and I wanna say the layout just first that's a really big honor to be here
on so like security that's awesome on securities like really awesome
and you guys are awesome so thanks a lot for %uh keeping up
and I you keep doing your thing I could do my thing items talk is called into
your cunt network and your conscience messing with and after smoking mirrors
even started so among start by taking a bit of up to look back and
talk about what I'm going to talk about and also by congress we're not going to
be speaking of
I'm so consider like three main phases all
network attack I'm you can find a Sunday Aug and a text book anywhere cuz I
completely made up
weekend think it as gaining access so to some network right so gaining access can
mean like exploiting and externally facing computer
or maybe you're like literally crawling through the air ducts
of like the Gibson corporation right I'm I we don't really care so from our
perspective like we don't care like how to gain access to it we assume you gain
access to you bypass the firewall you be
bypass something else in the border security on Step 2 was performer
Constance this were actually concerned about here
are so you want to find out everything you can about the network
that it is you want to attack for you want to find out how many systems are
what types systems are operating system sports everything right sorry we talk
about what we can do to
to tax that presence just like the reconnaissance also prevent I'm in
threes explain vulnerability
so you wanna in them in the content and in the process of
are for Nikon since you hope to find some vulnerability they're going to
exploit and then you actually send the payload rights or not be talking about
that
should not be talking about intrusion detection in the classical sense like
store does write like
looking for the blaster warm as it goes across your network cannot be trying to
get it back
we're just gonna cost remember to spokesman second phase and your
conscience
so talk about obscuring your network or
more specifically obfuscating more technically speaking ons or not we talk
on church in detection prevention
on your access control right so if you think like art will
we found a bad guy let's kick in from the network but that's not really what
we're trying to do here
or trying to bomb provide and your posts
on this replies to private networks
I'm so print networks are not normally publicly accessible
arm so that would mean like not public networks
so like your university I think I don't like library like
right like you can just walk around and look at the computers in the library
right like this
but I really much I can do against Allah for apps offer perspective also external
machines like Google's web server
like can't be helped by anything about to talk about right like as you need to
know where he was web server is and that poor needy is open
like ike I can help you also doesn't help anything against social engineering
so like your blog phone up like a operator in shoes into telling you all
your details likes nothing I can do about that and also just plain stupidity
right like if you post a picture of your network onto the internet nothing I can
do about
okay what we want to stop the actually talk about so I'm
four-time enter causes talk a little bit about reconnaissance I'm in a little bit
why
on how it works and a little bit why I'm how it's hard to prevent
on so wanted Mike most basic things wanna find out when he first gained
access and trying for Constance is
how many seasons are there what computers are up I'm so using our troops
can for this
times when the most basic techniques arc is the address resolution protocol
it's a way of finding out what mac Address is associate with a given IP
address
you know the IP even find out the mac Address to send out in our practices hey
192 168 1.1 what's your address
and if he responds as here's my mac address that means he exists
or you know well as this computer up there right if he doesn't respond that
probably means that it doesn't exist releases more than a half away
you can use this pretty calm another easy way of doing that is using a pain
getting everybody knows pain are you sent a ping request to send a pic reply
get a reply back to his is there though up
paying I i cnt in general of unblocking balking at work so
a negative response ripping sometimes just means that King ICM is being
filtered
on so then now you know what ports
or what conditions exist on this democratic found out like what IP
addresses how
machines behind them want to say one finds more information like what ports
or
cent sports are a really big thing for network security right the gas attack
surface
like more ports that are open on machine more things I could possibly go wrong
which is really good for you attack so he sent a TCP packet ready said the same
packet outs to try to connect to the
server I'm to try to connect service right to get a syntax back
then I mean sports open to get easily reset supports closed
and there's some other details here there's lots of other weird things
happen but those are the two most obvious ones right I'm sure you can you
tease
a connectionless so you just send data this is Noah connection right you to
send the data packet and if you get a data packet back
means open on though energy get an ICP
up for a ritual disclosed the forces of some other situations like it happened
like if you don't get a poor
a packet back Matt I could mean that it it's open because I'm gonna pack it back
yet or could mean it's closer maybe as a firewall
with lots of other things but as the basic idea right
