start	end	text
0	1440	All right, we're back.
1580	3800	And thank you, Alvaro, for supporting the community,
3800	7500	supporting DEF CON, for, of course, presenting here,
7500	9880	and definitely supporting the Red Team Village as well.
10820	13260	We're glad to have you here, and the floor is yours.
13260	14100	Take it away.
14480	15620	Thank you so much, Omar.
15620	17700	I'm so happy to be here another year
17700	19900	presenting the DEF CON Red Team Village.
19980	21560	Welcome to Total Eagresio,
21560	24760	Evading Intrusion Detection System for Stealthier Implants.
24780	27260	So, first of all, I would like to introduce myself.
27260	30140	My name is Alvaro Folgado, hashtag Rebuhacker,
30140	31780	and I was a product security engineer
32360	33700	where I perform a lot of software
33700	35560	and architecture security reviews.
35560	39060	I do a lot of offensive appsec, bug hunting,
39420	41820	a little bit of research about this last topic.
41820	43880	But in my free time, I have been spending
43880	45520	more or less the last two years
45520	49540	working on a main project that is an implant framework.
49760	51380	It's kind of divided in two parts.
51380	54140	The first part is the C2 operation manager,
54140	55220	that is grown on Golang.
55720	57520	Most of it, like, it used Terraform
57520	60660	to deploy, like, infrastructure, proxies, and redirectors.
60660	62760	And the other half is the modular Vegeto
62760	64840	that is grown on Go, C++, and OGTC
64840	66440	to perform a little bit more of, like,
66440	69080	native action over the target device.
69080	70980	I have the lag in the past, as I say,
70980	74200	to present this framework on the DEF CON Red Team Village
74200	76020	of the past year alongside Shellcon.
76020	78280	I am here again to speak a little bit
78280	79740	of this kind of same topic,
79740	82760	but connected to other stuff that I'm gonna develop.
82760	85040	So the connection here, it's, you know,
85040	88340	in the last year when I was presenting this framework,
88340	91280	one of the stuff that I was kind of most proud about
91280	94220	is, like, the ability of my implant of egressing,
94220	97120	not just using HTTPS against a custom server,
97120	98680	but using Gmail itself.
99040	101000	And I was saying in my talk, like, you know,
101000	103300	give me a string to egress and I should hack the planet
103300	104640	because, you know, you can use Gmail,
104640	106960	but you can use any other software service.
107240	108620	And from that talk,
108620	111100	I got an amazing amount of cool feedback.
111100	113280	But, you know, one of the most interesting one
113280	116400	was from one Blue Team engineer back then
116400	119300	that told me, you know, this looks cool,
119300	122000	but you know that by analyzing some header of your flow,
122000	123520	like the TLS fingerprints,
123520	126660	we could perfectly detect that that's a Go HTTP client.
126660	128320	And, you know, if we kind of,
128320	129840	while this is the kind of software we have
129840	131900	in the domain host of a corporate network,
131900	133280	that will look sketchy.
133280	136100	So I was like, okay, so you're telling me
136100	137340	I am egressing through Gmail,
137340	139860	but still not even by, you know,
139860	141060	doing a deep packet inspection,
141060	143640	we are able to detect I'm using some kind of malware.
143740	145820	So, you know, this really triggered my attention.
145820	148400	So I focused my next year research on them
149240	152260	towards like creating kind of an skeletal network model,
152260	153260	not just for my tool,
153260	155980	but also as a piece of code for every,
155980	159740	everything around the community to be able to use this
159740	163160	for bypassing this kind of filtering of this kind of rules
163160	164580	that the Blue Team could have
164580	166880	deployed in a corporate network.
166880	170620	So, you know, if we focus on this, you know,
170620	174400	on this field and we really want to like look stealthy
174400	175700	on the network level,
175700	178600	I wanted to start a little bit like a high level vision
178600	180680	of kind of the different techniques
180680	183260	that the Blue Team could deploy in a corporate network
183260	185840	towards detecting or running implant in a foothold
185840	188020	just by looking at the network package.
188020	191580	So I like to divide in kind of like two big parts, right?
