredibly, incredibly shitty at math. So 13 00:00:53,640 --> 00:00:56,700 if you can't math good like me then this is the talk for you. 14 00:00:57,100 --> 00:00:59,040 Okay. So I'm going to talk a little bit about the 15 00:00:59,060 --> 00:01:01,480 graph theory. And if you are good at math, well, good for you. 16 00:01:01,520 --> 00:01:06,760 Your mother must be very, very proud. So basically what we're 17 00:01:06,760 --> 00:01:08,720 going to go over, I'm going to talk and this is going to be a 18 00:01:08,720 --> 00:01:11,680 very gentle introduction. There's not going to be a lot of 19 00:01:11,680 --> 00:01:15,240 math because, again, suck at math. Talk about some of the 20 00:01:15,240 --> 00:01:18,200 graphs in everyday life. Very, very high level. I'm focusing a 21 00:01:18,200 --> 00:01:22,680 lot on the tooling aspect to help you build your own tools or 22 00:01:22,680 --> 00:01:26,500 get accustomed to tools and platforms that will let you 23 00:01:26,500 --> 00:01:29,040 apply graph theory as it runs. So I'm going to talk a little bit 24 00:01:29,060 --> 00:01:32,120 about graph theory and how it relates to OSINT because it's very, 25 00:01:32,200 --> 00:01:35,680 very powerful and probably a little bit easier than you think 26 00:01:35,680 --> 00:01:41,360 and cheap. Very, very cheap. So show of hands. How many believe 27 00:01:41,360 --> 00:01:46,460 that A is a graph? One, two, a couple people. Okay. How many 28 00:01:46,460 --> 00:01:51,900 believe that B is a graph? How many believe that C is a graph? 29 00:01:53,060 --> 00:01:56,360 Well, the good news and bad news is you're all right and wrong. 30 00:01:57,420 --> 00:01:59,040 If you look up any of these graphs, you're going to see a 31 00:01:59,060 --> 00:02:01,860 lot of these charts. So we'll go over this in a little bit. But 32 00:02:01,860 --> 00:02:06,100 if you look any of these up on something like Wikipedia, it 33 00:02:06,100 --> 00:02:09,180 actually says, oh, it's a type of graph that is used for 34 00:02:09,180 --> 00:02:12,720 charting this graphical reference model. Like, well, 35 00:02:12,800 --> 00:02:18,820 that doesn't really clear things up. Thanks. So just for the 36 00:02:18,820 --> 00:02:22,740 context of this talk and from a data science perspective, when 37 00:02:22,740 --> 00:02:26,860 we're talking about a graph, it really is a collection of 38 00:02:26,860 --> 00:02:29,040 vertices, nodes, and things like that. So you're going to see 39 00:02:29,040 --> 00:02:31,720 vertices, nodes, dots, and I really do use those 40 00:02:31,720 --> 00:02:33,800 interchangeably, and a lot of people do. Like, you'll hear 41 00:02:33,800 --> 00:02:39,580 people say vertices, child node, whatever. And it's where that 42 00:02:40,220 --> 00:02:43,000 entity represents something, whether it be a name, an IP 43 00:02:43,000 --> 00:02:47,540 address, a hash, and, you know, it could be a picture. And then 44 00:02:47,540 --> 00:02:50,920 there's the edges. Those are the relationships that tie those 45 00:02:51,680 --> 00:02:55,720 vertices together. And, you know, there is some sort of 46 00:02:55,720 --> 00:02:58,860 relationship between the two. So now you don't have to get a 47 00:02:59,040 --> 00:03:02,320 PhD in graph theory. Or at least an undergrad in graph 48 00:03:02,320 --> 00:03:06,980 theory. And I just want to say this. I always, you know, I poke 49 00:03:06,980 --> 00:03:10,900 a lot of fun at graph theory and people that understand it way 50 00:03:10,900 --> 00:03:14,260 better than me. But that's because it impresses the hell 51 00:03:14,260 --> 00:03:17,660 out of me how much they know. So it's very tongue in cheek. So 52 00:03:17,660 --> 00:03:22,540 no one should get very upset. Or too upset. I'm a big guy. I 53 00:03:22,540 --> 00:03:28,660 can take it. So this is a typical graph that you will see. 54 00:03:28,660 --> 00:03:31,560 And you can start this by yourself on a piece of paper. 55 00:03:31,700 --> 00:03:34,840 And I've done a lot of projects where I'm trying to map like 56 00:03:34,840 --> 00:03:37,660 information together just on a big sheet of paper with circles. 57 00:03:37,900 --> 00:03:40,700 And, you know, I probably look like a toddler trying to color 58 00:03:40,700 --> 00:03:49,320 the worst picture in the world. But so we have a vertex or a 59 00:03:49,320 --> 00:03:55,140 vertices, sorry, that is one that is connected to three via 60 00:03:55,660 --> 00:03:58,640 nine. So nine is denoting that edge. Connecting that edge to 61 00:03:58,660 --> 00:04:04,020 connecting the two. You just graduated to your master's 62 00:04:04,020 --> 00:04:08,040 program. So, again, it's a very basic structure that you can 63 00:04:08,040 --> 00:04:14,320 apply to things. So like person, Bob, created or installed, 64 00:04:14,560 --> 00:04:18,660 let's say, an application on this server. So now you have a 65 00:04:18,660 --> 00:04:22,660 person, Bob, you can map to additional product installations, 66 00:04:23,060 --> 00:04:26,700 additional IP addresses, additional data to build this 67 00:04:26,700 --> 00:04:28,640 huge semantic network graph of data. And you can map it to a 68 00:04:28,660 --> 00:04:33,360 lot of data that will give you a very good idea of what is 69 00:04:33,360 --> 00:04:40,100 happening as it relates to Bob. Or the organization. So you can 70 00:04:40,100 --> 00:04:44,320 also add additional information to add more context. And that's 71 00:04:44,320 --> 00:04:47,980 typically known as a label or an ID. So, you know, for the 72 00:04:47,980 --> 00:04:51,500 person, we could say that this entity or this vertices is a 73 00:04:51,500 --> 00:04:56,800 person. And that person in this instance happens to be Bob or 74 00:04:56,800 --> 00:04:58,640 Marco. Marco. And then you can add additional information to 75 00:04:58,660 --> 00:05:04,320 this. And Marco is 29 years old. And the software that was 76 00:05:04,320 --> 00:05:09,740 installed was a Java program called BLOP. These aren't my 77 00:05:09,740 --> 00:05:15,240 pictures, by the way. All the sources at the bottom. So, now 78 00:05:15,240 --> 00:05:18,040 that we've gone over that, how many believe that A is a graph? 