1
00:00:00,000 --> 00:00:07,740
our next speaker, they say you can't cheat time, but he can find foes in yourself with

2
00:00:07,740 --> 00:00:17,160
latency tri-territorialization. Our next speaker, let's give her a round of applause. Thank you.

3
00:00:30,000 --> 00:00:59,500
Hello, Maze. Thank you for being here and joining me in this talk. My first talk I said about geolocation. You can cheat time is a quote from Dr. Roo, as you can see from the TARDIS next to it. And I'm Lorenzo. Call me Lopoc if you want. And you can find me on Twitter. You can find my code, the code I'm releasing today on my GitHub. And let's talk about geolocation. Geolocation is something that has always been a

4
00:01:00,480 --> 00:01:29,980
important for humans and has always been a power driver for progress and technical things like sextant, mechanical clocks, or GPS, too. So very important. And even in our realm, so the cyber realm and Internet is important, too. Now we face some limitation. Almost anyone knows large IP-based geolocation services. I don't want to

5
00:01:29,980 --> 00:01:37,720
to name all of them but you can just type some ips and find with a certain precision where they are

6
00:01:38,440 --> 00:01:46,460
due to the massive use of cloud provider and cdn so we can no longer use them because you just have

7
00:01:46,460 --> 00:01:54,460
one anycast one or more anycast ips and you do not know where they are you maybe find the location of

8
00:01:54,460 --> 00:02:01,160
the company that run that subnet nothing more so this is what has driven my work so looking

9
00:02:01,160 --> 00:02:11,700
through the cloud cartrain so um so answer the geolocation question in the cloud provider

10
00:02:12,920 --> 00:02:18,000
world some theory before we start it's a mathematic and physics don't be scared it's

11
00:02:18,000 --> 00:02:24,300
very simple uh this is a this is a simple one distance is a speed per time this is a first

12
00:02:24,300 --> 00:02:24,440
time this is a first time this is a first time this is a first time this is a first time

13
00:02:24,460 --> 00:02:31,840
order estimation of distance starting from a time so it's something very easy and have to run so

14
00:02:31,840 --> 00:02:39,060
keep in mind but it's it's important it's it's very easy another thing is to keep in mind

15
00:02:39,420 --> 00:02:47,100
it's obvious but keep in mind the nothing can move faster than speed of light we even if we

16
00:02:47,100 --> 00:02:54,220
are hackers we are computer scientists we are antisocial we cannot break this law this is a law

17
00:02:54,220 --> 00:03:01,680
of this universe maybe in another one it's another speed but we have to remember that nothing can

18
00:03:01,680 --> 00:03:07,600
travel faster than the speed of light even information even things on the internet and some

19
00:03:07,600 --> 00:03:15,560
terminology now latencies versus speed we sometimes confuse them maybe the person that knows

20
00:03:15,560 --> 00:03:22,540
bad best what is the difference are video gamer because the latency is actually the lag so it's a

21
00:03:22,540 --> 00:03:24,160
time measure and it's in a

22
00:03:24,160 --> 00:03:30,720
millisecond or more but it's a time measure whereas speed is an amount of data or an amount

23
00:03:30,720 --> 00:03:37,860
of whatever over a given amount of time so keep in mind this and remember the speed of light limit

24
00:03:38,340 --> 00:03:45,120
latency cannot be arbitrarily low because it's the time information takes from a point to go to

25
00:03:45,120 --> 00:03:52,580
another one so you cannot you you cannot make information travel from sydney to san diego in

26
00:03:52,580 --> 00:03:53,960
two milliseconds it's impossible

27
00:03:53,960 --> 00:04:01,040
this universe doesn't want so obey the rules not relateration

28
00:04:01,040 --> 00:04:08,880
it's a well-known and well-known method for estimating at a known position starting from

29
00:04:08,880 --> 00:04:18,240
known points so it's it's well it's commonly used for gps for tracking smartphone okay it's