191580	194480	We have all the deep packet inspection techniques
194480	198200	where, you know, somehow the Blue Team has deployed
198840	201440	the infrastructure to force every domain host
201440	203900	network package to go through a proxy, right?
203900	205660	And this proxy normally is a TLS proxy
206620	208640	that filter out all this flow
208640	211520	and make the target operating system
211520	213100	all up to accept the certificates.
213100	215740	So I can deep look at the body of the flow.
215740	217840	And then, you know, by looking at this body,
217840	220380	I can get kind of common strings that match to malware
220380	223780	and I can try to create a set of fine grained rules
223780	225980	to detect which one are the flows that match
225980	228580	most common like indicative of compromise
228580	230600	and most common like problems, right?
230820	233740	But I'm not gonna get still really deep
233740	234740	into these techniques.
234740	236000	I want to focus a little bit
236000	238560	in not deep packet inspection techniques, right?
238980	240760	That those techniques will be focused
240760	243100	not in what the body of the payload is,
243100	246980	but more in things like where the aggression is going, right?
246980	250220	Which is the server or foothold is connecting to.
250520	252260	So, you know, the Blue Team will start to look
252260	254720	at things like a sketchy IP range,
254720	258060	or if we are using some kind of service like Amazon or Azure,
258060	259800	they can start to look at the domain, right?
259800	261500	Which kind of domain we are using.
261540	263680	And if we use something like domain fronting,
263680	264660	they start to look at,
264660	266740	oh, which kind of operating system or software
266740	268880	is listening to the connection, right?
268880	273520	Which kind of certificate is this server like serving?
273520	275460	Is self-signed or not?
275700	278860	And then they will also could look at the wire itself,
278860	281220	you know, which kind of protocol we are using.
281220	286300	If there is a huge amount of package load on a DNS aggression,
286300	288600	you know, they could say, oh, something is going on here.
288640	292100	So, you know, if we come back to the concept
292100	295440	of aggressing to a software as a service, like email,
295440	297860	then we can finish with all the problems
298420	301920	of detection by the endpoint, almost all of them.
301920	304040	And we can do this easily because if it's a software
304040	307140	as a service, it has the opportunity to modify on a string,
307140	309760	we can make our foothold to communicate through the C2
309760	312060	just by pulling, pushing data on it.
312460	314160	And now it's where you come to the funny part,
314160	316840	like we have finished with the problem with the endpoint,
316840	318920	but still the blue team has powerful tools
318920	322100	to analyze which kind of HTTP client we're using.
322100	324580	And they can say, oh, this domain host
324580	325840	is using a common browser.
325840	328860	That looks good to me, but oh, this human resource laptop
328860	332300	is running a Python script to go to whatever server
332300	333440	or a Go client.
333440	335800	That kind of look a little bit more sketchy.
335800	337860	So at the end of the day,
337860	340680	the blue team has a powerful tool to analyze
340680	345140	before breaking the encryption through TLS fingerprints,
345140	349060	which kind of software the foothold is using for this,
349060	350460	which kind of software we are using,
350460	352340	or redirect, or proxy, or whatever,
352340	353800	to receive the connection.
353800	355660	And by matching both of them,
355660	358340	they could get a really strong indicator of compromise.
359140	361700	This will work similarly to like antivirus
361700	364080	or host intrusive detective system,
364080	366360	where they will extract a hash from the binary
366360	368240	and compare it with a public database.
368240	370780	Instead of now doing that with the binary,
370780	372820	they will do that with a TLS handshake,
372820	375280	and they will extract a certain number of bytes,
375280	377900	perform a hash, and compare it with a public database.
377900	379900	This is around a really interesting research
379900	383720	that was done time ago by a bunch of blue team engineers.
383920	385980	And alongside with this research,
385980	388600	they publish it with this GA3 tool.
388600	389960	This is a Python script.
390260	392400	I'm going to do a little bit of a deep dive,
392400	393120	what's going on.
393120	395320	So let's imagine we're writing our implant,
395320	398140	and now we need to think about how he's going to egress
398140	400300	or how he's going to connect to the C2, right?