arms offering system shopping seasons are little more interesting
I'm so a and nap at least up to tax operating system let's talk a little bit
about an app on
over we're doing here up later I'll show you to we made
I'm it doesn't specifically target target and map but in memphis is a
course in the canonical
tool used to do network mapping I'm so specifically what I'm aptos to
figure out what operating system is running on computers really quite
ingenious
um they sent out in the legal TCPIP
packet the use I cept is Pnut
is the senate a legal packet so some packing work if you have the TCPIP spec
break typed out right in front of you and you're the programmer
of like the SkyTeam stack for for operating system
is it what should I do I get this packet the answers that's not on there's like
it's not inspec
so use up to make up like Shasta you figure out a way to write
rights your response somehow but everyone's going to a different way
so all the operating systems 12 responding differently in fact different
versions of different offerings this one respond differently cuz
undefined behavior so we can use this to figure out what operating system is
running so we sent some weird shaped package right
that kinda looks like Australia family I'm
and like windows will respond in the spare unique kind of ugly way
and when XO responds very nice shapely sorta way
but their unique us the important right like the you can tell the difference
between those two things
communuity final operators is right on some never to apology is nothing you
will find right you're fine
not just got to find the exact apology the networks use trace route to do this
I won't go through the details on exactly what race are at work sites like
pretty standard
complex that that the picture there's actually help but from other
does and map the visualization tool inside of and map
see like that an actual I picture you can get from and now
somebody's network to find like like who's behind exactly what router and
stuff like that which is all really and
more information on steam for an attacker
on 61 a fine is what services are actually running on
ports are open on and for the most part this kinda follows naturally from what
port there on
on but also you want to find out what versions of services are running since
thats
you know highly important running really all version of some service
not something you want to find out and so this works really somewhat operating
system detection
where you can like San unique packets like different versions will send you
difference of back
don't in fact most the time the services and the operating systems are just given
to you for free
like if you just go to a web server like the HTP banner on it what to say
hey I'm Windows version this running Apache version this
or I can you go to a telnet server say hey this is telnet server exactly .1 .3
.3 .1
like running Windows this right so there are some ways like scrubbing those in
our schools scrubbing those but I think in general
like they're not used or people to know about them I'm so
and to the canonical to like I said for doing all this stuff is an app I'm so
the tool that I i have your little show and a lot other research that we don
isn't targeting an app specifically looking at work anything else except and
now
on but your that's that obvious things talk
so why is detecting reconnaissance hard I'm
I think I went back up this assertion with a I'm
like hard proof in the slides I think most people just can't give up
on Const people to safeguard over and try to find a blast dormant
ideas in my network and I'll put some like firewalls
the edge minority people from going again and that's it right
and well you know like how many computers I have isn't a secret so
action try to trans fat issues give up on reconnaissance
arm and i think is a couple reasons white ones that its hard two signatures
fail
right signatures are how we work at security community we love signatures
they were from monetization standpoint they also like kinda work
i least when they do work they work well but all the stuff I talked about before
are identical to
packet level like there's no difference between our packet that's been used to
scan you
and an actual our packet the people use cuz networks used
right I'm pain can be sometimes blocked but even then like that
is really annoying we're on a network for ping is blocked people complain
about it
I mean in like pain is a but it's what it's made forty meters
like to find out what two years earlier it's a reconnaissance tool
saw lots of practice P sends like in a perfect world which we might think like
although maybe if somebody sends a tease peace n
for that doesn't have finished the connection like 10 weekly so that
hostile but it's not
you know in academia that might sound like a good thing to do but the real
world networks
how like weird stuff goes on you ceased racing packets like all the time
if you put a signature that says like anytime I see
like 1.2 the three TCP handshake packets
hours geiger alert for that you getting alerts constant
on suspicion is another issue right you can be a really really slow and I could
be still think
send a packet for our per day or are even less rate may be stealthy
or being super fast to be stealthy like you can be like fish for anyone noticed
on and also a pic was that a question
seasoning on also because the Tigers already inside you know we're kinda by
definition this right
solve your border security is pointless like your firewall if you have
your firewall top your network only covering Internet traffic
than it it doesn't work because none other traffic is getting hit by