30
00:04:18,240 --> 00:04:23,840
not very good use but it's used for or a rogue radio station

31
00:04:23,960 --> 00:04:30,940
stations and so on so it's a very well-known methods and we need for this recipe some points

32
00:04:30,940 --> 00:04:38,520
fixed points from where we perform our measures and we have to know their exact point exact

33
00:04:38,520 --> 00:04:45,360
position so tower radio towers or so on we will discuss what we will use in our

34
00:04:46,240 --> 00:04:53,840
for our problem then distances so a method for estimating distances between the

35
00:04:53,960 --> 00:04:59,840
unknown target and these points and then obviously the target that is what we are looking for

36
00:05:00,180 --> 00:05:08,200
so this is the simple recipe for to the iteration then we have another important powerful tool

37
00:05:08,660 --> 00:05:15,780
that is a mathematical tool that is a minimizer and we will use it for providing data we have

38
00:05:15,780 --> 00:05:21,620
collected and inferred like points distances and it will

39
00:05:23,960 --> 00:05:30,520
some of the best points the target could be so this is something that i will not give into

40
00:05:31,140 --> 00:05:42,620
diving to minimizer but you can uh to iteration has been used for tracking people even by uh by

41
00:05:42,620 --> 00:05:49,200
dating apps uh it's not actually a knack because uh sharing distances in many

42
00:05:50,720 --> 00:05:53,460
dating app is something that is up to the user

43
00:05:53,960 --> 00:05:57,760
but has been exploited for tracking people so the system is the same

44
00:05:57,760 --> 00:06:04,880
fixed points so where you have your measure points so your client and the target the unknown target

45
00:06:04,880 --> 00:06:14,920
and then do some translation well let's do some practice now this is a ping uh almost anyone

46
00:06:14,920 --> 00:06:22,220
here have used ping uh at least one time in his life and it's the first approach to latency ping

47
00:06:23,960 --> 00:06:30,920
it's the first time measure from a client and a server and it give a give us as output many

48
00:06:30,920 --> 00:06:39,900
parameters like the average time and so on and by using it's a very naive measure but by using it

49
00:06:39,900 --> 00:06:44,140
we can infer some important information

50
00:06:45,520 --> 00:06:51,800
for instance in this example we have the minimum round trip about 55 milliseconds

51
00:06:53,960 --> 00:06:54,500
and we can see that the speed of light is at the same level as the speed of light

52
00:06:54,500 --> 00:06:59,520
so if we combine it with the upper bound of speed in this universe so the speed of light we can

53
00:06:59,520 --> 00:07:08,360
assure we can literally sign with our blood that the target cannot be farther than 8.3

54
00:07:08,360 --> 00:07:16,600
hundred kilometers thousand kilometers so this is a very important things but um okay surprise surprise

55
00:07:16,600 --> 00:07:22,660
it's useless it's useless because because two things um

56
00:07:24,680 --> 00:07:34,720
services behind clouds are not ip services and so you cannot use icmp protocol for reaching them

57
00:07:34,720 --> 00:07:42,180
you we you will only reach the ingress point of the cdn so it's useless and will be the nearest to

58
00:07:42,180 --> 00:07:48,100
you second things it's internet it's not linear like speed per time speed per time is a linear

59
00:07:48,100 --> 00:07:52,640
function so it's almost useless internet is a large

60
00:07:53,960 --> 00:08:01,140
amount of nodes interconnected in every way is possible and governed governed

61
00:08:02,100 --> 00:08:09,420
by wave protocol like bgp i love bgp but it's another story and so it's not linear at all ah

62
00:08:09,420 --> 00:08:15,420
and all of this is projected over a spherical body in the universe so it's not linear at all

63
00:08:15,420 --> 00:08:22,260
we need to find a better model for estimating a distance starting from a latency

64
00:08:23,960 --> 00:08:30,500
i've used machine learning so anyone use a machine learning today but i used it for estimating

65
00:08:30,640 --> 00:08:35,400
starting from a latency the actual distance more or less