79 00:05:20,800 --> 00:05:28,120 B? C? So, if you talk to a data scientist, they will get an 80 00:05:28,660 --> 00:05:32,500 extremely angry if you call a chart a graph. Likewise, they 81 00:05:32,500 --> 00:05:35,980 will get very angry if you call a plot a graph. But like I said 82 00:05:35,980 --> 00:05:40,700 before, they are all graphing mechanisms. And it looks like 83 00:05:40,700 --> 00:05:44,180 we're going to build a fort with the cardboard. Awesome. So, 84 00:05:44,240 --> 00:05:50,220 again, for the purposes of this talk, a graph is a connection of 85 00:05:50,220 --> 00:05:56,500 nodes via edges to show you or to aggregate like information 86 00:05:57,060 --> 00:05:58,640 that you may need to reference. So, I'm going to go ahead and 87 00:05:58,640 --> 00:06:02,760 show you a reference at a later time. So, when you're talking 88 00:06:02,760 --> 00:06:06,240 about graph theory, you'll hear terms used interchangeably like 89 00:06:06,240 --> 00:06:10,820 networks. Or like network and graph is used interchangeably. 90 00:06:11,020 --> 00:06:14,200 And because I came from a networking background when I 91 00:06:14,200 --> 00:06:18,400 started my career, I tend to focus on network because a 92 00:06:18,400 --> 00:06:21,560 network graph, it makes sense to me visually if I'm trying to map 93 00:06:21,560 --> 00:06:25,800 packets going from hop to hop to hop or from, you know, router 94 00:06:25,800 --> 00:06:28,620 to router to device. And that's, you know, I spend a lot of my 95 00:06:28,640 --> 00:06:31,860 time, I spent most of my early formative days using TCP dump. So 96 00:06:31,860 --> 00:06:34,960 that's just where my mind goes. But you can use them 97 00:06:35,600 --> 00:06:46,080 interchangeably. If the edges are directional, we're closed. 98 00:06:47,060 --> 00:06:58,020 Geez. So, if, is he all right? He's good? Okay. Good. Yeah. 99 00:06:59,740 --> 00:07:07,740 All right. He can watch the video. So, you'll have the, the direction. 100 00:07:08,260 --> 00:07:12,300 If you have the directionality associated with a graph, you don't 101 00:07:12,300 --> 00:07:15,680 need to have a direction. It is helpful when you're trying to map 102 00:07:15,680 --> 00:07:20,720 out a large amount of information. As anyone who's used multigo will 103 00:07:20,720 --> 00:07:27,640 know. So, this goes to this, not vice versa. But you can have, when you have a directed 104 00:07:28,640 --> 00:07:28,920 view, you can have a COD in your graph. But the big difference is that 105 00:07:28,920 --> 00:07:31,120 you don't have the arrows going one way, that's sometimes called a digraph. 106 00:07:31,480 --> 00:07:38,060 But a lot of people just call it the directional graph. So, if all the 107 00:07:38,060 --> 00:07:41,500 edges are bidirectional, which happens, you can have the arrows going 108 00:07:41,500 --> 00:07:47,800 both ways. We don't judge in graph theory. We don't judge. Or it could be 109 00:07:47,800 --> 00:07:51,960 unidirected or you could have no directionality at all. Entirely up to 110 00:07:51,960 --> 00:07:57,780 to you how you want to represent the data for your purposes. So 111 00:07:57,780 --> 00:08:00,760 there's some variations as well. And you may have seen this in 112 00:08:00,760 --> 00:08:07,280 some larger applications where the edges may be thicker or a 113 00:08:07,280 --> 00:08:11,420 different color or have a different, like instead of a 114 00:08:11,420 --> 00:08:14,120 solid line, it's a dotted line. And that denotes something else. 115 00:08:14,540 --> 00:08:18,780 It's very common. And again, it's up to you as the data 116 00:08:18,780 --> 00:08:24,760 scientist, OSINT person, shitty math person to make it look like 117 00:08:24,760 --> 00:08:28,360 you want it to look. And the same thing with the nodes. You 118 00:08:28,360 --> 00:08:33,340 can make them any color you want. Makes it very easy to spot 119 00:08:33,340 --> 00:08:36,360 when something seems out of place or you have a cluster of 120 00:08:36,360 --> 00:08:41,940 information that you may not have understood, but now when 121 00:08:41,940 --> 00:08:44,720 it's clustered like that, it kind of pops and you can draw 122 00:08:44,720 --> 00:08:48,760 additional conclusions. So graphs in everyday life, 123 00:08:48,780 --> 00:08:54,480 we run into graphs all the time. And probably my favorite, and 124 00:08:54,480 --> 00:08:58,720 again, I'm a network guy, so remember when those maps of the 125 00:08:58,720 --> 00:09:03,460 Internet came out? It's like, that is awesome. So I'm Canadian. 126 00:09:03,600 --> 00:09:06,820 Oh, there's Canada, this tiny, tiny little network connection. 127 00:09:06,960 --> 00:09:09,600 Then there's the United States. And there's, like, all of Europe. 