even if you did how signatures that worked here right you have to have a
firewall
like onto the hosts are between all the network actions
but something more fundamental going on here as well arm is the fact that you're
talking about
isn't data its meta-data and meta-data camping crypt
so wanna the like mean ways that we like security people
deal with on security issues is by
encrypting cuz incursions awesome right arm
so you consider yourself you have a packet writer some
message that you wanna send you can create the contents data
and weekend you know prices do this and we can
say with of high degree of security out like contents the data secure that's
like
one of the best things like our security needs don't like corruption
really problem friction I'm but you can't do his encrypts
a meditative the packet right you can encrypt when the packet was arrived
you can criticize the packet although you can pat it but even then
right the Act how it's received isn't
you can trip to the direction that the traffic packet was going all the stuff
is meditative
and so I might have equally titled The talk
network steganography right on in many ways what are you talking about is very
similar to steganography
gonna call network steganography but I've and reconnaissance sounds cool
so we can do is this I love animation away
we just throwing a lot of other data and now you don't know which one is real
and even if you did know which worry if you want to find out which one is really
have to like
open all the messages it's very cumbersome process through injuries a
process
it wasn't as easy as it was before right before he just knew what it was
on this is what steganography does write like if you were the canonical example
being like if you're
a prisoner inside a jail and you want to send a message is somebody outside the
jail
you can't just writing in cryptic message have like that get out because
the warden is going to take your message no script
for grow it out you can we build the send a message
so the only way to do it is to have lots of other messages that seem
perfectly benign and then have your actual message inside
it doesn't that's where we talk about doing with network rather than
message so really talking about is trying to make unusual in a haystack or
make you are like actual nodes
I'm in your car on a computer network just 10
Justin you inside a much larger haystacks we talk about drowning out
your actual notes on network on with realistic-looking
fake ones on so to do this reviews and honey D
which is a a really awesome show written by grinding wheels pros
to happens like be here like to attack a drink or something
arm we had to make some additions to it I'm so I think I have us
out actually talk about ninety more specifically a few slides later
soul which I'm so we have two goals here on two primary goals
on one is to you obfuscate the network which
you know makes reconnaissance more difficult
makes it less effective
I'm they also want to identify reconnaissance mistakes not enough just
to
prevented for just a new make it harder we actually wanna find out when have to
make an alert
right like when this stuff goes down and so
this is a key a part of like our research we're figuring out
is that once you have these decoys this big sell fake machines
on that really helps you figure out when reconnaissance is occurring
because these are decoys honeypots and
people kinda by definition should be talking to the honey pots
on like they any traffic to them is presumptively hostile
are you talking about the box why you send exactly once in packet to all the
honey pots
like that there's a spare specific not only just that talking to them as
is about way as about but afrikaans is a very telltale signature from the network
lookup I'm so virtual they're using
a to do this that term I wrote and
a small team and working with arms open source project called Nova
our website is project Nova don't work
license that's their train CC plus on runs on you like systems
on about for forty-four thousand lines of code
a small team that's working with me SBIR grant
so if you have questions about like like that sort of thing
I think the SBIR project is a really cool way to start
I'm getting some funding for bottler security-related open source projects
on so to check us out there download the code I think I CNN packages that are
up that could be considered highly of
have no I made them myself and I really like a diving packaging guys so
obviously knows more about packaging be really helpful
I'm so you please I like download the those source
run on your network and see how things work I'd really like to get some
feedback from
okay so some since we're talking about honey possibly I talk a little bit about
like how honey pots are used to how they work usually use
however using them that's different than typical use case
on so a high-fidelity air quotes
iPod is on usually use in small numbers
so they're like real machines so like its not a typical for a large
organization to
how their IT guys I hate sup actual box
with real hardware and put over there in the corner and
run it with like like Windows XP no service packs
which like gets rooted if a light breeze comes through right
I'm and now we like will have like an early warning system
because presumably bad guys will see that no exploit first the idea
right that's the whole point honey or sometimes use a virtual machine for this
site you won't have to your hardware your virtual machine that we think it's
router
completely destroyed and you can like white betting hope that liked the
attackers able to
