start	end	text
0	5040	We wish everyone a safe flight home and travels.
5600	6740	Ducks.
8140	16800	But, no seriously, we hope that we will be all together soon, next, hopefully next year.
18560	27780	Before we begin, we want to give a huge shout out and a big thank you to AWS, who is sponsoring this year's Packet Hacking Village.
28500	33040	Our talk is coming up next.
33260	38940	This next speaker here is a legend and needs no introduction.
39180	42320	He is a friend and a world-class trainer.
42320	49020	It is my pleasure to introduce to you John Hammond with Take Down the Internet with Scappy.
49020	50460	Take it away, John.
59430	64810	Alrighty, hello everyone. Welcome. Thank you for tuning in. I appreciate you being here.
64810	69890	This is a talk and presentation titled Take Down the Internet with Scappy.
69890	75570	I'm presenting this as part of DEF CON 28, or DEF CON Safe Mode, and I'm here at the Packet Hacking Village.
75570	80970	So let's dive into the presentation, but before we do, I've got to say this.
81070	86790	I've said it before, I'm about to say it now, and I'm certainly going to say it again many, many times throughout the presentation.
87110	89850	Thank you. Thank you for being here.
89850	96390	Honestly, seriously, I know things are a little crazy and weird and not how we're used to them being at DEF CON,
96390	100510	but thank you so, so much for being here. Thank you for tuning into this talk.
100510	102170	Thank you for being a part of all this.
102170	107910	I usually say this at the end, and I'm certainly going to, but now especially, I think it's really important.
108150	112030	Just thank you. Thanks for being here. I really, really appreciate it.
112030	116350	Okay, so the classic disclaimer, right?
116430	119250	The start of every talk, it's just how it's got to start.
119850	122850	These are my words, not my employer's.
122850	125410	I don't represent them. I'm not speaking for them, etc.
125410	129650	This is stuff that I wanted to bring to you, me personally.
130370	135890	Other disclaimer, don't or do try this at home, right?
135890	141670	Anything that we talk about, anything that I showcase here, obviously it's a talk titled, Take Down the Internet.
141670	149990	Don't actually do that, or maybe do it at maybe your own small-scale lab environment, etc.
149990	155510	You can tinker with it and explore with it, but don't actually take down the internet, right?
156210	157090	Cool.
157410	160070	Next, your mileage may vary.
160350	163610	I bring this up with everything that I kind of try and showcase.
163610	165670	Look, I'm talking about it. I'm showing it to you.
165670	167090	Maybe you'll have different results.
167090	171610	Maybe something will work differently or strangely in the way that you do it, if you do this sort of thing.
171670	177710	I can't promise, and I don't mean to make this any written-in-stone gospel or anything,
177710	184590	the stuff that comes out of this talk, it might be different for you and your mileage may vary.
184930	186270	Okay, last bit.
186550	188330	We're the good guys here, right?
188330	190890	We talk about security. We talk about cybersecurity.
191010	194270	We break things for the sake of making them better.
194330	196550	We hack for good.
196550	197930	And I want you to do the same.
197930	201430	The stuff that we're going to talk about and showcase in this presentation,
201430	204370	maybe it's a little bit on the different side of the fence.
204430	209590	I want to reiterate to you and kind of enforce it, hey, hack for good.
211830	214810	Okay, obligatory introduction, right?
214830	217090	Who is this guy talking at you?
217090	219370	Hello, my name is John Hammond.
219770	224050	I'll try and run through this quickly because I know no one cares, not even me.
224050	227790	I used to just do some stuff with the Department of Defense Cyber Crime Center
227790	229430	and their Cyber Training Academy.
229670	234930	And I also work with the Defense Threat Reduction Agency as kind of a red team cyber operator.
234930	238650	Right now, I'm working as a senior security researcher over at Huntress Labs.
238650	242150	Again, not speaking for them. These are my words, not theirs.
242150	246190	And in my free time, I like to play a little bit of capture the flag.
246190	250190	I like to develop and create and host capture the flag events or competitions
250190	253770	or exercises and training sets to try and make people better,
254050	257230	try and improve everyone's cyber security skill.
257470	261210	On that same coin, I do produce some cheesy YouTube videos.
261250	265830	I publish and showcase some capture the flag write-ups or programming tutorials,
265830	267630	video guides, stuff like that.
267630	270670	But that's all nerdy stuff that you don't really have to care about.
270670	274210	Let's talk about what we're going to talk about.
274270	275530	Kind of meta, right?
275530	279410	So here's the agenda, the roadmap, the outline for our discussion.
279510	281510	First, we'll lay the groundwork.
281510	283610	We'll put down a little bit of a background,
283610	285770	really set the scene for what we're going to be discussing.
285770	289010	I'm going to be talking a little bit about Python, right?
289050	290390	Python is kind of my weapon of choice,
290390	295150	but we need to make a distinction between Python 2 versus Python 3
295150	298910	and what we'll kind of be using as our vessel throughout this talk.
298910	300510	Then I'm going to introduce Scapey,
300510	303630	one really, really cool Python module or library
303630	306590	that you can pull into your Python source code,
306590	309090	use with your projects, your other scripts,
309090	311810	whatever you're working on to do really, really cool,
311810	314690	low-level stuff with network packets,
314690	317090	with the stuff that you would find in PCAPs,
317090	320170	if you would take a look at it in Wireshark or TCP dump, etc.
320170	323230	We're going to do that with Scapey inside of Python.
323230	324750	So we'll talk about how to install it,
324750	327750	some documentation, syntax and use cases, etc.
327950	331510	Then we'll get into the real meat of the conversation.
331510	333690	We'll talk about different attacks that we could perform
333690	336230	and we'll kind of zoom in or zoom out as appropriate
336230	337990	on some of these different things,
339090	341230	like fraud, DNS attacks, BGP, etc.
341710	344970	I do want to showcase a couple of IRL,
344970	346950	or in real life cases, right?
346950	351590	Stuff that we've really seen out in the real world that is real.
351890	355150	All about the stuff that we're kind of laying the foundation with here,
355150	358110	Python, Scapey, and these network attacks
358110	360770	when we're trying to take down the internet.
361290	364250	We'll also discuss some of the defense and mitigation,
364250	365810	some things that we could do,
365810	367570	some things that we might consider
368110	372350	when we take note of all these network attacks we're going to be looking at.
372350	374650	Finally, I'll showcase some of the resources and references
374650	377850	that I use to put together this conversation, this talk for you.
377850	380550	And we'll have the boilerplate template slides,
380550	381790	how you can contact me.
381790	384690	And of course, I will thank you again and again.
384690	387150	I'm really, really appreciative that you're here.
387810	388990	All right, let's get into it.
389130	392190	To get things rolling, let's lay the foundation.
392250	395130	We're going to be talking about packets, right?
395250	397070	We're here in the packet hacking village.
397570	399350	We're talking about network-oriented stuff.
399350	402470	So naturally, we're going to be talking about packets,
402470	404130	using Scapey, using Python.
404130	405650	And we'll dive into that more.
405650	409090	But I want to say, the title of this talk, right,
409090	411530	the whole theme, take down the internet,
412290	416790	that's going to be doing a lot of kind of jerk stuff.
416930	423510	It's about obnoxious, annoying, adversarial, and disruptive attacks.
423510	429510	So nothing like leet, super cool, zero days, crazy, like,
429510	431510	ninja warrior cyber hacker stuff,
431510	435470	but really just being mean and breaking stuff.
435470	437990	We're trying to recklessly break stuff.
437990	439410	I want to showcase some of this to you,
439410	443930	because really I want to show you just how easy it is.
443930	450530	And how Python, the same scripting language that's about on every Unix system,
450530	451850	can do this stuff.
451850	454870	And how you could do it, if you really wanted to,
454870	457450	but you shouldn't, you don't have to, right?
457450	464030	Take down the internet, obnoxious, annoying, adversarial, and disruptive attacks.
464630	465970	That's the background.
467810	470070	All right, now let's talk a little bit about Python.
470070	473910	I'm going to be using Python as the vessel for this talk, right?
473910	476290	We want to make this a little bit of a technical talk,
476290	478710	and showcase some code, showcase some real stuff,
478710	481250	rather than just pointing at numbers on a graph.
481850	485250	So, I want to lay the foundation again with Python.
485390	489230	Python is a wonderful hacker's language.
489230	492950	Yes, it's a scripting language, it's not compiled, it's read through an interpreter,
492950	496390	but it is easy to read, and easy to write.