128 00:09:09,900 --> 00:09:15,280 And so Canada has this, like, one little dot. But if you look 129 00:09:15,280 --> 00:09:18,760 at the graph on the left, you can see colors. And so if you 130 00:09:18,760 --> 00:09:19,240 look at the graph on the right, you can see colors. And those 131 00:09:19,240 --> 00:09:23,000 colors are associated with specific countries. So let's say 132 00:09:23,000 --> 00:09:26,280 that red, and it probably is red, is associated with the 133 00:09:26,280 --> 00:09:30,820 United States. And the Internet graph, you can see, you know, 134 00:09:30,840 --> 00:09:33,360 that huge cluster of information as it pertains to the United 135 00:09:33,360 --> 00:09:37,580 States. So if you are a visual person like me, it makes it very 136 00:09:37,580 --> 00:09:40,580 easy to zero in on something. If you're color blind, I 137 00:09:40,580 --> 00:09:48,740 apologize. I didn't do colors. Another, another thing that I 138 00:09:48,760 --> 00:09:52,060 think is perfect example is Google Maps or any sort of mapping 139 00:09:52,060 --> 00:09:55,300 algorithm. How do I get from A to B? Like, oh, well, you go 140 00:09:55,300 --> 00:09:59,000 through C. And say what you want about all of the different 141 00:09:59,680 --> 00:10:03,600 mapping algorithms and mapping applications. They have probably 142 00:10:03,600 --> 00:10:05,960 helped you at one time or another. They may have had you 143 00:10:05,960 --> 00:10:09,440 off by a block or so, but they get you in the right 144 00:10:09,440 --> 00:10:15,700 neighborhood. And, yeah, you can also use graphs for perception 145 00:10:15,700 --> 00:10:18,740 and attitude analysis. Like, oh, I'm going to do this. I'm going 146 00:10:18,760 --> 00:10:21,540 to do this. Oh, what hashtags are trending now? Something about 147 00:10:21,540 --> 00:10:25,120 Britney Spears, undoubtedly. Which presidential candidate is 148 00:10:25,120 --> 00:10:29,660 being talked about the most? I think we know who that is. And 149 00:10:29,660 --> 00:10:38,060 then we can use this theory and apply OSINT to it. So 10,000 150 00:10:38,060 --> 00:10:40,360 foot view. So hang on. We're going to go really quickly 151 00:10:40,360 --> 00:10:42,820 through the tools. And all these slides are available. So you 152 00:10:42,820 --> 00:10:44,700 don't have to take pictures. Don't feel you have to take 153 00:10:44,700 --> 00:10:46,720 pictures of the slides. They probably won't come out that 154 00:10:46,720 --> 00:10:47,360 well anyway. 155 00:10:48,760 --> 00:10:53,500 So has anyone here used Google fusion tables? It's one of those 156 00:10:53,500 --> 00:10:58,800 like pseudo undocumented perpetual beta type of services 157 00:10:58,800 --> 00:11:03,840 that they have. But it's a fantastic way to build a 158 00:11:03,840 --> 00:11:07,220 network graph. Because you're just putting a whole bunch of 159 00:11:07,220 --> 00:11:10,320 stuff or a whole bunch of data into a table like you would a 160 00:11:10,320 --> 00:11:14,060 Google spreadsheet. And then saying, okay, this belongs to 161 00:11:14,060 --> 00:11:18,620 this. This belongs to this. And this is, you know, people 162 00:11:18,760 --> 00:11:24,320 this is IP addresses. This is an address. This is an e-mail 163 00:11:24,320 --> 00:11:27,520 address. And you're building all this. And then you hit go and 164 00:11:27,520 --> 00:11:30,080 it's like, boop, hey, we've got a graph. That's kind of cool. 165 00:11:30,520 --> 00:11:33,920 You know? How much did it cost you? Nothing. Well, your soul, a 166 00:11:33,920 --> 00:11:37,480 little piece of your soul maybe. Because it's Google. But, you 167 00:11:37,480 --> 00:11:41,560 know, it has a very robust, yeah. Does anyone here from 168 00:11:41,560 --> 00:11:45,100 Google? Does anyone here want to admit that they work at Google 169 00:11:45,100 --> 00:11:45,560 now? 170 00:11:46,780 --> 00:11:48,080 I think so. We just did. 171 00:11:50,740 --> 00:11:55,820 Yeah. Are you the developer of fusion tables? Because I'm a big 172 00:11:55,820 --> 00:11:59,040 fan. So, yeah, if you want to take a look at the docs, 173 00:12:00,160 --> 00:12:04,300 developersgoogle.com, fusion tables, very cool. SQL like 174 00:12:04,300 --> 00:12:09,080 interfaces to do queries and move around your data. You know, 175 00:12:09,080 --> 00:12:13,500 a lot of people bemoan SQL. But it still gets the job done quite 176 00:12:13,500 --> 00:12:18,740 a bit. Or quite frequently. Graph viz. This is, you know, a 177 00:12:18,760 --> 00:12:20,600 little bit more complex. I won't say it's one of the older, 178 00:12:20,760 --> 00:12:25,260 but it's been around for a while. It allows you to build 179 00:12:27,340 --> 00:12:32,960 somewhat complex network graphs, allows you to export them 180 00:12:32,960 --> 00:12:38,900 to all the various supported formats, PDF, SVG, ping. But, 181 00:12:39,380 --> 00:12:43,260 you know, it's, what makes it kind of cool is that you can 182 00:12:43,260 --> 00:12:45,840 embed hyperlinks. So if you want to embed hyperlinks and 183 00:12:45,840 --> 00:12:48,740 click on something, have it open up something else and, you know, 184 00:12:48,760 --> 00:12:51,860 you all know how hyperlinks work. Some of us more than others. 185 00:12:53,820 --> 00:12:56,880 Now, I found this one very interesting. So viz. Has anyone 186 00:12:56,880 --> 00:13:02,360 heard of viz before? It's, it was designed for journalists and 187 00:13:02,360 --> 00:13:06,060 authors and, you know, people that don't have a lot of 188 00:13:06,060 --> 00:13:10,300 technical acumen to start creating graphs of their sources 189 00:13:10,300 --> 00:13:12,660 and their information. So that when they're writing a story, 190 00:13:12,860 --> 00:13:16,100 instead of just a whole bunch of scribbled notes, they have that 191 00:13:16,100 --> 00:13:18,740 visual representation of how, you know, what they're doing. And 192 00:13:18,740 --> 00:13:21,740 that's how Bob was related to Mary and how they were both 193 00:13:21,740 --> 00:13:27,420 involved in, or being associated with a particular newspaper and 194 00:13:27,420 --> 00:13:31,160 then a story. So it makes