escape from jail that is the virtual machine
to certain degrees of success
but their century the same thing at least in terms of purpose concept
they run real software services that really do get exploited because that's
the whole purpose
arm and they're very useful I'm forensically I'm so like
if you're trying to figure out after the fact like what happened
like you know network intrusion I'm that's really useful in say hey like I
saw the same payload
apec came through on the the box to go twice on the honeypot to use
maybe try to go backwards on also
really useful are you can but the really useful academically
I'm so there's like honey at project and there's lotsa core programs like doubt
that
try to find like a worldwide you know viruses are actually going out on the
internet right now
suitable network honeypots they get exploited
and seeking you know get people heads up before like their network at it by
I'm so in a way the kind used to distract attention but not really
not really anti reconnaissance when they were talking about them because
by the by the sheer fact that their like high fidelity you can't make many
I'm so low fidelity honeypots is the concern
here's the not real machines least not I'm virtual machines like as you know
them
in the VMware View are for Joe Boxer sense right
arms that can be exploited like a virtual machine can I understand
danger of saying that something can be exploited in front of a group of actors
but I there's an order of magnitude of simplicity
difference between like a virtual machine which has like
actually emulating real machine and just a service that
throwing up packets to pretend like it is
on C can make these things and mass which is really important part
you can make and order magnitude more of them then you have real machines
so a single computer can have hundreds or thousands
these fake machines look real from the network
but you know don't have all the trappings regular virtual machine like
to run hard disk
their own gramercy I'm so when the comes a honey do you know if
anybody's following is a handgun and update like five years
and %uh since then and map has gone a whole new sweet
of operating system probes as or just responded
wrong and so I call the operating system results in a lot of even just the normal
results were just like of rape
sweet to give that some attention so if you go to
way up us ok and that was the reason to go to you on are
I get home page I'm then we have some new
code for do that response properly to the new I'm and map
probe so it'll actually like work with annual approves
water
see also honey bee services this important part about how money works
is that I'm uses scripts as services
I'm so these services can be really really simple
so like when the your virtual machine fake machine gets data only get like a
packet
I'm rather than running an actual like telnet server it's just a shell script
that response however
complex or simple you want to be so we have like a service to tell me auto fail
work you just you it's like 20 line scriptwriter takes input
and says nopee failed can't login like log in tonight
and you can spend like ours on this right like trying to login
I like %uh I'm where you make them really complex there's things like that
that pretend to be
infected machines like by my do my companies like viruses that open up for
your service like a listen
for command control signals and like bill a pretend to be like a man control
signals the like
except but responses right and pretend to be
in fact by those machines answers really though there's a more complex for those
are kinda cool things
his other side we have like a I think I got TP served no
we have a message server that like allows log in required
log into the service right minute like everyone smiled like your
it was so your permission is denied she can't like
she farts won't be too complex on his own relatively safe because the shell
scripts
I'm running at like a super low privilege level and
unit not they will be the mic or shell scripts could be possibly spoil because
in order
mangosuthu simplicity between like 100 line shell script and like an actual
running service on Cesar fairly safe to run sorry so take a step back now
and look at what kinda were wrapped in terms of
from a tax perspective right so your attacker you gain access to some network
that's running
this nervous system right and you see some massive network
has like thousands machines on and some crazy complex topology
on most these machines are fake but you don't no doubt
I mean you can spend hours you know trying their individual services
like trying to log into them and seeing if their exploitable
and some reconnaissance itself becomes
ineffective becomes cumbersome and objects
and sauna try to talk a little bit about the obvious part on so
I think we can %uh see how like consts becomes more difficult like
just the process itself becomes like really annoying and you know what
machines are fake
and trying to find out what's actually exploited because really really hard but
we don't want just our you want to have like
heads up on the track wanna have like some like public
lurching like the IT administrators like smart show writes like a somebody's
doing something bad
tarea up there was a
30 are to repeat the questions cuz on the Zambian like so you the question is
um
he said the machines have like a real like IP address that's yep that's right
yes I'm seeking something statically or using DHCP see
okay so um want the downside transit questions the
at the end just because I think it's kinda K usually I can accept questions
during the thing but like