496390	498730	That means that it's super duper friendly,
498730	502090	it's really easy to knock out quick testing scripts,
502090	504630	or to rapidly prototype some ideas.
504630	507850	It's just handy and useful, and has a lot of support
507850	511290	between all the different libraries, and modules, and packages
511290	515830	that you could pull into your code, and do some really, really neat stuff.
516430	518350	So, there's some conversations, right?
518350	522410	Because now we are in a new era, we are in 2020,
522410	526790	and Python 2, the older version of Python, is dead.
526790	529230	It's not on the table anymore.
529310	532130	Python 2 reached end of life at the start of this year,
532130	535470	and now Python 3 is the officially supported version.
535470	537630	Please don't hate me for screaming about that,
537630	540770	I just want to make sure, hey, everyone knows, we're using Python 3,
540770	542250	and you should be too.
542930	545770	And of course, Python is part of Linux.
545770	550790	It's typically shipped, and natively built into a lot of common Linux distributions.
551070	553670	And honestly, you should be using Linux.
553670	555270	I don't know why you wouldn't be.
555270	559090	And because it is part of Linux, it's really, really easy to access it,
559090	561830	just from the command line, you can simply type in Python,
561830	565790	and then you're inside of an interactive shell, or interpreter,
565790	567770	to work with the Python language.
567770	570790	I'm kind of being explicit here, I'm using Python 3,
570790	572650	with that suffix 3 at the end,
572650	575290	you probably will just be able to invoke it as regular Python,
575290	577790	and maybe that would spin up Python 3 for you,
577790	581890	but if it does fire up Python 2, hey, you should know better,
581890	584590	go fix that up, and hop over to Python 3,
584590	586890	now as the officially supported version.
586990	590330	Python, while we could be working inside of the language,
590330	592830	within the interpreter, or within that shell,
592830	595650	oftentimes you'll likely want to create a script,
595650	599030	or file with a .py extension, maybe a shebang line,
599030	601610	and you can invoke it and run it with Python,
601610	605630	just as an automated tool, not manually working through the interpreter,
605630	607730	or the interactive shell there.
607730	610150	In a lot of our conversations, what we'll be discussing,
610150	613670	I'm assuming you're going to end up using this inside of a script,
613670	618010	with a .py extension, and you don't need that interactive interpreter.
618010	622410	Okay, let's move on, because you probably all already know about Python,
622410	626070	and this is boring, so let's talk about Scapey.
626170	630970	Scapey is incredible, fantastic, phenomenal.
630970	634830	It is a module, it's a library, it's something you can just install,
634830	636790	pull into use with your Python code,
636790	642330	and it gives you the ability to craft network packets.
642330	646950	You can customize them, you can forge them, you can create them,
646950	649190	whatever you want, your wildest dreams,
649190	653430	whatever sort of network layers or protocols or things that you want to use,
653950	659950	you can get that fine-tuned, zoomed-in, microscopic customization
660650	664150	of what that packet looks like, and that's super-duper cool.
664150	666930	It's easy to install, I'm showcasing some commands here,
666930	670630	I'm assuming, okay, a Debian-based distribution, maybe Ubuntu,
670630	674390	you'll do a little sudo apt update, and you'll install pip,
674390	677830	if you're working with that little handy Python package manager,
677830	680730	and let's use pip install scapey.
681410	685090	Now, you can run Scapey in one of two ways,
685090	687830	very, very similar to what we talked about in Python, right?
687830	691830	Scapey could be interactive, and you could work inside of an interpreter
691830	696450	with a manual, like, typing in commands and getting that returned back to you,
696450	698510	like, interactive shell.
699130	703230	Or, you could work with it inside of a script,
703230	707150	and have Python just import Scapey as a whole module,
707150	710590	and you can access all of the code, the functions, the variables,
710590	715570	all of that functionality that Scapey offers inside of your Python scripts,
715570	716690	inside of Python.
716770	721670	Now, this is crazy cool, because we can work with TCP packets,
721670	726030	UDP packets, any other network stuff, maybe CAN bus protocols or Bluetooth,
726030	731670	there's so much more, and we could dive into some of the documentation for Scapey.
732710	735810	I always want to point people to the real documentation,
735810	737910	because that's where the real stuff is, right?
738190	740370	I'm not going to be the expert, sorry.
740430	742950	I don't think you would call yourself the expert,
742950	745070	and I'm not saying that to be mean, I'm just trying to say,
745750	749630	the source code is the truth, right?
750610	752690	Documentation is the real accurate stuff.
752690	754690	That's what's really there, really built in,
754690	758450	and the official source is what's good to go to when you need help
758450	759750	or you're trying to learn something new.
759750	761630	Obviously, there's a man page for the command,
761630	763070	if you wanted to fire that up.
763070	765290	Obviously, they've got an online web presence,
765290	767090	you can check them out at scapey.net,
767090	771170	and they have official documentation over at readthedocs.io,
771170	773910	and of course, a GitHub page,
773910	775390	so you can go take a look at the source code.
775390	778790	It's open source, it's awesome, it's all Python, good stuff.
778790	780610	The website is actually fantastic.
780610	783130	They have a page over there called Awesome Scapey,
783130	785490	and that will showcase other tools, exploits,
785490	788390	and some sample code to use, and it's really, really cool.
788390	790290	They have some good stuff on Wi-Fi,
790290	794430	like mapping and tracking Wi-Fi networks through 802.11,
794430	795930	making a rowing access point,
795930	797470	performing some man-in-the-middle attacks,
797470	800190	some TOR, Onion Router Protocol stuff,
800190	801850	tons and tons of great stuff,
801850	804090	even CVEs and exploits for common attacks,
804090	807370	or stuff from CRAC, the attack against WPA2.
807370	810310	Super duper cool, really recommend you go check that out.
811750	815090	Okay, now let's talk about the basic syntax of Scapey,
815090	817590	because if we want to use it, we have to know how to.
818670	821170	I say that Scapey is Pythonic,
821170	823030	in that the syntax that it uses,
823030	824650	when you're working with the module,
824650	828030	you're working with Python objects, right?
828030	830590	The same way most everything in Python really is,
830590	833890	is that you're interacting and working with an object
834330	836830	that has methods and properties
837190	839050	and all these attributes and things you could work with
839050	840630	that are really under the hood, right?
840630	843250	Functions and variables, just with kind of a different,
843250	844090	decorated name.
844090	846330	But being object-oriented means we can do
846330	848290	some kind of nifty things with it,
848290	849490	maybe not all the time,
849490	851990	I'm not trying to say OOP is the way,
851990	854170	but it's nice to have that
854170	856470	kind of built into the language when necessary.
856530	858150	So you can see I'm working
858150	860310	in like a little bit of a script here, right?
860310	862630	I've got a shebang line set up,
862630	865690	I'm going to work with Python 3 as my interpreter,
865690	866570	and I'm going to use that
866570	869790	from Scapey.all import everything,
869790	872210	or the asterisk, the star, the wildcard,
872210	875130	to pull in everything that that Scapey module has
875130	877170	into my current namespace.
877170	878330	So I can interact with it,
878330	880270	and I can work with it through Python.
880330	881710	So here I'm going to create an object,
881710	882670	or a little variable,
882670	885530	ping equals, and the IP,
885530	887090	this big class name, right,
887090	888390	you can see the capital letters there,
888390	891250	that's going to return a Scapey object.
891250	893070	And it's going to be a packet,
893070	895650	and I can define how that packet looks.
895650	897630	Maybe I don't want to use an IP,
897630	899370	or maybe it's that specific header
899370	900470	for that protocol.
900470	901910	I could zoom in on other things
905130	906530	other than Scapey or anything else.
906530	908710	And Scapey already has support
908710	910830	for all those crazy cool protocols
910830	911790	and layers,
911790	914130	and you could just pull them in and work with them.
914130	915770	Or, if you really wanted to,
915770	917790	you could go do a little deep dive,
917790	920110	get in the internals, and build your own.
920530	922250	So, note inside here,
922250	923770	I'm creating this IP object,
923770	926270	and I'm passing in a keyword argument.
926270	927590	I'm saying DST,
927590	930090	or the destination, the destination IP address.
930090	932310	I've simply set that to a string,
932310	934950	192.168.1.1
935130	938330	And I've had a little division symbol,
938330	939610	or that forward slash,
939610	940930	which looks weird, right?