400300	403140	So if we are going to use HTTPS,
403140	404540	and a lot of you will say,
404540	406480	okay, don't use HTTPS, use HTTP,
406480	408940	but for some reason we need to use HTTPS,
408940	411800	or endpoint for some reason uses HTTPS.
411800	413800	The first thing that our implant will perform
413800	415500	is opening a TCP socket.
415860	417820	And following that TCP socket,
417820	419740	the TLS handshake will start.
420140	423720	And that TLS handshake has a lot of information on it,
423720	426600	because first the client is going to tell to the server
426600	429060	which kind of TLS version we want to use,
429060	431120	which kind of C4CZ you want to use,
431120	434120	but particularly which kind of extension you want to use.
434120	435640	And a lot of these bytes,
435640	438380	they're really related to the kind of software we are using
438380	440920	or the kind of library we are using to write our implant.
441000	443600	In the same way, the server will do the same.
443700	447280	So the Python script will parse this pickup of,
447280	448840	you know, if we're using YSHA or any other software
448840	453300	to get them, and then we'll just select this package
453300	456940	and we'll analyze the bytes, transform them in MD5 hash
456940	459180	and match them to a really particular software.
459600	461460	If we're writing with our implant,
461460	463400	sometimes we rely on those libraries,
463400	465240	and other times we're going to use some software
465240	467080	that is already matched,
467080	468580	and it's already like,
468580	472480	give us a really particular alert to the blue timers.
472940	474240	So if you follow the source code,
474240	475460	you can go to the GF3 tool
475460	477800	and see exactly what he's doing when you provide
477800	479500	to the Python script a pickup.
479540	481800	But if we go to the YSHA,
481800	485000	and we start to listen to the flows,
485000	486120	and we just open a browser
486620	488660	that is performing HTTPS connection,
488660	490320	we can easily filter those package
490320	492180	and we can see what's going on.
492180	494560	We can go to the header of the SQL Socket layer
494560	497740	and we can see all these particular bytes that we have.
497800	501220	And while TLS version and CIFS are kind of easy to modify,
501220	503380	there is a bunch of extension that are assisted
504280	506760	by the RFC that can be configured.
506760	510880	So the Python script will just go over that set of package,
510880	513420	divide those bytes in five section,
513420	514940	transform them in hexadecimal,
514940	516960	and then generate this MD5 hash
516960	520600	that particularly match a certain version of a server
520600	522080	for the client and the server.
522220	524360	So, okay, where are the red timers?
524620	525780	We know this is a problem
525780	528840	and we know that we may be detected because of this.
528900	530720	So now it's where it becomes the idea
530720	532040	of blending in the network
532040	536460	and trying to like evading these techniques, right?
536460	538300	So I had a bunch of ideas.
538300	540200	My first idea was,
540200	542480	okay, I'm using a programming language.
542480	544000	This programming language gave me the option
544000	546300	to create my own HTTP client,
546300	547760	choose the library I want to.
547840	550080	But the problem is like most of the HTTP clients
550080	552100	that accept TLS configuration,
552100	554200	while they provide you a lot of bytes
554200	556740	for configuring your own TLS handshake,
556740	558580	they really don't provide you like an input
558580	560260	where you can put all the bytes you like
560260	561320	and the order you like.
561320	563280	So you can have the hash to decide
563280	566060	for copying another client software.
566320	568520	So this was kind of a tricky one.
568520	570720	So my next idea was, okay,
570720	573260	I will just open a TCP socket
573260	576520	and throw there my copy client hello package
576520	577460	and see what happened.
577460	579140	Obviously the TLS handshake breaks
579140	580780	and it's not interesting to us
580780	581840	because at the end of the day,
581840	583540	we need to use HTTPS.
583780	587120	So my last option were like getting a little bit
587120	589140	my hands dirty and go and modify
589680	592440	the source code of the programming language
592440	594400	I was using in this case was Golang.
594400	596380	So I will say, okay, I will add a feature
596900	599080	and this is more or less how it works.