it a lot easier for someone who's not 195 00:13:31,160 --> 00:13:33,820 incredibly technical to wrap their head around a symmetric 196 00:13:33,820 --> 00:13:39,520 network graph. Now, Gephi. Gephi is one of the old 197 00:13:39,520 --> 00:13:44,320 workhorses. This is one of the greatest data science tools for 198 00:13:44,320 --> 00:13:48,720 visualizing data because it can create a ridiculous amount of 199 00:13:48,740 --> 00:13:55,120 nodes and edges. People do call it the Photoshop, but for graph 200 00:13:55,120 --> 00:14:00,200 data. So you can change pretty much everything and anything. It 201 00:14:00,700 --> 00:14:04,260 is, you know, if you think of it as a tool built by data 202 00:14:04,260 --> 00:14:06,680 scientists for data scientists, that kind of sets your 203 00:14:07,220 --> 00:14:10,860 expectation or level of knowledge as to how difficult it 204 00:14:10,860 --> 00:14:17,260 is to use. But it's kind of like, does anyone here use R on a, 205 00:14:17,260 --> 00:14:17,800 yeah? 206 00:14:18,780 --> 00:14:23,740 Yeah. On a daily basis. I use R every day. It's the kind of 207 00:14:23,740 --> 00:14:25,920 thing that if you don't use frequently, you lose a lot of 208 00:14:25,920 --> 00:14:28,700 that knowledge. Just like any programming language. Gephi, I 209 00:14:28,700 --> 00:14:33,420 find, is very similar in that respect. Has anyone heard of 210 00:14:33,420 --> 00:14:41,020 Open Graffiti? Hey! So, Tebow Roy at OpenDNS created it. And 211 00:14:41,020 --> 00:14:48,720 it's a 3D immersive symmetric network graph engine. And it's 212 00:14:48,740 --> 00:14:52,000 built, he built it. It was amazing. He hooked it up to the 213 00:14:53,220 --> 00:14:59,380 leap and the, what the hell are the goggles there? Yeah, Oculus 214 00:14:59,380 --> 00:15:02,140 Rift. So it was funny because you could see people and they 215 00:15:02,140 --> 00:15:05,020 were like, oh, grabbing nodes and edges and moving them around 216 00:15:05,020 --> 00:15:08,420 and then falling over eventually. It was great. But, 217 00:15:08,520 --> 00:15:11,560 you know, if anything came from Open Graffiti is that it 218 00:15:11,560 --> 00:15:17,960 justifies the purchase of an Oculus Rift for your sock. So if 219 00:15:18,740 --> 00:15:22,600 you're like, hey, thanks for letting us buy toys. Uh, but an 220 00:15:22,600 --> 00:15:27,280 API, very accessible API to graph things on the fly and make 221 00:15:27,280 --> 00:15:32,120 those connections. So I've used this for, so I used to be an 222 00:15:32,120 --> 00:15:35,240 industry analyst at 451 Research. And I was always curious 223 00:15:35,980 --> 00:15:40,160 which companies had received funding from which, uh, venture 224 00:15:40,160 --> 00:15:43,560 capitalist firms. And what overlap there was in actual 225 00:15:43,960 --> 00:15:48,720 types of products. So I put five years of security and 226 00:15:48,740 --> 00:15:52,500 security mergers and acquisitions into my model. And 227 00:15:52,500 --> 00:15:56,300 I was able to see who was acquiring the most types of a 228 00:15:56,300 --> 00:16:00,460 particular company. And who could potentially be looking to 229 00:16:00,460 --> 00:16:03,720 acquire a company of that type. That's kind of interesting 230 00:16:04,840 --> 00:16:09,100 information for an analyst firm or for bankers to say, hey, you 231 00:16:09,100 --> 00:16:12,980 know what? This person, this company doesn't have a product 232 00:16:12,980 --> 00:16:17,620 of this type, but all of their competitors do. Who is available 233 00:16:17,620 --> 00:16:18,720 and for what price? 234 00:16:19,520 --> 00:16:23,720 So, it's kind of fun. Actually, I think that data sets included 235 00:16:24,440 --> 00:16:28,240 the open graffiti. And then there's Multico. I love this 236 00:16:28,240 --> 00:16:33,160 tool. It's fun. Uh, I, apparently I'm very bad at 237 00:16:33,160 --> 00:16:35,880 typos, too. Or good at typos, depending. It's the community 238 00:16:35,880 --> 00:16:41,340 edition. Uh, if you've not used this, download the, download the 239 00:16:41,340 --> 00:16:45,540 community edition. It is great to play with. Uh, you can have 240 00:16:45,540 --> 00:16:48,720 directed graphs. You can map your data quite easily. You can 241 00:16:48,720 --> 00:16:51,260 map it quite easily. It's not that steep a learning curve. It 242 00:16:51,260 --> 00:16:55,180 looks a little bit daunting at first. Especially if you try and 243 00:16:56,280 --> 00:17:01,020 use all of the visualizations and all of the connectors. And 244 00:17:01,020 --> 00:17:04,520 run all the transforms. That's just not a good idea. Because 245 00:17:05,000 --> 00:17:06,820 that'll just frustrate you and you won't want to use the tool 246 00:17:06,820 --> 00:17:12,480 again. Uh, they also have case file, which is essentially an 247 00:17:12,480 --> 00:17:15,100 offline version. So, if you're doing incident response or 248 00:17:15,100 --> 00:17:18,700 forensic analysis, and you want to trade up from the data that's 249 00:17:18,700 --> 00:17:25,760 coming from your handwritten notebook, not bad to use. Now, 250 00:17:25,820 --> 00:17:31,660 databases. Has anyone used Neo4j before? Does anyone like Java? 251 00:17:33,580 --> 00:17:38,920 Hands all go down. So, Neo4j is a graph database that has a 252 00:17:38,920 --> 00:17:42,460 wonderful front end that does all of the visualization for your, 253 00:17:42,480 --> 00:17:48,600 uh, your graph associations for you. Now, like any database, uh, 254 00:17:48,700 --> 00:17:53,960 if you do really poor, or poorly structured queries, you're going 255 00:17:53,960 --> 00:17:57,040 to have a very bad day when it tries to visualize all of them. 256 