940930	943410	Because we're not dividing these objects,
943410	945950	but I'm using that syntax,
945950	948250	and that is the syntax that Scapey uses
948250	950490	to actually add layers in
950490	951870	or kind of build them into
951870	954030	that packet that we're crafting.
954030	954990	So, I'm going to say,
954990	958170	this is simply going to be an ICMP packet,
958170	959810	or ping packet, right?
959810	962190	I've assigned that to that ping variable,
962190	963090	or the object,
963090	965490	and I'm just going to print that out on the screen.
965610	968010	If I were to run that script,
968010	969910	check out down below,
969910	971310	now I have that kind of B prefix
971930	973970	to note that this is a binary string,
973970	976430	or I'm just including real raw bytes here,
976430	977750	and that backslash X,
977750	979390	the backslash X everything,
979390	982830	all those are the bytes to this packet
982830	984690	that I've just formulated and created
984690	987010	in a super duper simple way, right?
987010	990290	It literally took one line of Python code,
990290	991750	and now I have a ping packet.
991750	992850	And I could do this,
992850	994610	I could send this packet,
994610	996650	I could receive the information that comes back,
996650	999290	maybe a little echo, a request, reply ping,
999290	1001530	that's very, very cool.
1001550	1002970	All in a script,
1002970	1005310	all automated and extensible,
1005310	1006990	whatever way that I want,
1007590	1009790	and super duper short, right?
1009790	1011890	One line of that Python code,
1011890	1014110	easy to read, easy to write.
1014470	1015590	Obviously,
1015590	1016870	Scapey is abundant,
1016870	1018710	and there are more examples
1018710	1020670	of this sort of thing on their website
1021750	1022830	and that's really, really why
1023410	1025090	I'm pointing you all towards it,
1025090	1026590	because that's where the good stuff is.
1026590	1028450	We're going to cover some cool stuff in the talk,
1028450	1030490	but if you want to go deeper,
1030490	1032150	learn more, do some more research,
1032150	1034270	I'd recommend, hey, go check out
1034270	1036230	that documentation.
1036810	1038770	Okay, last slide on Scapey,
1038770	1040630	I promise, then I'll shut up about it
1040630	1041650	and we can move on.
1041650	1044470	I'm not trying to sound like an evangelist here,
1044470	1045810	but I am trying to show you
1045810	1048670	all of the cool things that Scapey can do.
1048690	1050390	Obviously, in this last slide,
1051750	1053350	we have a super duper small,
1053350	1055330	minuscule example of one thing
1055330	1057070	that Scapey could do.
1057070	1059050	What we could do with that packet,
1059050	1061290	or with many other packets,
1061290	1064090	is put that together into a PCAP file,
1064090	1066630	write it out to a packet capture archive,
1066630	1069470	or we could read in a packet capture archive
1069470	1070730	or a PCAP file,
1070730	1072090	read through it, loop through it,
1072090	1073350	do interesting things with it,
1073350	1075090	or we could sniff and listen
1075090	1077790	and actually capture live packets
1077790	1080550	and dissect them or forge new ones, etc.
1081750	1083070	Import and exports,
1083070	1085950	create graphs, reports, tables, etc., etc.
1085950	1087150	And obviously,
1087150	1088990	all of those specific different protocols
1088990	1091350	that we would want to work with, we can.
1091870	1093490	And then, maybe we could turn it
1093490	1095690	into more of the offensive side.
1095690	1098230	We could probe or scan or attack networks,
1098230	1100470	fuzz specific aspects of a protocol,
1100470	1102550	or send malformed packets.
1102550	1104250	And we could do crazy tricks like,
1104250	1105470	okay, art poisoning,
1105470	1107630	or do some specific kinds of scans,
1107630	1109490	etc., etc.
1109490	1112610	The benefit behind all of this,
1112610	1115170	and this is what makes it so awesome,
1115170	1117310	is that it can all be automated
1117310	1118430	and you can write it
1118430	1120270	and you have that fine-tuned control
1120810	1122630	all within Python.
1122670	1124210	You have the entire arsenal
1124210	1125710	of the Python language
1125710	1128110	and libraries, modules,
1128110	1129490	other tools that you can use
1129490	1130850	and pull into it.
1130850	1132870	So, that's super-duper cool.
1134070	1136090	Now, let's get into the good stuff.
1136090	1137710	Let's get into the really cool attacks
1137710	1139190	that could potentially
1139670	1141450	take down the Internet.
1141650	1143430	So, we'll start small.
1143430	1144750	We'll start with some simple things
1144750	1146270	and then we'll slowly kind of zoom in
1146270	1148030	onto more complex stuff.
1148030	1150170	But just to kind of whet your appetite,
1150170	1152590	let's start with the ping of death.
1153470	1154690	Interesting name, right?
1154690	1156070	So, the ping of death attack
1156070	1157770	is a denial-of-service attack
1157770	1160170	where the attacker will
1160870	1162090	stop a machine
1162090	1165430	by sending a large ping packet.
1165430	1166770	So large, in fact,
1167710	1168570	that the machine can't handle it.
1168570	1169750	It'll choke.
1169790	1172070	There's so much data in that packet
1172070	1174310	that the machine doesn't know what to do with it
1174310	1175330	and it'll freeze up
1175330	1177610	or just fall over or crash.
1177670	1179530	We talked about ping packets
1179530	1180830	in the previous example
1180830	1182450	or that script and source code
1182450	1183390	that I showed you earlier
1183390	1186030	when we were looking at that ICMP protocol
1186030	1189050	or the Internet Control Message Protocol.
1189350	1190570	So, typically,
1190570	1192610	ping packets are very small.
1192610	1194730	But IPv4 ping packets
1197710	1199170	have a maximum allowable packet size
1199170	1202870	of 65,535 bytes.
1202870	1203970	Some systems
1203970	1206210	might not be designed to actually handle
1206530	1208410	packets larger than this maximum
1208410	1210290	and they might be vulnerable to packets
1210290	1211530	at that size
1211530	1213430	and they're sensitive to it.
1213430	1215870	They'll choke and they'll fall over.
1215890	1217630	When this large evil packet
1217630	1220190	is sent from the attacker to the victim,
1220190	1221550	the packet becomes fragmented
1221550	1223170	into different segments,
1223170	1224590	each of which will be smaller
1224590	1226550	than the maximum size limit.
1226910	1228390	When the target and victim
1228390	1230050	actually attempts to put these pieces
1230050	1231650	all back together,
1231650	1233430	eventually that total size
1233430	1235630	will exceed that maximum size limit
1235630	1238490	and maybe a buffer overflow occurs
1238490	1240070	or something goes wrong
1240070	1242330	and that machine can't handle it.
1242330	1243690	It'll freeze, it'll choke,
1243690	1244910	it'll crash.
1245750	1246930	So, we're using this example
1246930	1248530	where the ICMP echo
1248530	1249570	or that ping packet
1249570	1251010	could be used for this attack.
1254590	1256310	It can hold more data
1256310	1259490	or can have this attached information
1259490	1262050	that extends beyond that maximum size
1262050	1264310	could be used for this attack.
1264310	1266570	That could be TCP or UDP
1266570	1268690	or any IPX stuff.
1269110	1270950	Admittedly, the ping of death attack
1270950	1272070	is kind of old
1272070	1273510	and a little outdated,
1273510	1276290	but I think it works as a really cool
1276290	1278610	and simple quick jumping off point
1278610	1279970	or starting point for us
1279970	1281690	to take a look at some of these evil,
1281690	1283610	nefarious things that we could do
1284590	1285910	with Python and Scapey.
1285910	1286830	So, with that said,
1286830	1289330	let's take a look at the source code here.
1289510	1291590	You can see I'm using the send function
1291590	1293630	which is part of Scapey.
1293630	1295050	We say we've imported everything
1295050	1296430	into our namespace.
1296690	1298910	You could also send just one packet
1298910	1300370	and receive the information back
1300370	1302430	or send packets inside of a loop,
1302430	1304690	but for just one quick shot
1304690	1306250	firing the gun,
1306250	1308690	we can use this send function here.
1308710	1310070	We'll create a fragment
1310070	1311970	as kind of we discussed earlier.
1314590	1316210	It could be rebuilt and reassembled
1316210	1317390	by the victim machine
1317390	1319410	that could potentially cause it
1319410	1320890	to crash and choke.
1321510	1322390	And inside of that,
1322390	1324830	we'll build this ICMP packet
1324830	1326030	just as we've done before
1326030	1327430	in that previous example.