599860	601980	So, you know, and I'm sort of similar
601980	603980	in other languages that relate
603980	605140	to which kind of language you're using
605140	606000	for writing your input,
606000	607600	but at least in Golang,
608040	609160	when you want to address,
609160	610780	you need to graph your HTTP client.
610820	611980	And when you graph the HTTP client
611980	613320	and you want to use HTTPS,
613320	614680	you provide the TLS configuration
614680	615860	that is like a struct.
617080	619140	Before requesting to the endpoint
619140	620240	with a post get,
620240	622220	whatever HTTP request you want to,
623760	625040	the language will go through
625040	628240	the flow of crafting this TLS hello.
628260	629900	And it will take kind of your configuration
630400	633020	and then grab up the bytes
633020	634780	and send them to perform the handshake.
634780	636140	The problem is, I was telling before,
636140	636940	we don't have a feature
636940	640080	where we can like put whatever bytes we want to.
640080	643520	So I modify the source code of Golang
643520	645280	and HTTP client to accept
645280	646740	in the TLS configuration,
646860	648080	a new string input.
648080	650520	And this string input will be exactly
651020	653520	what the GF3 tool provide to us.
653520	654400	So in that case,
654400	656260	we can use like GF3 tool
656260	659100	for copying a Chrome Firefox Opera browser
659100	662280	and throwing in the compilation of our implant.
662560	665300	In that way, when you go to TLS,
665300	666760	the TLS flow,
666760	668400	and you need to add another part of the code
668400	669880	where you are like marshalling
669880	671740	or creating this client hello,
671740	672700	I added a for loop
672700	675360	and for each hexadecimal value,
675360	677060	I kind of copy a reference,
677060	677860	which is the package
677860	680900	or the syntax that respect the RPC.
681020	681920	So if you have a bunch
681920	683800	of hexadecimal bytes in the right order,
683800	685060	you can extract the fingerprint
685060	687260	of the browser you are targeting.
687700	689420	It's true that a lot of them,
689420	690400	and I'm sure this extension
690400	692740	will be like modified with the time,
692740	694560	but I have enough right now,
694560	697060	entropy or availability
697060	699400	of like hexadecimal bytes already caught
699400	701380	for like accepting most of the browser.
701380	702240	If you feel that you need
702240	703360	more hexadecimal bytes,
703360	704520	I will add them.
704600	705300	There is no problem.
705300	706360	The source code is already published
706360	708260	in these links on GitHub.
708480	709100	So, okay.
709100	711500	Now we have the HTTPS client
711500	712780	that we need for copying
712780	714420	rightful connection of browsers
714420	716560	and any other like software you like,
716560	718580	antivirus, aggression, whatever.
718900	720160	But now it came the problem
720160	722440	that we want to address using Gmail.
736020	741120	That I need to change on the source code.
741480	743160	So that's it.
743160	746180	I want to like provide you a flow
746180	748000	of how this implant will work
748000	749000	on the background,
749000	751640	once we get the execution on the foothold.
751800	753380	So when we craft our implant,
753380	754780	the first thing we need to have
754780	756760	is the Gmail connected app.
756760	757580	We configure it
757580	758880	and we provide those credentials
758880	760200	to the C2.
760200	762040	And the C2 on the completion of the implant
762040	764140	will provide both the credential
764140	766820	to the digital alongside
766820	768200	with the TLS fingerprint.
768260	769660	And then the implant will start
769660	770460	with the aggression.
770460	771200	And for aggression,
771200	772040	the first thing he will do
772040	773560	is using the refresh token
773560	775920	against the Google authentication servers.
775920	778120	And then when he get the access token,
778120	779860	we will start to like push,
779860	781820	pull information through Gmail.
781820	783220	The C2 or the operation server
783220	784380	will do similarly.
784380	786540	And we could create a data connection
786540	788680	for sending or receiving commands perfectly
788680	791040	and totally transparent to the operator.
791260	792440	At the eyes of the blue team
792440	795000	that is looking to this proxy,
795000	797320	it will just look like a Chrome browser,
797320	798740	which is good to go.