66
00:08:37,840 --> 00:08:44,540
machine learning requires many data many data i collected around 40 kilo measure couple of

67
00:08:44,540 --> 00:08:51,800
measures source destination each one target with a country code source country code

68
00:08:53,960 --> 00:09:03,020
actually um and trained over the distance inferred via computed via other scene functions so the

69
00:09:03,020 --> 00:09:10,180
shortest starch between source and destination so we have as features uh country code and we use it

70
00:09:10,500 --> 00:09:15,140
has a bag of words for who knows what machine learning data science things

71
00:09:15,580 --> 00:09:23,700
works and then latency times and as output the real uh distance i used an svr a support

72
00:09:23,960 --> 00:09:32,200
direction model is very simple to use and i will run on this because we are running out of time

73
00:09:33,080 --> 00:09:39,080
now recall the recipe we need points the best way to have many points around the world is

74
00:09:39,080 --> 00:09:45,280
used is using a cloud provider choose your favorite one and deploy some lines of codes

75
00:09:45,860 --> 00:09:53,900
on each of them we are talking about uh cloud front of the services like command and control

76
00:09:53,960 --> 00:10:00,480
control so we cannot use ICMP anymore but we have to measure latency on application layers.

77
00:10:00,720 --> 00:10:08,940
So I use HTTP, so I use CURL for HTTP and HTTPS protocol. We have to deploy these lines of

78
00:10:08,940 --> 00:10:17,340
code on each point we choose. We have to compute latency. It's a simple substraction and it's

79
00:10:17,340 --> 00:10:25,560
and read manual of CURL is perfectly explained. And then we have to compute the distance using

80
00:10:25,560 --> 00:10:34,720
our machine learning model and at this, yes, and at this point we have two arrays. A point of

81
00:10:34,720 --> 00:10:42,340
arrays that are data centers and their coordinates that you have found by OSINT or Googling them

82
00:10:42,340 --> 00:10:47,320
or whatever. And distance inferred via machine learning model.

83
00:10:47,340 --> 00:10:57,120
And the unknown point we are looking for. Now we have to do the magic with some math and we have

84
00:10:57,120 --> 00:11:05,200
to minimize all these things. I will go fast on these two but it's minimizing process over the

85
00:11:05,200 --> 00:11:12,460
residual between the hypothetical position and the distance we have collected, we have inferred

86
00:11:12,460 --> 00:11:17,320
before with the machine learning model. And I don't know if it's clear. So we have to do

87
00:11:17,340 --> 00:11:25,300
the math. Is it clear? Yes. And you will have many outputs. I will use a small set just for

88
00:11:26,980 --> 00:11:36,240
make it better to be understood. And this is a cloud of possible points with a centroid on the

89
00:11:37,200 --> 00:11:46,960
west of UK. And the server was actually in London. So it works. The yellow, the yellow circle is

90
00:11:47,340 --> 00:11:53,640
the upper bound of the speed of light radius. So we know that the point cannot be outside that

91
00:11:53,640 --> 00:12:03,500
circle. So it's very good for just latency based method of inferring a position. But let's do

92
00:12:03,500 --> 00:12:11,500
something cyber. The main problem, the main things I was working on is command and control

93
00:12:11,500 --> 00:12:17,320
behind cloud front. At the moment, anyone who works on threat Intel, they don't have the

94
00:12:17,340 --> 00:12:24,900
command and control in case they have fronted command and control or a malicious site for

95
00:12:24,900 --> 00:12:33,060
the living malware, raises their hands and say, oh, we cannot do nothing. We cannot say nothing on

96
00:12:33,060 --> 00:12:40,120
which part of the world the service is or isn't. Unless you call the cloud provider. But good

97
00:12:40,120 --> 00:12:47,320
luck if you have tried. I don't know. Let me know. But surprise, now, and I don't know if it's

98
00:12:47,340 --> 00:12:55,800
until now was impossible. I arrived to a good result in this method. And this is not precise at all.