1327430	1329510	However, you can see there at the end
1329510	1330730	we use another divider
1330730	1332190	or add in another layer
1332190	1333130	or some more information
1333130	1334630	into this packet.
1334650	1337030	And I just use a simple dummy string.
1337030	1338130	I just use the letter X
1344590	1346270	and I've strapped to this ping packet
1346270	1348230	so that I can send a ping of death
1348230	1350190	that's just a little too big
1350190	1351390	and maybe that machine
1351390	1353610	is biting off more than it can chew.
1353630	1356530	It'll choke and it'll fall right over.
1356530	1358050	I did mention though
1358750	1360370	that this ping of death attack
1360370	1363210	is less common today.
1364310	1365530	More so now,
1365530	1367130	you'll see other kinds of attacks
1367130	1369970	that are still this denial of service attack.
1369970	1371410	We're being a jerk.
1371410	1373270	We're overwhelming, flooding
1374590	1376510	and it's bogging down the resources
1376510	1378590	on that victim or target.
1379250	1380450	So one of the more common ones
1380450	1381150	you'll see now
1381150	1385350	is perhaps an ICMP or a ping flood.
1385350	1386550	And we can certainly send
1386550	1388070	other kinds of floods.
1388070	1389730	One of the most common ones you might see
1389730	1391490	is a SYN flood.
1392110	1394410	SYN flood is another denial of service
1394410	1395330	or DOS attack
1395330	1397010	which will make that server,
1397010	1399930	your victim, unavailable to respond.
1400170	1401730	It'll be just too busy.
1401730	1402790	It'll be bogged down.
1402790	1403810	It'll be hosed
1403810	1406110	because something will be consuming
1406110	1409470	all of the available server resources.
1409710	1410690	We're going to cause that
1410690	1412730	by sending packets
1413650	1416650	with that SYN flag set.
1416650	1419030	So you know TCP packets, right?
1419310	1422130	TCP being the Transmission Control Protocol
1422590	1424970	which ensures there is a connection in place
1424970	1427910	by using the three-way handshake, right?
1428290	1430730	The client on one side of the conversation
1431730	1433150	will send to the server
1433850	1435850	a packet with the SYN flag set
1435850	1438040	to synchronize or start the conversation
1438310	1440810	and begin requesting communication.
1440810	1442910	The server over on the other end
1442910	1444390	of the conversation
1444390	1446550	will say and respond back
1446550	1448370	with a SYN ACK packet
1448370	1451290	or a packet sent with those flags set.
1451350	1453690	Finally, the client,
1453690	1455410	knowing that the server has responded,
1455410	1457570	that someone actually answered the phone,
1457570	1459750	it will respond once more
1459750	1461710	with an ACK flag set.
1461730	1463510	On a packet or the acknowledgement,
1463510	1465570	okay, someone is listening and we can talk.
1465570	1467150	We can have this conversation.
1467910	1469930	Interesting thing though,
1469930	1471870	on step two of that process
1471870	1475270	or in the middle of the three-way handshake communication,
1475270	1478610	the server, while it sends that SYN ACK packet,
1478610	1481690	it will wait and wait to receive
1481690	1483390	that ACK packet from the client
1483390	1486170	so that it can begin having this conversation.
1487850	1490750	So the attack is simple.
1490750	1493930	We just send a ton of SYN packets
1493930	1496250	where we're just starting all these conversations.
1496250	1497510	We're dialing the phone,
1497510	1500170	but once someone answers, we don't care.
1500170	1503050	We don't respond to them with an ACK packet.
1503050	1505310	So they're just, they're overwhelmed, right?
1505310	1506670	The phone keeps ringing.
1506670	1508010	Someone, they're going to pick it up
1508010	1509250	and they're going to want to talk to someone,
1509250	1510470	but no one will be there.
1510470	1512650	They're just not having this conversation,
1512650	1513870	but they're still holding the phone
1513870	1516070	and more are ringing.
1517010	1520070	That will hog all the resources.
1521210	1523330	That will cause that target victim
1524030	1527790	to not be able to respond to other legitimate traffic
1527790	1532290	because, okay, hey, they're busy, tied up with other stuff.
1532290	1535430	All those resources are being utilized right now.
1535890	1538750	Because this attack brings that server
1538750	1541890	to the halfway point in the three-way handshake, right?
1541890	1543430	They started the communication,
1543430	1546390	but have not responded to the server's acknowledgement.
1546670	1550170	That means that it's halfway communicated.
1550170	1553090	That's why it's called that half-open attack.
1553430	1554690	Kind of interesting.
1554970	1557150	So let's take a look at the source code, right?
1557150	1560170	Scapey, again, makes this super-duper easy.
1560250	1561950	We're performing this attack
1561950	1564710	in, realistically, two lines of code
1565210	1567070	that could even be shortened to one
1567070	1569050	because, hey, maybe we could abstract out
1569050	1571850	that object that's not necessary for that SYN flood.
1571850	1573810	We could just pass that to the function.
1573970	1577810	So I'm creating this SYN flood object, or variable, right?
1577810	1580750	I send in a keyword argument for the destination.
1580750	1582610	Again, just an IP address we'll use.
1582610	1584690	We'll set an ID number for that packet
1584690	1587010	and we'll specify the time to live.
1587010	1589050	These values aren't extremely important
1589050	1591130	for kind of just our discussion,
1591130	1594870	but obviously that next layer certainly is.
1594870	1597790	We create a TCP portion of this packet
1597790	1601830	and that SPORT, or S-port is how you should read that,
1601830	1603810	for our source port,
1603810	1607230	that's just going to be a random, ephemeral port
1607230	1608890	that Scapey will help us generate
1608890	1611410	with that RANDSHORT function there.
1611510	1614330	That'll return something to make it look like,
1614330	1616790	okay, we're coming from a different port every time.
1617130	1619310	The D-port, or the destination port,
1619310	1620770	will be passed in as a list,
1620770	1621890	or a little Python array.
1621890	1624450	We'll just send this over to port 80, HTTP.
1624510	1626770	You could specify this to whatever you wanted to,
1626770	1629410	maybe SSH or anything specifically.
1629710	1632010	Specify a sequence number,
1632010	1633630	specify an acknowledgement number.
1633630	1637490	Again, for this example, those don't really matter all that much,
1637490	1639650	but maybe they could in other scenarios.
1639650	1643210	A window size, and the most important thing here,
1643210	1647650	the flags that are set on this TCP packet.
1647690	1649450	Obviously, I'm just passing in a string here
1649450	1651230	with that capital S,
1651610	1655610	and certainly enough, that stands for SYN, right?
1655610	1659430	The SYN flag has been set on this packet.
1659430	1664810	So we have created one packet that is just a SYN packet.
1664810	1669310	The very, very first step in that TCP three-way handshake.
1669570	1671110	The next line below,
1671110	1673730	we're going to end up using that SR loop function
1673730	1675550	that Scapey makes available to us,
1675550	1679410	and that is going to send and receive packets in a loop.
1679410	1682070	So we will repeatedly, over and over and over again,
1682070	1683910	send this packet.
1684890	1688030	The keyword arguments there, that enter or the interval,
1688030	1690070	we'll send those at three-tenths of a second.
1690070	1692870	We'll retry every two seconds if that kind of gets dropped,
1692870	1695630	and we'll have a timeout of four seconds.
1695710	1698150	Again, those are a little extraneous,
1698150	1700530	but the point that we're getting across right now
1700530	1704050	is that we are looping a SYN packet being sent
1704050	1706110	over and over and over again.
1706110	1709270	We are flooding that target victim server
1709690	1711850	with this SYN flood attack.
1711850	1714170	In the case of the line of code there,
1714170	1716650	we have an answered and unanswered information
1716650	1719590	that's being stored as a return value of that SR loop.
1719590	1721290	That'll just return a tuple, okay,
1721290	1723990	or a list of what packets actually had a response
1723990	1725010	and what didn't.
1726210	1727930	The point that I'm trying to get across
1727930	1730730	is that just these two lines of code
1730730	1733050	are putting together this attack,
1733050	1735110	and it's super-duper simple.
1735110	1737390	All you've done is outlined the structure.
1737390	1739510	You've orchestrated this packet,
1739510	1740930	and now you can put it to work.
1741850	1743750	You can use it as a SYN flood.
1744590	1746750	You might notice, though,
1746750	1749930	in this example, with this setup right here,
1749930	1752090	we're sending this SYN flood attack
1752690	1755670	just with our attacker machine.
1755890	1757650	One machine.