800260	801780	So to speak a little bit
801780	802720	about DeepPacket inspection
802720	806240	or how we can bypass or avoid this stuff.
806240	807080	So, you know,
807080	808500	if we have the bad luck
808500	809840	that the sock or the scissor
809840	811340	is gripping common string
812260	814620	within or like flow against Gmail,
814620	816540	we could kind of use some kind
816540	817940	of later cryptography
817940	820100	and share a symmetric key with the C2
820100	821800	and then common grips
821800	823740	or common errors will not pop up.
823740	824820	If we have the bad luck
824820	825880	that it's a threat hunter
825880	827260	catching our flows,
827260	829700	we can also use other techniques
829700	831060	like stenography.
831060	832280	It wouldn't be as difficult
832280	833920	because also Gmail provides us
833920	835140	the ability to attach images
835140	836540	to the draft emails.
837220	839140	So a little bit
839140	840820	of how the network model
840820	842540	with the encryption will work
842540	844220	in Siesta time is using
844220	845420	the similar thing,
845420	846680	putting on the body of the draft
846680	847720	whatever JSON payload
847720	849400	we want to process by height.
849400	850720	But instead of just putting
850720	851760	playing the strings,
851760	852840	we can use like encrypting
852840	854240	with the symmetric key.
854560	855780	I have still not developed
855780	856920	this full model,
856920	857680	but it will be added
857680	859340	to Siesta time in the future.
860360	862160	So let's let's go ahead
862160	862920	with the demo.
862920	864540	So what I have created here
864540	865840	is trying to reproduce
865840	866760	this environment
866760	869160	where the blue team has deployed
869160	870100	this kind of detection
870100	871540	technique in a network.
871720	872580	I have created
872580	873600	two different implants.
873600	874680	This is the graphical interface
874680	875860	of Siesta time.
875860	877200	And alongside all the inputs
877200	878320	that I'm not going to speak
878320	879460	about each one of them,
879460	880780	particularly we see here
880780	882340	we have this TLS fingerprint
882340	884160	with an extra 4G S3 tool.
884160	884880	In that way,
884880	886420	we can create different implants
886420	886960	that mimic
886960	888760	whatever connection we want to.
889260	890720	If we focus a little bit
890720	893320	the network topology of the demo,
893320	894520	what this is going to look like
894520	896880	I am using a BIMI workstation
896880	898680	with three machines on it.
898680	899640	But particularly interesting
899640	900840	is we have the Windows 10
900840	902400	foothold that is going to run
902400	903320	two different implants
903320	904280	and every connection
904280	905240	that I get through email
905800	906620	is going to be read
906620	908060	by a Ubuntu server
908060	910900	that is a TLS proxy
910900	911760	with Polar Proxy,
911760	913200	which is not the most interesting.
913200	913840	The important thing
913840	915140	is running a Suricata
915760	917660	network interface detection system.
918120	919240	And you have a bunch of alerts
919240	920520	just to like detect
920520	922000	that if the TLS fingerprint
922000	923200	is not going to the client
923200	924320	to show me an alert,
924320	926040	if not, you can go ahead.
926080	928220	So let's go to the demo.
931280	932780	So as you can see here,
932780	933880	this is a graphical interface
933880	934660	of siesta time.
934660	935520	These are all the jobs
935520	937260	that the Hive has processed already.
937380	938920	And now we have two implants
938920	939980	that are created.
940400	941380	That means we can just
941380	942900	download the executable
942900	944600	and somehow we will make
944600	945580	the foothold to execute
946800	949160	through any attack vector we want to.
949420	951220	So this is the Ubuntu machine
951220	952020	that is listening
952020	952780	to all the connection
952780	954640	or the aggression of the foothold.
954640	956880	And we have the Suricata running on it.
957760	958840	Suricata will match
958840	960560	the two following rules.
960960	962220	These two rules,
962220	963340	they're using a GS3 plugin
963340	964160	for Suricata,
964160	966680	and they will get the header
966680	967620	of the TLS connection
967620	969340	of every aggression package.
969340	971480	They will generate an MD5 hash.