00:17:57,120 --> 00:18:00,260 Especially if you're not on a very powerful machine. So, you 257 00:18:00,260 --> 00:18:04,260 have to be very careful. Just like running SQL queries against 258 00:18:04,260 --> 00:18:07,360 a large data set or a large database in production, you 259 00:18:07,360 --> 00:18:11,280 could have adverse effects trying to visualize things back. 260 00:18:11,440 --> 00:18:14,260 And even working with the data, like moving around, zooming in, 261 00:18:14,860 --> 00:18:18,680 um, could eat up a lot of your memory. But, still pretty cool. 262 00:18:18,680 --> 00:18:21,600 Especially if you don't want to do a lot of the work yourself of 263 00:18:21,600 --> 00:18:25,800 trying to manipulate the nodes and edges. Uh, it has a pretty 264 00:18:25,800 --> 00:18:29,300 cool, uh, it's called the Cypher Query Language, which is very 265 00:18:29,300 --> 00:18:34,960 similar to SQL. But, yeah. And free. OrientDB, I haven't had a 266 00:18:34,960 --> 00:18:37,500 lot of time working with OrientDB. I played around with 267 00:18:37,500 --> 00:18:44,740 it a bit. Uh, I actually, in favor of Titan. So, every, every 268 00:18:44,740 --> 00:18:48,660 big company that is doing threat intelligence, they're doing a 269 00:18:48,680 --> 00:18:52,300 great job. Whether it's, you know, Cisco, uh, OpenDNS, anyone 270 00:18:52,300 --> 00:18:59,080 that's doing, like, massive scale graph representation, odds 271 00:18:59,080 --> 00:19:02,740 are they're using Titan. Because it sits as an abstraction 272 00:19:02,740 --> 00:19:06,760 layer on top of your data, usually Hadoop, and allows you 273 00:19:06,760 --> 00:19:10,440 to have a graph database abstraction layer without really 274 00:19:10,440 --> 00:19:17,080 impacting your core data that much. So, very, uh, very cool. I 275 00:19:17,080 --> 00:19:18,580 love the graphic, too. Graphic's awesome. 276 00:19:18,680 --> 00:19:24,040 Good logoing. And then Tinker Pop, which is, let's be honest, 277 00:19:24,140 --> 00:19:28,180 that's really fun to say. Tinker Pop. It's an open source graph 278 00:19:28,180 --> 00:19:32,120 computing framework. I, I'd say it's relatively new compared to 279 00:19:32,120 --> 00:19:35,720 some of the other tools. But, uh, again, you can have it as an 280 00:19:35,720 --> 00:19:40,580 abstraction layer over different databases. To get that, you 281 00:19:40,580 --> 00:19:48,420 know, that graphiness you want. So, Network X is probably Python 282 00:19:48,680 --> 00:19:52,420 programmers in the room. Yeah. I really shouldn't have put my 283 00:19:52,420 --> 00:19:55,120 hand up, because if you looked at my Git repo, you'd be like, 284 00:19:55,200 --> 00:19:59,360 you're not a Python programmer at all. And you'd be right. So, 285 00:19:59,400 --> 00:20:02,360 Network X is what most people use for creating semantic 286 00:20:02,360 --> 00:20:07,580 network graphs. Uh, Graph Tool is also fairly cool. Snap I 287 00:20:07,580 --> 00:20:11,140 haven't used, but because it's written in C++, it is pretty 288 00:20:11,140 --> 00:20:14,980 fast from what I've heard in talking to people. And, uh, it 289 00:20:14,980 --> 00:20:18,660 does scale immensely. So, if you need to make huge, huge 290 00:20:18,680 --> 00:20:22,180 network graphs, uh, and I'm not talking about visualization, I'm 291 00:20:22,180 --> 00:20:24,440 talking about just making those associations, you might want to 292 00:20:24,440 --> 00:20:28,360 look at Snap. Although, Network X is still pretty awesome. 293 00:20:28,600 --> 00:20:33,180 There's, like, unless you're doing, um, like, NASA-level data 294 00:20:33,680 --> 00:20:36,180 manipulation, you're probably going to be okay with Network X. 295 00:20:37,160 --> 00:20:42,180 Uh, SemanticNet. So, Thiebaud, who created, uh, Open Graffiti, 296 00:20:42,340 --> 00:20:48,080 created a very simple, uh, graphing network library. And 297 00:20:48,080 --> 00:20:48,660 it's, uh, it's, uh, it's, uh, it's, uh, it's, uh, it's, uh, it's, 298 00:20:48,680 --> 00:20:52,060 it's just creating semantic graphs in JSON. Makes it very 299 00:20:52,060 --> 00:20:57,060 easily readable to use in your other tools. And it's, you know, 300 00:20:57,080 --> 00:21:00,760 it, because it's JSON, it's easy to read. I tend to like 301 00:21:00,760 --> 00:21:04,960 that. Plotly, uh, if anyone's not used Plotly, it's kind of 302 00:21:04,960 --> 00:21:07,540 cool. You can get a lot of your graphs and visualizations without 303 00:21:07,540 --> 00:21:10,900 having to do a lot of work. So, this is really a module that just 304 00:21:10,900 --> 00:21:15,440 lets you map everything and then you push it off and Plotly will 305 00:21:16,000 --> 00:21:18,600 plot it for you in a cloud environment and give you, like, 306 00:21:18,680 --> 00:21:21,440 visual dashboards. So, if you don't, if you're not, like, a 307 00:21:21,440 --> 00:21:24,800 JavaScript whiz and don't like to do the Viz stuff on the fly, take 308 00:21:24,800 --> 00:21:29,020 a look at Plotly. Make your life a lot easier. Now, if you are a 309 00:21:29,020 --> 00:21:33,720 JavaScript kind of person, Viz.js is very, very popular for 310 00:21:33,720 --> 00:21:37,840 creating semantic network graphs. Uh, JS Network X, again, 311 00:21:37,960 --> 00:21:42,260 it's a JavaScript port of Network X. So, if you, you know, 312 00:21:42,260 --> 00:21:45,800 you've heard good things or you like the way Network X works, 313 00:21:46,440 --> 00:21:48,660 but you're a JavaScript person, then take a look at Plotly and 314 00:21:48,660 --> 00:21:57,000 look at JS Network X. So, let's make sure we're, yeah, alright. 