99
00:12:56,060 --> 00:13:03,820
I could have put an example that was more precise. But I wanted to say that it's not very precise.

100
00:13:04,220 --> 00:13:16,180
It's not a kilometer precision method. Here we have a real service behind the cloud front located in

101
00:13:16,180 --> 00:13:24,460
a room. And using only latency measures and no more than a dozen point of measures, we have this

102
00:13:24,460 --> 00:13:31,700
fancy heat map and an error of 600 kilometers. That in Europe is a lot. But imagine the rest of the

103
00:13:31,700 --> 00:13:41,000
world. I think it's a good result. Please appreciate it. Something more that we can use this method

104
00:13:41,000 --> 00:13:46,160
for is sandbox detection. Sandbox detection is a method that we can use for a lot of things.

105
00:13:46,180 --> 00:13:54,300
It's many times as a fake net behind. So a system that mimics the real behavior of a network of the

106
00:13:54,300 --> 00:14:06,180
internet. But it's very difficult to cheat time or mimic the behavior of latency versus some points.

107
00:14:06,320 --> 00:14:15,400
So we have just we can embed our model inside the malware and a number of fixed points inside it.

108
00:14:15,400 --> 00:14:22,780
Embedded in it with a target country and what I've said before. And in presence of fake net,

109
00:14:23,920 --> 00:14:31,240
latencies will be only a few milliseconds. So the result will be something that graphically is a

110
00:14:31,240 --> 00:14:38,460
non-overlapping circle. So it's an impossible mathematically solution. It's impossible. It's

111
00:14:38,460 --> 00:14:44,060
impossible. There's no point that minimizes the function that we've seen before.

112
00:14:44,340 --> 00:14:44,520
.

113
00:14:45,400 --> 00:14:53,600
We can even add some random latency in fake net. But I don't know if someone will work for it.

114
00:14:53,780 --> 00:15:00,940
We could try. But I don't think it will work better. It will work better than a real network.

115
00:15:01,500 --> 00:15:09,860
And the other thing, similar to the sandbox detection, is a malware self geolocation. And you can

116
00:15:09,860 --> 00:15:15,380
ship a malware with inside this model some fixed points and some other things. So it's a very

117
00:15:15,380 --> 00:15:22,380
automatic process for determining which area of the world is running and then turning on or turning

118
00:15:22,380 --> 00:15:32,460
off some features or the malware itself. So I think it's nice things to do. Is it at the moment perfect?

119
00:15:32,720 --> 00:15:40,620
No. Is it bulletproof? Absolutely not. But promising. I'm very clear. I don't want a wow effect.

120
00:15:40,900 --> 00:15:44,880
It's an early stage research. So I'm very, very frank.

121
00:15:46,000 --> 00:16:12,040
Then I have a demo. And here it is. Is it in full screen? No? Okay. Sorry. Okay. This is the notebook,

122
00:16:12,420 --> 00:16:15,360
Jupyter notebook that you will find on my GitHub.

123
00:16:15,360 --> 00:16:23,900
It's POC for this. And I ship it with my pre-trained model. But I will have to retrain it again.

124
00:16:24,380 --> 00:16:32,760
It starts with measures. That is a long process. And then it starts estimating an offset. That is important

125
00:16:33,250 --> 00:16:41,720
because of the inner latency of the computation due to the computational time of the server we are reaching.

126
00:16:42,060 --> 00:16:45,340
So we first determine an offset for the network. And then we start estimating an offset for the network.

127
00:16:45,340 --> 00:16:54,840
For all the latency measures, we subtract them to the measured latencies. And then we have to estimate distance

128
00:16:54,840 --> 00:17:05,760
with our machine learning model. And these are the distances. This is the main process.

129
00:17:06,080 --> 00:17:15,320
Trilateration is done with a method that we can discuss of the records for avoiding some outlier and so on.