if I approaching people was a sec always so
up the process was like hundreds of these things is fake notes
um one other troubles with some is actually setting them up by configuring
and I was wondering very early things we discovered about heidi was that like
and overhead in terms of manpower like setting up these fake versions is really
really high
on since have to go through config files like do with mainly by hand
on it's also dangerous process are dangerous I say in the way of
0 actually thats news there dangers in the sense that
I'm as easy misconfigured right because the whole point of these fake machines
have to look real they'd look believable to an attacker and so if you like
a BSD box like a fiction the pretence BST that's running MSRP see
then it's like probably about right liked kinda giveaway
on this awesome other subtle things to like if your network
is all just like a Linux server farm and you have like
entire sacked like section like Windows machines and those are fake ones over
fake missions all Windows
over real ones are winik's that's probably about to write you got i cant
an obvious separation
as you want something that looks like your network but a little bit different
so week well we deal with this as well
I'm so a lot of what we do is try to run providing easy front-end
I'm friend bout are for frontier other
on so you can create these virtual high parts with a nice pretty Korean stuff
like that
on the bar really we have when the things we just finished
actually is on the sorrow configurability a master tears I say
just finished I mean like last week
so not a morning it's like really fresh so does it and maps your network
people like Obama you give the subnet on and master networker finds out what what
computers are there
operating systems are unimportant stuff like that right and it generates
an entire pay stock for these things art sales tax and I'll
and Parsons 180 config file so you have up in it like
randomized situations you have a slider bar to say I want like
really random or slightly less random and then it makes
um when these fake networks for that looks like your network but a little bit
different
for you know how different depending on how March 16
I'm so that like makes saying such a greasy his company
of course you know the the the irony from
using and mapped seat and prevent and map is not lost on me
como adding salt there in a second
arts a classification some other that need crunchy part of the topic here
so with high fidelity honeypots um classification is done like manually
right
like expecting log files secure the IT guy at like
a network and your boss comes to us as a team
catch a bad guys today like how would you answer that question
if you've got like a high-fidelity I you gotta go to the log files and I don't
maybe you
maybe you've got some automated tools maybe you've got something that like
tells a shadow file changers something like that right
but for the most part so really manual process it's really knowing it takes a
lot of time
on because like signatures like IDS antivirus or things help but not really
in the sensible connaissance
10 singers mostly fail in this case
I'm sorry top doing his machine learning I'm so this is like a
really cool sorta part about this i really want to get in on so them
the over the air using for machine learning is called the k-nearest
neighbors over them first to school
learning on this is a totally normal like our in the plot people use for lots
of things that
have absolutely nothing to do with network security so
it's actually one more simple algorithms for machine you find which is why the
reason we went for
I'm so the idea that you have and statistical features
on that are scaler values so well we're not talking about like
Deepak inspection in fact I think actually captures the like
the headers think we go a hundred bites and two packets we only recognize that
on C looking a scaler values like packet timing I like number IP's contacted
for suspects like ports comic number reports contacted
comic what percentage this haystack to the thing contact right
and your plot all the scaler values for suspect in n-dimensional space
only two dimensions due to budget cuts are showed on the screen
I'm and so you match in like per side you much like percentage
avoid a nappy stacker notes contact on the x-axis
and some other value on the y-axis right you have some training that is
that set and so just like spam filter right you have to have training data
have to tell the system
what's good and what's bad what possibly looks like what the nineteen
looks like he plotted on a graph like this I'm
helms yes you popped
all these days all the state an n-dimensional space
when you query point is green guy with a question mark in the center right
say are you here's a point is your order is the bad like I found a new suspect
I calculated the state a foreign applauded monograph is eager is about
how do you answer that question
well it's fairly simple here you just search for its K nearest neighbors were
case I'm constantly choose
so the inner circle there's three we say are well there's
got to red triangles and 1 Blue Square
and so majority votes say he's going to be a red triangle
which maybe means hostile system right in reality we use that distance metric
to try to get a
so we will just use a majority go value 0 to 100 means
almost surely benign and one means almost surely hostile
I'm going to do this we use a a library called the band which is awesome its
in the cabin to repose as the approximate nearest neighbors
out for them library it's one of those things were like they don't