315 00:21:58,100 --> 00:22:02,420 So, I like, when I was at OpenDNS, I always loved when 316 00:22:02,420 --> 00:22:07,020 someone would create a report that said, you know, well, the 317 00:22:07,020 --> 00:22:09,120 first thing it would say is, you know, we believe these Chinese 318 00:22:09,120 --> 00:22:11,940 hackers did X, Y, Z or we believe these Russian hackers 319 00:22:11,940 --> 00:22:16,080 did X, Y, Z based on these two IP addresses. And then they would 320 00:22:16,080 --> 00:22:18,640 expand the report. And if you're, you know, if you're a 321 00:22:18,660 --> 00:22:21,580 person in the field, you're lucky, they would put all of their 322 00:22:21,580 --> 00:22:25,840 IOCs in the bottom of the email or throughout the, or the bottom 323 00:22:25,840 --> 00:22:30,200 of the blog post or scattered throughout screenshots in the 324 00:22:30,200 --> 00:22:33,240 blog post. If they're not there, sometimes you had to kind 325 00:22:33,240 --> 00:22:35,620 of go through back channels and ask someone like, hey, can I get 326 00:22:35,620 --> 00:22:40,020 the IOCs and then start doing some research on them. What I 327 00:22:40,020 --> 00:22:43,620 found is that when I have that starting point, generally, I can 328 00:22:43,620 --> 00:22:48,460 find additional new information that may be pertinent to that 329 00:22:48,460 --> 00:22:48,640 information. So, if you're a type of person who, you know, is a 330 00:22:48,660 --> 00:22:52,760 investigation that they had not considered or that just wasn't 331 00:22:52,760 --> 00:22:55,720 available at the time they did their research. So it becomes 332 00:22:55,720 --> 00:22:59,960 very cool if you want to get your feet wet, start looking at 333 00:22:59,960 --> 00:23:02,720 other people's published IOCs and then see where you can pivot 334 00:23:02,720 --> 00:23:07,640 off and add additional nodes and edges to make associations. So 335 00:23:07,640 --> 00:23:12,240 this is a, from Minerva Labs, they did a really good blog post 336 00:23:12,240 --> 00:23:17,900 talking about binary that was mimicking Navicat, info sealing 337 00:23:17,900 --> 00:23:24,740 malware, POS oriented module. So I loaded the indicators into 338 00:23:24,740 --> 00:23:30,240 Maltego. So Maltego CE because it's free. I'm cheap and poor. 339 00:23:31,140 --> 00:23:35,420 So really what I did was I had available the hashes, domains, 340 00:23:35,620 --> 00:23:39,640 IP addresses, e-mail addresses and I manually went and created 341 00:23:39,640 --> 00:23:43,320 those nodes. And as you can see those nodes are not associated 342 00:23:43,320 --> 00:23:46,400 with anything yet. They're just nodes that have no edges 343 00:23:46,400 --> 00:23:47,880 whatsoever. So there's no edges whatsoever. So there's no 344 00:23:47,900 --> 00:23:53,160 association other than I know I put them in there. So what you 345 00:23:53,160 --> 00:23:58,020 can do, which is very cool with Maltego, is if you right click on 346 00:23:58,020 --> 00:24:02,480 certain nodes, you can enrich that data automatically. Now I 347 00:24:02,480 --> 00:24:06,560 would, if anyone has run all transforms after they've loaded 348 00:24:06,860 --> 00:24:11,520 a ton of transforms into the plug-ins folder, you're going 349 00:24:11,520 --> 00:24:14,920 to, you're going to have a bad day. Because it's going to look 350 00:24:14,920 --> 00:24:17,880 like someone threw a whole bunch of spaghetti on the wall. You're 351 00:24:17,900 --> 00:24:21,920 going to have to make sense of it after. If you start going 352 00:24:21,920 --> 00:24:26,460 through, or through an iterative process of running the 353 00:24:26,460 --> 00:24:30,280 transforms or creating those associations between the nodes, 354 00:24:30,880 --> 00:24:36,120 it's going to be far more manageable. So what I used, I 355 00:24:36,120 --> 00:24:40,260 had access to virus total. So the virus total public API, which 356 00:24:40,260 --> 00:24:43,380 anyone can get. Threat crowd, which anyone can get access to. 357 00:24:43,760 --> 00:24:47,780 Passive total. It was free. Just had to register. So those were 358 00:24:47,900 --> 00:24:52,840 sources of information that I was able to use. And when I 359 00:24:52,840 --> 00:24:56,100 started enriching the data, it drew the associations together 360 00:24:56,100 --> 00:25:00,380 for me. So this is, you know, the most zoomed out view that I 361 00:25:00,380 --> 00:25:04,480 could get that showed all of the different nodes. And you can see 362 00:25:04,980 --> 00:25:09,800 the associations, or all of the data that's associated with 363 00:25:09,800 --> 00:25:13,500 each node. Makes it a little hard to read, but luckily they 364 00:25:13,500 --> 00:25:17,880 have a nice color coded legend at the bottom. And then you can 365 00:25:20,400 --> 00:25:25,960 zoom in and figure out what's going on. So when you zoom in, 366 00:25:26,040 --> 00:25:30,820 looking at a particular hash, you could see, because of the virus 367 00:25:30,820 --> 00:25:35,920 total association, or the virus total transform, how the various 368 00:25:35,920 --> 00:25:39,980 vendors were recognizing that particular variant. Which may or 369 00:25:39,980 --> 00:25:44,580 may not be useful, but if you start seeing associations between 370 00:25:44,580 --> 00:25:47,880 additional hashes that weren't meant to be associated with the 371 00:25:47,900 --> 00:25:52,260 original report, then you can draw inferences that they may be 372 00:25:52,260 --> 00:25:58,680 related and research a little bit more in depth. So you can also 373 00:25:58,680 --> 00:26:02,360 see very interesting intersections. So the domains are 374 00:26:02,360 --> 00:26:05,880 all associated with the same domain registrant. So I got 375 00:26:05,880 --> 00:26:08,360 that from passive