1758130	1759910	So, potentially,
1759910	1761830	that endpoint or that target,
1761830	1763230	the victim server,
1763230	1766430	once it realizes, hey, I'm under attack, right?
1766430	1767810	I'm in danger.
1767810	1769630	If they kind of had the opportunity
1769630	1770650	to look through some logs
1770650	1772550	or could figure something out and determine,
1772550	1774810	oh, I know the source of this attack.
1774910	1776900	I can just block it off.
1777710	1779010	Well, you're totally right.
1779010	1780990	That's absolutely doable.
1780990	1782790	For that reason, this kind of thing
1782790	1786990	isn't often done just with one host.
1787310	1789770	Just with one attacking machine.
1789770	1791690	So you bring in the conversation,
1791690	1794710	okay, we're performing a denial-of-service attack,
1794770	1796900	a DOS attack or a DOS attack.
1797560	1801740	But if we had more machines in this pool,
1801740	1804100	if we were attacking with multiple hosts,
1804100	1807500	we could be performing a distributed denial-of-service attack
1807500	1810600	or that DDoS, D-D-O-S.
1810820	1814420	That might make it a little bit harder to do,
1814420	1816260	harder to track down, harder to trace.
1816260	1818380	However, we could do even more.
1818380	1819960	We could go one step beyond that
1819960	1823460	when we say our source IP address,
1823460	1826120	we don't want that to look like it's coming from us.
1826120	1827380	We want to hide it.
1827380	1830580	We want to mask it and obfuscate that just a little bit more.
1830760	1832900	But you can tell with Scapey,
1832900	1836620	we are crafting our packets at the granular level.
1836620	1840620	What's to stop us from specifying just that information,
1840620	1843700	just the bytes, the real, real information that we need
1843700	1846000	within that header of the packet?
1846080	1848860	We could say that our source IP address
1848860	1852480	comes from a different IP address,
1852480	1853640	comes from a different host.
1853640	1855520	We can spoof our IP address
1856120	1858020	simply by passing in the keyword argument.
1858020	1859660	Just as you see the example there,
1859660	1864720	we specify that DST keyword argument as an IP address string.
1864720	1870740	We could just as easily specify SRC or the source IP address
1870740	1874360	and make it look like we are coming from a different location.
1874360	1879340	We can spoof our IP address super easily with Scapey.
1879360	1882840	And we can use that as a segue into the next attack,
1882840	1885320	DNS amplification attacks.
1885320	1889360	A DNS amplification attack is a really interesting technique
1889360	1893360	that abuses the regular functionality of DNS,
1893360	1894880	or the domain name system,
1894880	1900540	to again overwhelm, spam, and flood a target or victim machine.
1900540	1902940	The way that this works is that the attacker
1902940	1906180	actually sends a legitimate regular request
1906180	1912260	to a DNS name server asking for as much information as they can.
1912260	1917020	So their request is a regular kind of small, tiny packet
1917020	1918560	just asking for information,
1918560	1920880	and the domain name server will respond
1920880	1923920	with as much information as possible,
1923920	1927760	and that way you get a much larger packet in response.
1927760	1932320	The trick here is that with this DNS amplification attack,
1932320	1936480	the attacker sets their IP address, the source,
1936480	1940080	back to the actual victim or the target server
1940080	1943360	that they're aiming to overwhelm and choke.
1943540	1946260	You can see this here in the source code, right?
1946260	1948960	We're defining, again, another object or variable
1948960	1950660	to keep track of our packet.
1950660	1954660	We're defining an IP header, but interestingly enough,
1954660	1957500	we supply that SRC, keyword value,
1957500	1959880	or the source IP address of the packet
1959880	1961880	that we're going to be formulating.
1962120	1964820	Note, this will act as our victim.
1964820	1969420	This is the target machine that will have the domain name,
1969420	1971640	and attack that large request.
1971640	1973920	You can see, again, our division symbol
1973920	1975940	or the forward slash to add new layers,
1975940	1979400	and we're adding a UDP packet portion, right?
1979400	1982400	We'll set the D port or the destination port to 53,
1982400	1985960	the default port for the domain name system or DNS servers,
1985960	1989040	and what we're going to query from this DNS
1989040	1991700	is anything we'd particularly like.
1991700	1995260	Here, I'll just ask for anything regarding google.com
1995260	1996580	or that domain.
1996580	1998820	You could, of course, ask for any type
1999420	2001060	of resource record you'd like,
2001060	2004260	an A record, a text record, a CNAME record.
2004480	2006240	Generally, with this attack,
2006240	2009760	you could expect to see the attacker request for any,
2009760	2014300	as in return all of the resource records you could give me.
2014300	2016400	We'll have that packet formulated,
2016400	2020380	stored, and encapsulated in that DNS AMP object and variable,
2020380	2023820	and again, we will just send that packet along.
2023980	2026660	The DNS server will respond accordingly.
2026660	2028720	It will give all the information it can,
2028720	2032120	but send it to that source IP address,
2032120	2034120	not our actual attacker.
2034120	2037480	That will flood and overwhelm, choke,
2037480	2039820	that target victim server.
2040140	2042820	Obviously, you'd want to have more than one attack
2042820	2045400	or one attacking machine doing this.
2045400	2048080	You could perform this distributed denial of service,
2048080	2052600	that DDoS, or send this request multiple times.
2052600	2054440	But I think this attack is really cool
2054440	2055760	and really interesting.
2055760	2059000	But if you put it in kind of layman's term
2059000	2061780	or normal human explanation,
2061780	2066540	say you are at the drive-thru ordering some fast food to go,
2066540	2067840	or whatever the case may be.
2067840	2070800	Let's say you ask the person or the teller
2070800	2073500	that's chatting with you and taking your order,
2073500	2077200	I want one burger, or I want one drink,
2077200	2078700	or whatever, whatever, whatever.
2079340	2081040	Typically, that job of the teller
2081040	2083660	will read back your order, right?
2083660	2086480	So, envision this scenario.
2086480	2088060	You as the driver, right?
2088060	2089860	You as the attacker, you say,
2089860	2092160	I want everything on the menu.
2092160	2095620	And then, before they can read your order back to you,
2095620	2097960	you drive away and let that next person
2097960	2100940	go ahead and actually hear all that information.
2101080	2103300	So, while you just ask for a small, tiny thing
2103300	2106220	and a simple, hey, give me everything you've got,
2106220	2108880	the next person or your target or your victim
2108880	2111100	is going to be read and enumerated
2111100	2113100	and receive all of the information.
2113660	2115520	So, maybe, I don't know,
2116700	2119020	a one scale for your packet
2119020	2122480	could respond to a 10 in the response
2122480	2124780	and what that teller will read out
2124780	2127420	to that other person or that individual.
2127440	2128740	Kind of cool.
2128860	2131480	And obviously, another added benefit to this
2131480	2135840	is that the attacker is performing this attack indirectly.
2135840	2137980	They make this request out to an open
2137980	2140180	and accessible DNS resolver,
2140180	2142560	and it will respond and just send that information
2142560	2146080	out to the actual target or victim themselves.
2146080	2148540	The attacker doesn't really leave any fingerprints
2148540	2151500	or trace on the target.
2151660	2153660	It's not reaching it directly.
2153660	2155600	It is an indirect attack.
2155600	2158080	You can see that here again with that syntax,
2158080	2160340	but as always, Scapey is making this
2160340	2163880	really, really simple and honestly, really easy.
2164760	2168680	Okay, now let's talk about our finale attack.
2168680	2171900	I want to discuss BGP abuse.
2171900	2176860	So BGP is the Border Gateway Protocol,
2176860	2179100	and that is the standard routing protocol
2179100	2181080	of the internet today.
2181660	2185300	That means that it's actually telling your computers
2185780	2187580	where these packets are going to go
2187580	2189400	when you're working on the internet
2189400	2192880	or at a large scale, the wide area network, right?
2192880	2195360	So routers using this BGP
2195360	2197100	or the Border Gateway Protocol
2197620	2200380	store a routing table with the best routes
2200380	2205020	in between autonomous systems or AS as an acronym.
2205020	2208940	These autonomous systems are large groups of networks
2208940	2211980	or just a giant large network itself
2211980	2215120	kind of owned and managed by a specific organization
2215120	2218240	or maybe an ISP, an internet service provider.
2218240	2222760	This is important because it's the backbone of the internet.
2222760	2224320	It's the freeway. It's the highway.
2224320	2226780	It's how our packets get from one place to another.