they they introduce some very small amount air attacks a configurable
are many introduces what some big performance gains
I'm and so a if you're data points are selected well rather if your features
are selected well
these points in your and dimensional space should naturally tend to cluster
of
like if they're spread evenly about
like more or less without any order the means like your day does not correlate
into anything
I'm if every if your data shows and well our using data
your own features shows well like a hostile gosh look at a club up in one
area
nine guys kinda club open one area because that's what data suggest
Arts in response on when we do we actually find a bad guy
ons like I said before we don't want to do things like injecting them from the
network or black
blacklisting now we want to do that stuff since as:
we don't have the authority to do that right since for prices to be some piece
of software running somewhere in the networking
will have the ability to projecting from the network boss because you don't want
you
because if your cure if the attacker knows our system is on here right and
they've suddenly get a check to the network than like a like
that gives them some information about like the stuff that I scan was enough to
know that I'm hostile
they can use that against us on so what we gonna do that so we're not playing
the role that ideas
ons wanna make an alert which is one thing we want to do comes with a couple
ways you doing out
email doing in a log file suffered
user interfaces to pick a I'm will swallow for the attacker further
sorties you something which I I call the doppelganger
which is a way of denying access to real news
I'm so when you find something that's attacker
you you determine that is hostile according to the system
we're going to do was going to reroute any traffic from him only
on that was going to go to a real host out to when these fake names
so what you have and you know they made specifically it's called a doppelganger
as we speak machines right I'm and you're going to like the transition to
you going to do move him over to you like the speakership now when he tries
to access
on the rest so figure we catching like a quarter the way through the scanning
right
now the rest of the three quarters is not gonna get any real notes
even though now when he does trust and relax can get rerouted traffic
it's almost all the day isn't the same as fake
I'm using it. tables magic to do this
from this injured
said that I'm so one important things 12 years make sure the
information is different than the real host so it's really easy thing to try to
say like all
what we just make the real host I double dare look the same in that way when he
tries to exploit
like some service that on there that'll just be exporting the fake machine and
other real one
and that's it sounds good but like you to resist out by saying we're not in IDS
right we don't wanna try to do that
because then when you like you can find out that a fake machine many
that's bad from our perspective we want to do is provide
different information on this is this this feature is also possibly dangerous
um since any false positives then turn into and I'll service
it's like if your file server gets determined as hostile that's not just a
matter like your
I'm by your administrator getting like an alert knowing alert
the file server then diskette style service tray like it all his traffic
gets rerouted to these fake notes now you got
I'm so by default this feature is disabled
you also wanna like do things like probably
increase the threshold the pasta cation on him as well
on its really a few channels onto his mother features them sing together
quickly force
I'm so like training like there's a wave in band-like training system that press
the train by
I'm get through a bunch of the dance sare all that trade holiday to you too
saw was benign
and it goes into the system region say all actually I was and mapping in the
middle there in this IP address was bad he was in and maps Q
but that is their data and you can train system
i'm too much for you eyes we've a web interface
the local QT interface and a terminal thats interface through
good for scripting a you can import export trading day to somebody else gets
to know you can like imported export
actually highly multi-threaded and free software force because
use of force would go
I'm not a demo
realized
talk take this
I was gonna fail miserably
are alright so I've gots
I am a few virtual machines running so I got
a a US concealed so got from
a three virtual machines running those to that are victims
is the names are victim 1 and hapless victim to
and and and and map guy hears takes like a minute to run someone ago and started
the side has a pretty to fall from Cape
surprised if all options on a his reign operating system
scan Run with 0 is running the fuzzy
option to say like try to guess the operating system get it exactly since
an operator lee gets a hundred percent result that is just as this
save it to an external file so we can look at another you why
and randomizing posts pretty normal to I'm so he's doing some other things that
worry we talked about before
stickball except seconds answers for seizing up much are packets to try to
find
figure out what machines are out on this virtual network have set up
bomb on my my laptop right now and he's gonna do up
defaults TCP port scan out some other
commonly used ports that are on machines nominees
going to looking operating systems see we're offering sis was running
I'm so this onto a before and after so like this is the