total automatically. They're all 376 00:26:08,360 --> 00:26:16,140 associated with jd1zzl33 at gmail.com. So it's not a hidden 377 00:26:16,140 --> 00:26:17,880 service. It's not a hidden service. It's not a hidden 378 00:26:17,900 --> 00:26:23,060 email registrant. It's an actual gmail account. And you 379 00:26:23,060 --> 00:26:27,780 can also see that fraternitylaw.co.in, well, you know, 380 00:26:29,380 --> 00:26:36,940 allegedly in India, you can see the changes in dates. And then 381 00:26:36,940 --> 00:26:40,500 you can also see associations like how the domains are all 382 00:26:40,500 --> 00:26:43,260 associated with the same IP address. So all of the domains 383 00:26:43,260 --> 00:26:46,400 that are in that report were associated with that same IP 384 00:26:46,400 --> 00:26:47,880 address. If I want to see the same IP address, I can go to the 385 00:26:47,880 --> 00:26:50,700 gmail.com. And if I wanted to, I could then say, given this 386 00:26:50,700 --> 00:26:54,240 information, what additional domains are associated with that 387 00:26:54,240 --> 00:26:57,160 IP address? That could be a huge list if it's a virtual hoster. 388 00:26:57,300 --> 00:27:01,480 It could be a very small list, especially if this threat actor 389 00:27:01,480 --> 00:27:05,100 is only registering domains as they need them for specific 390 00:27:05,100 --> 00:27:10,640 campaigns. And then you can just enrich the data with all the 391 00:27:10,640 --> 00:27:14,220 other domains registered using that particular email address. So 392 00:27:14,220 --> 00:27:17,860 we could find streetfighterx.top. And then you can just 393 00:27:17,880 --> 00:27:20,200 go and look at the entire domain. You could find a whole bunch of 394 00:27:20,200 --> 00:27:24,760 additional domains associated with that registrant that may or 395 00:27:24,760 --> 00:27:29,340 may not have been used in a previous campaign or might be 396 00:27:29,340 --> 00:27:33,940 used in a future campaign. So that gives you additional IOCs to 397 00:27:33,940 --> 00:27:41,600 track and monitor as time goes on. So when you start making all 398 00:27:41,600 --> 00:27:47,260 these associations, things get a little sloppy. So when you want 399 00:27:47,880 --> 00:27:51,420 to do that, one thing I recommend is when you're working with many 400 00:27:51,420 --> 00:28:00,220 indicators and a lot of overlapping associations is to create a copy of 401 00:28:00,220 --> 00:28:03,800 that graph. So if you just want to, it's, one thing I'll say about 402 00:28:03,800 --> 00:28:07,820 Maltego is it's hard to back out to the previous revision or several 403 00:28:07,820 --> 00:28:12,340 previous revisions because the revision control is more like Microsoft 404 00:28:12,340 --> 00:28:17,780 Word than it is a traditional revision control system. And, you know, I'm not 405 00:28:17,880 --> 00:28:23,300 going to fault them on that. It's a great tool otherwise. But if you want to run test 406 00:28:23,300 --> 00:28:28,600 transforms and just see what kind of data can shake out by making 407 00:28:29,160 --> 00:28:34,000 assumptions, then just create a copy of that graph and play with that one. 408 00:28:34,120 --> 00:28:43,020 Keep your master copy untouched and untarnished. And if you find that in your copy, if that 409 00:28:43,020 --> 00:28:47,560 association adds value, then go back to your master and run the same association. 410 00:28:47,880 --> 00:28:57,880 It will make trying to back out a lot easier. So, you don't need a degree in 411 00:28:57,880 --> 00:29:01,900 mathematics to understand graph theory. If you have one, granted, you will 412 00:29:01,900 --> 00:29:09,380 understand far more than me or, you know, the average person. But if you know the 413 00:29:09,380 --> 00:29:17,860 basics, it becomes so easy to use open source intelligence information without 414 00:29:17,880 --> 00:29:23,800 having to draw associations and make inferences based on that data to help with your 415 00:29:23,800 --> 00:29:29,160 investigations, to help with your recon, to help with anything you want to do with that data. 416 00:29:29,380 --> 00:29:35,720 And like I said, you can use a tool. If you're not a developer or not even like a, I'll say, 417 00:29:35,860 --> 00:29:43,600 like a punchy scripter like me, use a piece of paper. All of the graph theory I learned from Dia 418 00:29:43,600 --> 00:29:47,860 was him sitting with a notebook drawing things for me. We didn't even have to do that. We just 419 00:29:47,860 --> 00:29:51,300 didn't even touch a computer. He was like, okay, well, you know, we're going to draw, this is 420 00:29:51,300 --> 00:29:56,040 what a directed graph is. This is how you make these associations. And it was all in just a paper 421 00:29:56,040 --> 00:30:01,900 notebook. So, you don't need fancy tools to do this association. Granted, it makes it much 422 00:30:01,900 --> 00:30:06,460 easier to enrich the data instead of, like, writing out a hash on paper and then saying, oh, 423 00:30:06,480 --> 00:30:13,980 yeah, it's all these different associations. But you don't really need to. So, the connection of 424 00:30:13,980 --> 00:30:17,840 any related information will help you visually understand what you're doing. So, if you have a 425 00:30:17,840 --> 00:30:21,320 graph, you can easily represent the data. Some people are not visual people. I'm a visual 426 00:30:21,320 --> 00:30:27,560 learner. The application of graph theory to incident response and just investigations in 427 00:30:27,560 --> 00:30:33,780 general has greatly expedited my research when I'm conducting it. Because I see the associations. 