971480	973580	If that hash match this one,
973580	975180	we will pop up an alert.
975580	978080	We can check that these two hashes,
978080	980400	they match by the public database
980400	983220	of GS3, a Go HTTP client.
986490	987750	So let's search for the hash,
987750	989030	similarly to VirusTotal,
989030	990170	but with TLS fingerprints.
990170	992330	We see this is a Go HTTP client, right?
993290	995070	We are going to run the first implant
995070	996810	in the Windows 10 foothold
996810	998750	and we're going to be detected.
1001970	1004110	So the interesting thing
1004110	1005710	about these two is like,
1005710	1007310	obviously, this Go client
1007310	1007870	is going to be using
1007870	1009050	the default configuration,
1009050	1010510	but we can change things.
1010950	1012850	But the cool thing about this is like,
1012850	1013270	it doesn't matter
1013270	1014850	how many configuration is changed
1014850	1016750	by using a Go HTTP client.
1016750	1017770	By the end of the day,
1017770	1018830	all those hashes,
1018830	1019530	they will be registered
1019530	1020870	with this public database.
1020990	1022510	So we have two appearances
1022510	1023650	on the log of Suricata.
1023650	1024370	And the reason is
1024370	1026650	because I was saying before,
1026650	1028530	one request is for getting the access token
1028530	1030850	for the Google authorization servers.
1030850	1032650	And the second one is for pushing,
1032650	1035070	pulling data from Hive through Gmail.
1035770	1037390	So let's clean the logs.
1037410	1038690	And now we are going to do
1038690	1039750	exactly the same,
1039750	1041870	but using the implant
1041870	1042890	that has been created
1042890	1044070	with siesta time
1044070	1045750	and with the TLS fingerprint
1045750	1047350	of a Chrome browser.
1050250	1052590	So the creation of the implant
1052590	1053710	is just the same process,
1053710	1054510	which is going to change
1054510	1055690	with the execution of it
1055690	1057030	and how we detect it.
1057030	1058850	And the data flow is just the same.
1058850	1060550	So let's execute the implant
1060550	1062350	that now is copying
1062350	1064750	the fingerprint of a Chrome browser.
1065550	1067470	And let's go back to the Suricata.
1067490	1069190	And we see there is no any log,
1069190	1071870	but let's recheck what's going on.
1071870	1073450	So let's open a Wireshark
1073450	1075330	and start to detect
1075330	1076730	and read all the packets
1076730	1079650	that are going through the TLS proxy.
1080590	1082750	And the objective of this is,
1082750	1084470	since we maybe don't trust
1084470	1086190	what Suricata is saying to us, right?
1086190	1086850	Let's make sure
1086850	1088530	that this fingerprint is a Chrome browser
1088530	1090570	instead of a Go HTTP client.
1090570	1091730	So let's filter,
1091730	1093570	let's get all the main hello,
1093570	1096170	and then let's export it in a pickup.
1096770	1098230	And we can use this pickup
1098990	1101570	for like a GS3 to parse it
1101570	1102410	and tell to us
1102410	1104050	which fingerprints of bytes
1104050	1106650	is detecting from this aggression.
1108270	1110050	This way will be the same
1110050	1111170	that we need to follow
1111170	1112690	if we need to copy the TLS fingerprint
1112690	1114690	from any other rightful software.
1115310	1116870	So here you see there is like
1116870	1118730	this five section of bytes.
1118730	1119810	This one will be the input
1119810	1120690	for CSTATIME frame
1120690	1122470	we want to generate an implant
1122470	1123590	with these fingerprints.
1123590	1125430	And there is two different MD5 hashes
1125430	1128110	because as this is a TLS proxy,
1128110	1129250	there is a second fingerprint
1129250	1131170	for polar proxy itself.
1131190	1133770	But if we go and we take the fingerprint
1134130	1135150	of the implant,
1136310	1137630	we are going to see
1137630	1140110	that this is effectively
1140530	1141830	the public database GS3
1141830	1144010	is effectively pointing it
1144010	1144890	to a Chrome browser
1144890	1146630	instead of a Go HTTP client
1146630	1148030	or a Java client,
1148030	1148610	Python client,
1148610	1150550	whatever we have HTTP library
1150550	1152950	we have used for our implant to address.