130
00:17:15,340 --> 00:17:24,840
And then we already have the heat map now, but it's not plotted. We find a cluster, the largest cluster of these points.

131
00:17:25,120 --> 00:17:37,720
And we compute even an estimation of the error. And then the plotting time. And here it is.

132
00:17:37,920 --> 00:17:42,660
No popping calc like my exploit friends, but it's nice.

133
00:17:46,680 --> 00:17:51,900
Wait. Okay. So this is the one of the example in the slides. So it's an actual one.

134
00:17:52,120 --> 00:17:54,500
And thank you for this.

135
00:17:55,080 --> 00:18:07,960
Then I'm done with two minutes earlier. So if some of you want to make some questions.

136
00:18:08,580 --> 00:18:14,620
How long does the HTML model stay accurate with unique graphs changing the method?

137
00:18:19,600 --> 00:18:26,200
Okay. BGP is a big mystery for me and for almost anyone.

138
00:18:26,440 --> 00:18:32,440
But I came across the fact that the BGP is more stable than what we're used to.

139
00:18:32,760 --> 00:18:39,220
And the machine learning, due to the fact that it's a large amount, not an enormous amount of data,

140
00:18:39,360 --> 00:18:45,160
but it's a large amount of data collected, it responds very well.

141
00:18:45,340 --> 00:18:49,780
Even during a few months or a few weeks.

142
00:18:50,100 --> 00:18:56,760
So maybe combining it with a looking glass, BGP status and so on would be even better.

143
00:18:56,900 --> 00:19:00,780
But I assure you that it's more stable than I expected.

144
00:19:08,420 --> 00:19:10,080
Oh, sorry. I cannot.

145
00:19:16,420 --> 00:19:18,560
Okay. Artificial latency.

146
00:19:18,980 --> 00:19:25,280
Yes, you can introduce in your services or an artificial latency.

147
00:19:26,040 --> 00:19:28,180
But it would be useful.

148
00:19:28,840 --> 00:19:38,300
But if you collect a large amount of measures, not just one, you will find the main value.

149
00:19:39,120 --> 00:19:45,120
So you will have a distribution like a Gaussian one with a random latency, artificially introduced.

150
00:19:45,340 --> 00:19:47,180
In any service or so on.

151
00:19:47,300 --> 00:19:54,960
And then you can use all the smallest one or the main value.

152
00:19:55,260 --> 00:19:58,840
And you can use the system in the same way.

153
00:19:58,960 --> 00:20:05,560
Just with a slightly modified check preconditioning of the data.

154
00:20:08,140 --> 00:20:08,520
Oh.

155
00:20:09,420 --> 00:20:10,180
.

156
00:20:10,180 --> 00:20:11,120
.

157
00:20:12,240 --> 00:20:12,400
.

158
00:20:13,740 --> 00:20:13,900
.

159
00:20:16,940 --> 00:20:17,100
.

160
00:20:17,860 --> 00:20:18,020
.

161
00:20:19,300 --> 00:20:19,460
.

162
00:20:19,460 --> 00:20:19,540
.

163
00:20:19,540 --> 00:20:19,640
.

164
00:20:20,880 --> 00:20:21,040
.

165
00:20:21,040 --> 00:20:21,120
.

166
00:20:21,120 --> 00:20:21,140
.

167
00:20:21,140 --> 00:20:21,160
.

168
00:20:21,160 --> 00:20:21,200
.

169
00:20:21,200 --> 00:20:21,220
.

170
00:20:21,220 --> 00:20:21,240
.

171
00:20:21,240 --> 00:20:21,260
.

172
00:20:21,260 --> 00:20:21,280
.

173
00:20:21,280 --> 00:20:21,300
.

174
00:20:21,520 --> 00:20:21,680
.

175
00:20:21,680 --> 00:20:21,780
.

176
00:20:21,780 --> 00:20:21,820
.

177
00:20:23,220 --> 00:20:23,380
.

178
00:20:41,420 --> 00:20:41,800
Thank you.