before so this can show you like what can that work actually looks like on the
900 apply for
tool that we haven't seen it looks like rafter hopefully he will finish it
usually takes like 70
to you for four seconds another try this before
ago slicker
the scenes and napkins and maps and I saw front and for presentations like
this
so he's got a few a machines ace on this network
from 26 18 you don't want 62-56 one is my
laptop the host machine stock in that buyers Surana whatever running
I'm presence this is our chat server X these guys you can see here running
empathy
and then 101 is himself
so he doesn't see anything air suspect writers Amy imports and 100's the bike
default DHCP server
the psych virtual boxing set up so he's all the real machines
from and was pretty easy is pretty straightforward and he got all the real
data and now you can start looking deeper into the services and see where
you can explain right
so let's Ron is also like eyeball
logo thing but since when does
to logo's and saw for projects ever have to make sense turn on
system passable
data there cleared out and then I will run the scan
same time it will take a little bit longer
I'm since he has a whole bunch of these fake notes scans well
which kinda but as by design to write a mean I'm taking a little bit longer
in this scam like making the attacker take longer sending more packets
is definitely an advantage for us so we should see actually freeh for the
defender
we should see this guy pick up on that the bad guy
some point in the hill large probably show biz green first I'm green means
these detectives benign arms system has to get a few
packets a bit more information for all finally come to the conclusion that is
bouncing
you know tries to be nice to people before I'm figuring out the bad
I'm sorry popped up their screen POS and that tends to like
first packets this it's really bursty for some reason doesn't like sand
packets like really evenly throughout for some reason sources and easy options
like make it less per city
senator makes it all the more entertaining to watch in demo cassettes
like watching a blinking cursor right now
by just patrol talk over it to I
could you repeat that
can I try I miss that kite tried what to eat no
thinkin quite understand the question
still running sky still running
should come with something more interesting to talk about what's going
on
with areas if I like it was red i guess i maps was
coming to the Enders scanning so he a
like I said we have a system that comes up with a number between 0&1 were zero
is almost surely benign and
one is almost really hostile so here's a appoint 911
something on so it's pretty hostile
in the sky still finishing up scanning now and in a minute
finish a play it's like a show the results
these guys can still talk by the way in like if you're lucky
a pop up and say
you can read that
them
talk to myself RM absecon while I wanna fuck Inc
if I cancel those discussed all look at their output XML
were free to do that Charlotte ago
tougher taking longer
sissy routes not doing a trace route so
tree struck triggered by the way takes a long time and time try to run
trace rats can by the doubles are more Europe you're scanning time for some
reason well I'm
now for some reason it was asked to go through all the different hops doing up
the presentation her
up the connection well I think I look for some other
um configuration options and here the so I can go into
preferences for system and so you can
the define a ser profiles
I'm here hopefully you guys can see what's on screen I'm so you can define
like operating system whatever rights we have like a
when xserver and you can get what you cannot vendor you want she could set the
agenda
under 68 clear and here's though
like a huge database that we found a bug you can add vendors shoes I want safe
secure base
machine right useselect and that'll happen first
I'm 3 I think bytes it is of the
the first half of the mac Address is the vendor area analyst that those
second half it is just random for the individual device as it'll take the
first half as a shirt is a secure base
vendor right and the disk if you're an actor so you can specify it from there
you can set drop rates you can say like I want just pretend to be a wifi link
that
dropped 16 percent all the packets to go buy it I'm
I am to look at
operating system supports and stuff like that she can set
but what ports are open since I just this I want like a particular part be
open or closed
actual service running on it here's the operating system
so somewhere for this is the and map OST be
comes you can pretend to be any operating system that on here so
this is like a lot of offering since pretty much like every device it's ever
been made ever
as IBM like a i ax like every version
sir it's ever been made by them or
Kodak Kodak makes 20 printers course right and network printers
I'm I think
and map is like frozen or something I was just what's the 22 minutes remaining
ones are doing
arianna I know are so I'm gonna cancel I'm gonna run for 20 minutes Seaford
now dan didn't save a file
art so I'm gonna go and I try this again
and I'm scared continuing to come back to it and so I can show you the results
for
I of all the things I could feel it and think that an applicant in 10 shell
correct was not patsy
I think I only have yet might have a questions and contact information so I
got
from my email address obvious you're into
like social networks over Twitter & account for diaspora
that sort of thing are are saw for project
website again is out a project without word on our actual source codes upon get
help
get up slashed a soft on company I work for do this with