1154290	1155570	So if we go back
1155570	1158690	to CSTATIME graphical interface,
1159250	1161730	we can see we already have the host infected.
1161830	1164210	We have killed one implant.
1164210	1164930	So that's offline,
1164930	1166470	but the other is still alive.
1166630	1167930	So now we can do things like,
1167930	1169330	you know, injecting a shell
1169330	1172810	or injecting a reverse SQL shell.
1172810	1174250	We have all the information
1174250	1176730	from the target host that we have infected.
1176770	1178250	And we also have like, you know,
1178250	1180250	an asynchronous interactive shell.
1180250	1181530	And all these will happen
1182250	1183710	totally transparent to the operator
1183710	1184770	and through email.
1184770	1186570	You see the fingerprints we need.
1188270	1188990	So,
1189930	1192170	I want to speak last but not least,
1192830	1194030	how to help defender,
1194030	1194810	how to make them better
1194810	1197150	because at the end of the day,
1197150	1198790	you know, the routing operation
1198790	1201190	is have a lot of reason,
1201190	1202870	but we want to make the defenders
1202870	1203930	to be better, right?
1203930	1205470	And to be prepared to this kind of attack.
1205470	1207130	So if I focus on the network
1207130	1208410	intrusive detecting techniques
1208410	1210470	and in the TLS,
1210470	1212210	a fingerprint detection,
1212210	1214430	if you ask me if there is gap of improvement,
1214430	1216050	I will say, yes.
1216790	1218370	There is for one reason
1218370	1220850	that the Python script of GS3,
1220850	1222030	it's, you know,
1222030	1224130	going through all these extensions by it.
1224130	1226090	So they will, the big entropy happens,
1226090	1227790	but it's just taking the headers.
1227790	1229190	You know, the Python screen,
1229190	1230470	we could write a new for loop
1230470	1232510	for like getting more byte inside
1232510	1234510	this like an onion layer, right?
1234510	1235950	And this is something that GS3
1235950	1237150	is not doing right now.
1237150	1239030	That we always generate more md5 hashes
1239030	1240030	and more different
1241470	1243150	entropy to search.
1243150	1243890	But that's it.
1243890	1244890	That's cool.
1245070	1249610	But this is the catch of the mouse.
1249610	1250370	If they do that,
1250370	1253350	I will use another for loop in my HTTPS client
1253350	1254770	and then we're in the same.
1254830	1255890	What I think is interesting
1255890	1259170	is not just using network intrusive detecting technique,
1259170	1260070	but, you know,
1260070	1262030	focusing on the host intrusive detecting techniques
1262030	1263430	or now called EDR
1263430	1265610	and trying to match kind of the two signatures
1265610	1267350	and see if something is going on.
1267350	1269290	I say this because while my VGTO
1269290	1270950	is regressing really efficiently,
1270950	1274090	this is still doing not so like a straightforward actions
1274090	1275730	in the operating system.
1275890	1277750	And, you know, this could be easily detected.
1277770	1278410	Like, you know,
1278410	1280850	when we can see md.x as a forward cell x
1280850	1283050	or for persisting use,
1283050	1285750	calling the APIs of a schedule that's on Windows.
1285910	1288670	This could be like a little bit more like a shiny
1288670	1290410	at the hour of detection.
1291870	1293250	So that's everything.
1293250	1294390	Thank you so much.
1294770	1297630	The source code is already published for everything.
1297630	1298790	And there is a user guide
1298790	1302190	for the CSTATIME framework as well.
1304030	1306810	I have the Discord and I can answer questions.
1306890	1308630	So just let me know.
1313260	1313880	Okay. Yeah.
1313880	1314760	The slides will be,
1314760	1315920	I will publish the slides.
1315920	1316580	Source code is there.
1316580	1317460	There is user guide.
1317460	1317940	Yeah.
1322560	1323480	So that's everything.
1323480	1324380	Thank you so much.