2226780	2229280	It's what makes that large scale growth
2229280	2231660	of the internet possible.
2231800	2235020	I mentioned this freeway and highway analogy, right?
2235020	2238580	And that's the easiest way to kind of envision this attack.
2239200	2244200	What if someone were to, without anyone else knowing,
2244200	2247420	change or modify the road signs or the exits
2247420	2250040	or the different locations on the map?
2250120	2252180	Obviously, this routing table
2252180	2254500	that these routers are using with BGP
2254500	2257800	has to be correct and accurate.
2257800	2260560	Otherwise, traffic, things might be directed
2260560	2264780	and routed to the wrong and incorrect place.
2264780	2269020	On top of that, BGP is working off of TCP,
2269020	2270700	that transmission control protocol
2270700	2274220	that relies on a persistent long-term connection
2274800	2278720	that could potentially offer an attacker a long window
2278720	2282180	or a decent amount of time to be able to tweak things
2282180	2284480	and get in the way and abuse it.
2284480	2287780	BGP was not designed with security in mind.
2287800	2290740	With that said, obviously,
2290740	2294400	there is a lot of room for potential abuse and danger.
2294400	2296920	There could be BGP hijacking,
2296920	2298960	another classic denial of service,
2298960	2300880	or some kind of interesting ones
2300880	2303480	where you can do blind BGP attacks
2303480	2305380	to disrupt sessions,
2305380	2308460	taking advantage of that TCP three-way handshake
2308460	2310060	or the communications and conversation
2310060	2312560	that has to happen within that protocol,
2312560	2315620	or even more dangerously,
2315620	2317980	inject routing misconfigurations
2317980	2320640	and change that highway sign,
2320640	2322540	change that exit so that traffic
2322540	2325940	is going to or through a bad place.
2326720	2328240	Okay, so let's zoom in
2328240	2330660	on one of the potential attacks we could use
2330660	2332540	trying to do some blind disruption
2332540	2334980	with these BGP routers.
2334980	2336960	What we're going to do is actually abuse
2336960	2339860	and take advantage of the regular TCP communication
2340320	2341860	and settings and functionality
2341860	2343900	that that protocol would require
2343900	2347260	to keep this BGP session alive.
2347260	2349100	All we were simply going to do
2349100	2354800	is send a packet with that RST or reset flag set.
2354820	2358020	Granted, the situation kind of means
2358020	2359940	our attacking host has to be
2359940	2361620	in the middle of a conversation
2361620	2363280	or listening or eavesdropping in
2363280	2366320	on the conversation between two of the routers
2366700	2368580	using BGP.
2368680	2370340	You can kind of note that here
2370340	2371640	in the comments of the code.
2371640	2373220	I'm specifying a D port
2373220	2375020	or destination port as a value
2375520	2377620	that would ideally match
2377620	2379420	the expected destination port
2379420	2382220	that's being used in an active BGP session
2382220	2384500	or conversation between these two routers.
2384500	2386840	The sequence number and the acknowledgement number
2387220	2389940	also have to match what that victim
2390340	2392060	would be expecting.
2392360	2394480	This is where we get into the conversation
2394480	2396560	of being blind.
2396560	2397980	We might not know that.
2397980	2399540	Maybe it could be fuzz.
2399540	2400980	Potentially you could just hammer this
2400980	2402680	until you get a hit.
2402680	2404700	But at the end of the day,
2404700	2406940	what we're doing is we're sending packets
2406940	2409040	in between these two routers.
2409040	2412340	So I have a source set to one router
2412340	2414060	that is going to act as the peer
2414060	2415660	or one in this conversation
2415660	2416600	and communication
2416600	2420140	and the destination as our victim router.
2420140	2422840	We're sending in that RST flag
2422840	2425580	or the reset signal and notification
2425580	2427340	part of this communication.
2427340	2429160	You can note that in the flags there.
2429160	2431540	Again, R to represent that RST
2431540	2432940	and A for ACK.
2432940	2434860	And of course passing in the appropriate
2434860	2436880	sequence number and acknowledgement number.
2436880	2438080	We send this packet
2438080	2441520	and that target or victim
2441520	2443120	will suddenly believe,
2443120	2447040	okay, this BGP session was just shut down.
2447080	2448200	They just hung up the phone
2448200	2450340	and we're not going to talk anymore.
2451080	2453360	Obviously, there's another router
2453360	2455720	at play, the peer router.
2455720	2458600	And this BGP protocol,
2458600	2459480	the way that it's working
2459480	2461280	is that it's sending any type
2461280	2463640	of four potential messages.
2463640	2465860	BGP could work with an open message
2465860	2467880	or a notification message
2468300	2470040	or a keep alive message
2470040	2471900	or an update message.
2471900	2474960	We'll tune into that update message soon.
2474960	2477140	But what's going to happen here
2477140	2478720	is that that peer router
2478720	2481000	will notice it's still trying to work
2481000	2482040	and have this conversation.
2482040	2484900	And yet the other router, our victim,
2485720	2487560	is down with that RST flag.
2487560	2488950	It's no longer talking.
2489440	2491140	Because of BGP,
2491140	2493600	there might be some keep alive messages
2493600	2494860	in the conversation
2494860	2496720	and that other victim router
2497610	2499880	will restore. It will recover.
2499880	2501540	This might take a minute,
2501540	2502640	but it'll happen.
2502640	2505020	So we could momentarily
2505590	2506970	disrupt the communication,
2507300	2510880	but maybe that will again be revived.
2510880	2512720	If you wanted to,
2512720	2513900	I don't know. Again,
2513900	2516280	we're working in blind territory.
2516280	2517960	You could potentially be hammering this
2517960	2519200	over and over and over again
2519200	2521780	and trying to keep shutting it down.
2521940	2524100	Maybe that could be a worthwhile attack
2524620	2526180	with BGP.
2528160	2530320	Let's take a look at another example
2530320	2532100	where we go a little bit more in depth
2532100	2534060	and this gets a little bit more complicated
2534060	2536580	because we're going to try and do a blind inject
2536580	2539960	or supplying fake, malicious,
2539960	2541520	bad routing information
2541520	2543100	or hijacking the routes
2543900	2546280	that the BGP protocol will use.
2546280	2547900	So again, we're working in the scenario
2547900	2549820	of an attacker machine
2549820	2551360	within the conversation
2551360	2553280	of two routers that are working
2553900	2555440	with this BGP protocol
2555440	2557700	and in the source code with Scapey,
2557700	2559120	you can see I've ran this
2559120	2560580	load contrib function
2560580	2562760	to load a contributed package
2562760	2564780	or a portion of Scapey
2564780	2566920	to actually access more of the BGP
2567820	2569600	functions and variables
2569600	2570960	and work that we could do
2570960	2573440	to actually modify BGP packets
2573900	2574500	within our code.
2574540	2576620	Again, my destination port
2576620	2578420	sequence number and acknowledgement number
2578420	2580000	might need to be tweaked or modified
2580000	2581680	to match this conversation
2581680	2583700	and they potentially could be
2583700	2585280	perhaps fuzzed,
2585280	2586620	but what we'll be doing
2586620	2590180	is we'll be defining a whole new BGP packet.
2590180	2591620	We'll set up an origin,
2591620	2593540	we'll set up a note for our AS
2593540	2594860	or autonomous system
2594860	2597240	and specify the next individual
2597240	2598940	or that router IP address
2598940	2600500	that we'll be sending this to
2603900	2605660	the most interesting thing here
2605660	2607760	is that path update variable
2607760	2608960	down at the bottom.
2608960	2611580	We're going to be specifying a new malicious route
2611580	2614180	5.5.5.0
2614180	2615300	slash 24
2615300	2617080	which you can kind of decipher
2617080	2619040	from that syntax there.
2619040	2621260	Then we'll go ahead and send this packet
2621260	2623220	with that path update.
2623500	2624440	Now this is interesting
2624440	2626820	because it could realistically result
2626820	2629500	in one of three different things.
2629500	2630720	The first case,
2630720	2632780	if all the stars aligned,
2633900	2634120	we have the source number
2634120	2636820	and acknowledgement numbers right in the session.
2636820	2638880	And if we were within the correct window
2638880	2640280	of that conversation,
2640280	2643020	our malicious route could be inserted
2643020	2645120	and injected into the routing table
2645120	2646880	and traffic could potentially
2646880	2648740	flow through that.