on and on RC like I'm coming at us up anytime
marciano RTC channel Nova and ever want to see me in person
I mean Phoenix 2600 to meet %uh First Fridays
our meeting spots archive influx a lot lately so I'm just go to the website
on PHX 2600 .org to you on figure out
we're at and okay into two questions
do you like crazy and a shout out I saw a hand
okay
now the questions like do you agree with DHCP so we can like white list of hosts
on we do away with a feature on that's based off love static
Roger addresses turn into the current incarnation the jewel I'm you can give
no whitelist on an address
say this progress is good like don't you know do anything about to the file
server
but it's not tied to GCB I'm so we could actually go also given a mac Address
on the equally I think I'd be good feature actually on so currently the
whitelisting
all abilities basil I P assault and here
in
this the questions about or liked or like you know
I think urban is it or is like how it is on your system react
around react to or integrate with two or perhaps yeah
this so I guess just brought workout is our system mentor
lycra later in tracked I'm anger just fairly different fundamentally liked or
isn't necessarily about reconnaissance
stores just about I'm trying to hide
like the original location your data so it's Micah privacy tool
I'm whereas like I don't think that necessarily relates much to
major Constance here
I'm so I know that company de
I'm has been run with as many as a thousand 24
notes on a single computer arm and of course that's going to pound on
how fast your computer is on this offer itself can handle at least a few
thousand
I'll reply personally done um are
any
armor sees a lovely running it on ARM
other data software running on our own I'm internal like corporate
internet and we have probably about a hundred and sweet you know half probably
about a hundred fake nose as well
and you know networks reasonably well
though the there's this fun ways of us I'm a working our system like we
we accidentally we're running a test network and we would like
getting new I we've renovate find a new mac address that we do see p for it
and we would like start and stop this whole buncha times were quickly ran out
of disk allegations
arms that was annoying was a few things like that in a week we have to watch out
for
yes sir because
I'm so that the questions like how much bottleneck is the approximate nearest
neighbors like Lost cation algorithm
I mean that's a big bottleneck in terms of computational on
ability right since Aug that's like a pretty heavy duty thing
when she start talking about like the 12 dimensional space
thousands of data points this becomes a really crazy thing on
and it can be paralyzed to a certain extent so that's really helpful
but in by in our current tests I'm we wanna
with on a large bottle neck just like capturing data
it turns out that like having to run CPU cycles on every packet
on when you're receiving like Gigabit Ethernet or more right
don't be a really limiting factor so it Houston the software testing done our
software
in practice it's been the packet capturing that the bottleneck
on this post the cost occasion though in anticipation that we do is we have a
class cation timeouts we say what's only do it
like once every five seconds cost cation or maybe what only do it like every
second and that's configurable
question here me
as the question was like I'm if I can't act was able to get
I'm not your arc data and see like all the arcade it was coming from one
machine
bike with a like would not coming anyway I'm so the
out the machines ago by better at when you when you request like in our
when you are requesting a new
IP address right like case cuz for you deviated
the a DHCP arm %uh of it
Fig missions have their own Mac addresses and so if you're just looking
at data
I'm their to appear to be different machines like they want all be appearing
to be coming from one source
unless you how like several wiretaps across the network right are able to see
every link
and actually see our will all these machines actually are following all down
to this one guy
on which point then maybe the solution is to not run
you know Nova once in one place but to run into several different locations
route to a question for you
p
I'm can we that's the question as I can to can we detect
a fake machine like traffic analysis i'm peter is you saying I come
havana can an attacker tell the difference between a real no fake
machine
base of traffic houses so one of the things we don't have right now
that we arm as a feature in the future is I'm to make
like data like ShopRite like to have these fake notes
sending data out amongst one another also may be too fake machines
oh I see what you mean like some like the figures in houses like that they're
saying
data back to the attack right maybe there's a latency involved with it like
maybe like the fake machines like how 10 some other signature I got I'm
I we tried to look for that right I mean but like bike
kinda definition is only so much that I can do on SATs the sort of thing that
we're hoping to get from the community
is like maybe there is some super easy thing like half a second
place is always added on: from over fake notes and that's that smaller billy
wright that would be bad if that were true
I'm susser I can't give you any par de sac know that isn't true
but yeah hopefully we can get a some from the crowd actually see for
you see really quick at this and mapping finished
nasty all that matters art so nice
no I think I turned Art Walk
assault she's my time
are
and I think it's all you have time for talk