428 00:30:34,080 --> 00:30:40,300 I see groupings of, like, data. And I can focus or completely take that information and just 429 00:30:40,820 --> 00:30:45,340 move it off to the side and not have to worry about it. Because it's not pertinent to my 430 00:30:45,340 --> 00:30:47,220 investigation at that point in time. 431 00:30:49,020 --> 00:30:54,880 And, like I showed you, there's a growing number of tools. You know, just in preparing this talk 432 00:30:54,880 --> 00:30:59,140 and giving this talk, there's probably been, like, five new really cool tools that popped up that 433 00:30:59,680 --> 00:31:06,020 apply to graph theory or help you apply graph theory as it relates to malware analysis or open 434 00:31:06,020 --> 00:31:12,340 source intelligence in general. Yeah. But, you know, don't feel as though you have to pick one 435 00:31:12,340 --> 00:31:17,280 particular tool because it's what everyone uses. So, if you don't like network X, if you're not a 436 00:31:17,280 --> 00:31:23,500 Python person, you're a JavaScript person, there are other tools you can use. If you don't want to 437 00:31:23,500 --> 00:31:30,820 have to use a graph database, then don't use a graph database. Work with flat data sets. Some of 438 00:31:30,820 --> 00:31:35,180 the best data scientists I've ever met hate databases. They would rather use just big, flat 439 00:31:35,180 --> 00:31:44,600 files and just aggregate. They would rather use bash to analyze their data and then create really 440 00:31:44,600 --> 00:31:47,260 intricate and ridiculously long data sets. So, you know, I'm not a Python person. I'm not a 441 00:31:47,280 --> 00:31:50,600 human. I don't like the fact that people use bash scripts to start mapping all their data to one 442 00:31:50,600 --> 00:31:56,900 another. So, pick what works for you. Whatever is going to help you get the job done. If you find 443 00:31:56,900 --> 00:32:03,160 that one piece of advice, if you're doing any sort of development and you're saying, you know, I'm 444 00:32:03,160 --> 00:32:07,660 spending an awful lot of time on this, maybe I should just do this by hand, the answer is almost 445 00:32:07,660 --> 00:32:13,960 always, no, you should not. Because you've already started down a particular track, and if 446 00:32:13,960 --> 00:32:17,260 you write a tool or write a script to help you do this, it's repeatable. So, if you have a dog, oh, 447 00:32:17,280 --> 00:32:20,740 and you can do it again in the future. And you can just modify 448 00:32:20,740 --> 00:32:23,540 that code. Or better yet, if you're a shitty programmer like 449 00:32:23,540 --> 00:32:28,200 me, put it up on Git and say, hey, intern, part of your job 450 00:32:28,200 --> 00:32:31,740 now is to fix this dumpster fire I have going on over here in my 451 00:32:31,740 --> 00:32:35,480 Git repo. And, yeah, it works out really well. I've had 452 00:32:35,480 --> 00:32:38,560 people compliment me on my code and my styling. It's like, oh, 453 00:32:38,580 --> 00:32:42,680 well, thanks. Yeah. That was a great intern that I hired to 454 00:32:42,680 --> 00:32:47,940 fix that. So with that, I think we're kind of back on track. I 455 00:32:47,940 --> 00:32:50,880 tried to go as fast as I could. May have been too fast. But if 456 00:32:50,880 --> 00:32:53,260 ever you want to contact me, please feel free to reach out, 457 00:32:53,400 --> 00:32:57,080 e-mail. You can try phoning. I probably won't pick up. But 458 00:32:57,920 --> 00:33:02,500 Twitter or e-mail, I answer those. So if anyone has any 459 00:33:02,500 --> 00:33:09,060 questions, because we have time. Hey. No questions. Oh, 460 00:33:09,080 --> 00:33:09,860 yes. Hi. 461 00:33:10,520 --> 00:33:12,380 More about the tools or the 462 00:33:12,380 --> 00:33:12,660 transactions. 463 00:33:23,180 --> 00:33:27,540 Yeah. I tend to, so just to reiterate, you know, what's my 464 00:33:27,540 --> 00:33:29,920 confidence in some of the transforms for the publicly 465 00:33:29,920 --> 00:33:35,640 available information? I use them all more as indicators or 466 00:33:35,640 --> 00:33:39,160 echoes that I need to follow up on. I'd never, I would never 467 00:33:39,160 --> 00:33:42,600 say they're the definitive truth. And I would say that 468 00:33:42,600 --> 00:33:45,360 all threat intelligence vendors and threat intelligence 469 00:33:45,360 --> 00:33:49,280 providers, because the data is only as good as what is coming 470 00:33:49,280 --> 00:33:56,520 in. So I take every association with a grain of salt. And to 471 00:33:56,520 --> 00:34:01,180 your point, like some of these crowd sourced group threat 472 00:34:01,180 --> 00:34:04,820 intelligence tools for IPs, it's like, oh, great, your honeypot 473 00:34:04,820 --> 00:34:09,580 found an MAP scan. That means that, you know, China's attacking 474 00:34:09,580 --> 00:34:12,120 today. So that's everyone's top priority. 475 00:34:13,460 --> 00:34:17,420 Thanks, honeypot. But, like, those crowd sourced intelligence can 476 00:34:17,420 --> 00:34:21,700 be easily gamed. And that's a whole other talk to, you know, tainting 477 00:34:21,700 --> 00:34:23,960 the, tainting the well of information. 478 00:34:26,560 --> 00:34:30,180 Yeah. Well, yeah, VirusTotal's a great example. If I was a malware 479 00:34:30,180 --> 00:34:33,780 author, I'd be uploading just garbage all the time just to hide my 480 00:34:33,780 --> 00:34:34,060 tracks. 481 00:34:38,120 --> 00:34:40,640 But, you know, I'm not, because I've already said I'm a shitty 482 00:34:40,640 --> 00:34:42,060 programmer. So it's not me. 483 00:34:43,220 --> 00:34:46,780 And I'm bad at math. So, you know, I'd get bored really quick. 484 00:34:48,120 --> 00:34:54,020 Any other questions? No? You can beat the lines. Run.