2648740	2650680	We may have very well changed
2650680	2651760	the highway signs
2651760	2654020	and we're directing packets and communication
2654020	2655880	now going to or through
2656300	2657920	a different place.
2658400	2660520	In the other case,
2660520	2662820	I guess I'll call this case number three,
2663900	2664720	we fail.
2664720	2666020	It doesn't work.
2666040	2667380	Maybe our timing was off,
2667380	2668940	maybe the variables at play
2668940	2670920	just weren't matching in the conversation
2670920	2673120	and that didn't take.
2673200	2674400	Kind of a bummer,
2674400	2675660	but we know, okay,
2675660	2676740	that might be natural
2676740	2678740	with our blind attack here.
2678840	2681020	And what I'll call case number two
2681020	2682960	or kind of the other scenario
2682960	2684040	we can keep in mind
2684040	2687360	is we're showcasing conversation
2687360	2690620	between two BGP routers right now.
2693900	2694580	We have a BGP router in place
2694580	2697240	that is not part of this conversation
2697460	2699260	or not pertinent to this attack
2699260	2701200	happening between our source
2701200	2702540	and destination.
2702540	2704100	You can mentally map that
2704100	2706100	to a client and server, I suppose.
2706100	2708900	Maybe an external or third party router
2708900	2710440	still present,
2710440	2712100	working with all these routes.
2712340	2714300	If our victim,
2714300	2716500	if our target upon success
2716500	2718240	of getting this injected
2718240	2720940	new malicious routing information,
2720940	2723700	that will try and propagate it out.
2723900	2727020	Maybe that other third party router,
2727020	2729060	it will receive that new information
2729060	2730280	to take in this route.
2730280	2732540	It could potentially, again,
2732540	2733860	just not being in sync
2733860	2735400	within the conversation.
2735400	2737220	The receiving number
2737220	2739820	might not match the kind of victim
2739820	2741140	and target sending number
2741460	2743640	in the sequence and conversation.
2743640	2744840	And that third party router
2744840	2747340	will identify the mismatch
2747820	2749520	and it will try and acknowledge
2749520	2751120	and send responses like,
2751120	2752920	hey, I can't compute this.
2753900	2754740	I might send an acknowledge
2754740	2757120	or a notification this is wrong.
2757120	2758700	That other router is still trying
2758700	2760120	to send over this update,
2760120	2761020	but it's still receiving
2761020	2762300	and now it's going to send
2762300	2764360	its own ACK and acknowledgement.
2764360	2765860	And those two will get in a little bit
2765860	2767480	of an ACK war.
2767480	2768660	They'll be repeatedly sending
2768660	2770060	acknowledgements to one another.
2770060	2771500	And this will happen at least
2771500	2773020	until a timeout occurs
2773020	2776600	and the session will be disrupted.
2776680	2778500	It'll just shut down and stop.
2783900	2784880	And eventually a keep alive
2784880	2787140	will be in the midst of the conversation
2787140	2788940	and it will restore.
2789320	2792500	That might not be a minute in length
2792500	2794260	as opposed to our previous example
2794260	2796920	with that RST or reset flag being set.
2796920	2798360	But this could take maybe four
2798360	2800000	or five minutes for that session
2800000	2801080	to come back to life
2801080	2804360	after they've realized this mismatch.
2804360	2806000	So maybe that could be
2806280	2807500	a bit more of a dangerous
2807500	2809540	or maybe worthwhile
2809540	2810660	depending on your avenue
2810660	2812260	or your outlook here
2812260	2814980	for this attack.
2815760	2817900	So we've talked about a few attacks.
2817900	2819580	I hope some of those were kind of cool
2819580	2820440	and kind of interesting
2820440	2824300	in the conversation to take down the internet.
2824300	2827380	I wanted to showcase some IRL cases
2827380	2828420	or some real stuff
2828420	2831240	where these sort of things actually happened.
2831240	2832760	Maybe not an attack
2832760	2834400	but at least a mishap
2834400	2836360	that showcases some of the weakness
2836360	2837760	between these protocols.
2837760	2838940	Especially BGP
2839800	2841880	or that Border Gateway Protocol.
2841880	2844980	This was June 24th of 2019.
2844980	2846880	Some of you might remember this.
2846880	2848780	It seemed like all of the internet
2848780	2849940	was being funneled through
2849940	2852620	some small shop in like Pennsylvania
2852620	2853720	or something.
2853720	2856200	This is over on CloudFlare's blog
2856200	2858060	if you're interested and you might have seen
2858060	2859860	I've already referenced some CloudFlare stuff
2859860	2861560	as we've gone through the talk.
2861560	2863240	This dives into a little bit more
2863240	2865880	of the BGP optimizer that was in use
2865880	2867520	and that would kind of split
2867520	2869800	or segment different routes
2869800	2872760	or giant networks into smaller pieces.
2872760	2874500	And it seemed that there was a little bit
2874500	2876060	of a leak from Verizon
2876060	2878160	where some of the BGP output
2878160	2880080	was being pushed and propagated
2880080	2882980	and updated again through to DQE
2882980	2884620	and CloudFlare, etc.
2884620	2886220	And that would take down
2886560	2887260	a decent amount of stuff
2887260	2890100	even between Amazon, Linode, and more.
2890100	2893020	It was crazy to see that this was worldwide
2893020	2894860	and CloudFlare I think at the point
2894860	2897300	lost about 15% of traffic.
2897300	2898480	And I think it goes to show
2898480	2901020	just how much trust is really being placed
2901020	2903920	into that BGP or Border Gateway protocol
2903920	2907120	because absolutely these routing tables
2907120	2909460	need to be accurate to ensure that
2909460	2910820	okay, all of the traffic
2910820	2912300	and communications and conversation
2912300	2913600	flowing through these packets
2913600	2914860	is going to the right place
2914860	2917520	so that that infrastructure can handle
2917520	2919780	that load and that amount of traffic.
2919780	2923300	If more than a few fragments
2923300	2924260	and portions of the internet
2924260	2926620	are all funneled through one specific spot
2927180	2929060	that could be potentially bad
2929060	2932120	and take down the internet.
2932820	2935160	This other case is even more recent
2935160	2937100	over on July 17th of this year
2937100	2938540	just a month back.
2938600	2941340	Again, a BGP leak.
2941340	2942440	CloudFlare is reporting on.
2942440	2944040	You can check out their blog.
2944240	2947620	Once again, BGP having an incorrect route
2947620	2949640	that was being propagated and bleeding out
2949640	2951440	and doing damage
2952620	2954880	potentially taking down the internet.
2955120	2957120	I think this blog post is really cool
2957120	2958600	because it showcases a little bit more
2958600	2960540	of the router syntax and talks about
2960540	2963100	the timeline of kind of where things went wrong.
2963300	2965220	CloudFlare actually does put a disclaimer
2965220	2967500	and hey, we just want to enforce
2967500	2971180	this is not the result of an attack.
2971180	2972760	And I want to preface that as well
2972760	2975300	because sure, we've just spent a lot of this talk
2975300	2977480	discussing some of the potential attacks
2977480	2978580	and things we might be doing
2978580	2980780	especially muddling with BGP
2981440	2983140	but this was just again the case
2983140	2984920	of something potentially going wrong
2984920	2988500	with a misconfiguration in those routing tables.
2988500	2990100	So again, just the reliance
2990100	2992140	on how that protocol works
2992140	2995640	and how much faith we end up putting in it.
2995740	2998240	Okay, let's briefly discuss
2998240	3000460	some defense and mitigations
3000460	3002560	at least in regard to some of the attacks
3002560	3004220	and some of the stuff that we've covered.
3004220	3005920	I will breeze through this a little bit
3005920	3007160	or at least kind of go surface level
3007160	3010100	because I'm cognizant we are low on time.
3010100	3012440	But how could we try to prevent
3012440	3014380	some of this stuff?
3014380	3015660	We talked about the ping of death
3015660	3019660	and I mentioned that is generally protected today.
3019660	3021560	Kind of a lot of modern systems and technologies
3021980	3024680	will know how to behave and handle
3024680	3027520	that large ping and packet size.
3028000	3029820	That could really potentially be done
3029820	3031360	just adding a check.
3031360	3033080	Make sure, hey, are we not exceeding
3033080	3035300	that maximum packet size?
3035960	3037340	Another option with that
3037340	3039360	is actually kind of allocating a memory buffer
3040100	3041860	to be able to handle that packet size.
3041860	3043760	I feel like that, I don't know,
3043760	3046640	might not have the real intended effect
3046640	3047420	that we want.
3047420	3049000	I think the protections that we have
3049000	3050860	to just verify and check,
3050860	3052840	hey, are we dealing with an overblown,
3052840	3053840	oversized packet?
3053840	3055520	That makes the most sense.
3056240	3058920	The SYN flood and other flooding attacks,
3058920	3060360	especially with SYN flood,
3060360	3063100	you could be using some server SYN cookies
3063100	3065020	where the server will actually kind of specify
3065300	3066980	a nice token or something specific
3066980	3068600	to that communication.
3068600	3070260	And that would obviously need to be returned
3070260	3073020	and responded back with a response.
3073020	3074640	Or maybe you could recycle
3074640	3078220	the older previous half-open TCP connections
3078220	3079580	that were started.
3079580	3081160	If you realize, okay,
3081160	3082700	this machine is getting overblown
3082700	3085480	with open or half-open connections,
3085480	3087220	we'll roll back to one of the ones
3087220	3088100	that we've got started
3088100	3091000	and just work with that as necessary.
3091000	3093740	For DNS amplification attacks,
3093740	3096960	this one is almost,
3096960	3099900	it seems just natural, right?
3100300	3101920	If the flaw here
3101920	3103400	is that we can just abuse
3103400	3105480	and reach out to the natural behavior
3105480	3108000	of DNS or the domain name systems
3108000	3109500	and those open name servers
3109500	3111960	and resolving servers,
3111960	3113420	limit that number.
3113480	3115160	Maybe we could scope and turn down
3115160	3116220	the stuff that is accessible
3116960	3119060	within your network or a network
3119060	3120300	or what is applicable.
3120300	3122460	Another technique is actually verifying,
3122460	3124840	okay, who is requesting this information?
3124840	3127100	If you check that source IP address,
3127100	3128520	does it come from someone
3128520	3129720	that really should be able
3129720	3131860	to access that and reach that?
3131860	3135120	We have the conversation of DNSSEC, right?
3135120	3137160	But the gimmick
3137160	3139200	with that DNS amplification attack
3139200	3141140	is that it's just the natural
3141140	3143460	functionality of DNS.
3143460	3144800	If someone is asking
3144800	3146680	for all of the resource records
3146680	3149680	you can get by simply requesting any,
3149680	3151300	it's going to give that information
3151300	3152340	back out to you.
3152340	3153760	Just that example that we discussed
3153760	3155340	at the drive-through,
3155340	3157100	you say, hey, I want to know everything
3157100	3158980	on the menu, they have to give you
3158980	3160600	that information because that's
3160600	3163600	just how DNS has to work.
3165340	3166340	BGP.
3166500	3167960	Oh, man.
3168460	3169760	BGP abuse protection
3169760	3171860	is kind of tough, right?
3171860	3173660	Just because, again,
3173660	3176440	this is how it has to work.
3176460	3178400	Knowing that we are assigning
3178400	3180340	the routes and locations
3180340	3183140	and maps for ways
3183140	3184760	to get to places on the internet,
3184760	3186920	that has to be
3186920	3187820	just secure.
3187820	3189940	Unless anyone is monitoring that
3189940	3192080	and knowing when those changes
3192080	3194580	are being put in place,
3194580	3196420	it's hard to
3196420	3197880	lock that down.
3197880	3199920	And BGP itself was not designed
3199920	3201180	with that security in mind.
3201180	3202480	It's working off of TCP
3202480	3204280	as it needs to.
3204280	3205500	Maybe there'll be more developments
3205500	3207220	with BGPSEC, which I believe
3207220	3208200	there are some conversations
3208200	3209460	and research kind of being started
3209460	3211080	in that direction.
3211080	3213560	But anyone that declares
3213560	3215900	changes to routes
3215900	3218140	should be kind of a valid,
3218140	3219960	authoritative, and trusted source,
3219960	3222300	not just a thing that could happen.
3222300	3224080	And when that change
3224080	3225640	does happen,
3225640	3226860	that needs to be monitored
3226860	3228880	and maybe notifications and set
3228880	3231320	aware for individuals to
3231320	3232960	track that.
3232960	3235060	If you are struck by
3237220	3239480	random to whatever BGP attack,
3239480	3241440	you will know it, right?
3241440	3242560	Obviously, okay,
3242560	3244040	signs of increased latency,
3244040	3245240	your network's moving slow,
3245240	3246620	degraded network performance,
3246620	3248760	and just misdirected traffic.
3248800	3251840	That should be a big indicator,
3251840	3253400	an alarm going off in your head.
3253400	3254600	Maybe something's wrong.
3254600	3256820	Potentially, BGP hijack.
3256820	3259940	The internet has been muffed up.
3259940	3261920	All these things we can take
3261920	3263540	into consideration, right?
3263540	3264800	Defense and mitigations,
3267220	3268240	things that we can discuss
3268240	3270900	and talk about and know,
3270900	3272740	just so when we're looking
3272740	3274140	at these attacks and we're kind
3274140	3275340	of taking a look at all these
3275920	3277680	jerk, I don't know,
3277680	3280280	techniques to disrupt,
3280280	3282960	abuse, really annoying,
3282960	3284380	obnoxious denial of service
3284380	3286140	attacks and stuff that is
3286140	3287460	prevalent on the internet.
3287460	3288560	Maybe we can be a little bit
3288560	3289940	more knowledge about it and we
3289940	3292700	won't take down the internet.
3294080	3296380	Okay, this is just a data dump
3297220	3298540	of sources and references that
3298540	3299760	I had kind of used to help put
3299760	3301380	this together. You could
3301380	3302720	hopefully be able to sort through
3302720	3304020	this by kind of the topic or
3304020	3305320	discussion that I've showcased.
3305320	3306580	I didn't include too much stuff
3306580	3307960	in here for Python and Scapey
3307960	3310420	because the documentation and
3310420	3311800	the websites for that you can
3311800	3313700	certainly very easily find online.
3313700	3315260	But some of the specific things,
3315260	3316480	some of the research papers,
3316480	3317420	there's a lot of really cool
3317420	3319700	stuff in here. Cloudflare, of
3327220	3328040	course, has really cool open
3328040	3329480	source tools and utilities that
3329480	3331060	showcase this or even how to
3331060	3332700	defend against it with IP tables
3332700	3333860	or other things that are
3333860	3335320	applicable. There are some
3335320	3336260	really, really cool stuff in
3336260	3337900	here. The Naval Postgraduate
3337900	3339360	School had a research paper out
3339360	3341200	I think back in 2017 that
3341200	3343600	discussed these BGP blind
3343600	3345400	attacks. There's some University
3345400	3346520	of California stuff out there
3346520	3348100	and there's even a black hat
3348100	3349820	presentation that discusses this
3357220	3358720	and more worthwhile stuff over
3358720	3360260	there. And if you're interested,
3360260	3363220	I do, do recommend you do some
3363220	3364640	of that research. Check out
3364640	3365580	some of these references and
3365580	3366700	resources. I hope they are
3366700	3370000	helpful to you. Okay, I'm going
3370000	3371980	to wrap it up. If you have any
3371980	3373220	questions or comments or
3373220	3374900	feedback, I'd love to hear from
3374900	3376960	you. Obviously, I'm putting this
3376960	3379700	out here for you. I'm happy to
3379700	3380720	be part of the community and
3380720	3382060	jamming and meeting everyone and
3382060	3383300	seeing everyone here at DEF CON.
3387220	3388220	If you want to hang out, just
3388220	3390140	want to discuss, please do reach
3390140	3391240	out. You've got my email
3391240	3392520	address, my silly YouTube
3392520	3393780	channel. If you want to see
3393780	3394680	any of my code, that's on
3394680	3396080	GitHub and of course Twitter.
3396080	3396900	And if you want to do some
3396900	3398480	real-time instant messaging,
3398480	3400520	that's my Discord server there.
3400880	3403840	Okay. Holy cow. Thank you so,
3403840	3405920	so much, everybody. I cannot say
3405920	3407620	it enough as I did the beginning
3407620	3408640	of this talk, as I did
3408640	3409720	hopefully through it a little
3409720	3411560	bit. Thank you. Thank you.
3411560	3413060	Thank you. This has been a
3413060	3414160	blast. I hope you enjoy the
3414160	3415520	talk and presentation. I hope
3415520	3417840	you enjoy DEF CON Safe Mode
3417840	3419440	and please stay safe and enjoy
3419440	3421240	yourself. Take care, everybody.
3421240	3421740	Thank you.