Yesterday I gave a
talk
at the
O'Reilly Open Source Convention (OSCON)
entitled
Iptables Attack Visualization. Slides can be downloaded
here.
This talk concentrated on the new
Gnuplot interface
available in
psad-2.0.8, and example visualizations of data
provided by the
Honeynet Project were presented.
Both two and three dimensional points graphs can be generated with psad-2.0.8, and these
are useful for graphing large data sets; the Scan34 challenge from the Honeynet Project
includes over 170,000 lines of iptables log data. Also, link graphs produced with the
psad interface to
AfterGlow were presented.
These graphs are great at expressing relationships between IP addresses and activity such
as outbound connections from the Honeynet.
Here is a sample graph of Slammer worm traffic (404-byte packets to UDP port 1434) in
the Scan34 challenge data set (seeing the spike in worm traffic is extremely easy with
a graph):
Other activities are visualized in my talk (including port scans, port sweeps, and Nachi
worm traffic), but some of the most interesting log messages show outbound connections
from the Honeynet over SSH and IRC, and these are clear indicators of a compromised
system. Here is a link graph visualization of such activity with the AfterGlow project:
With psad-2.0.8 released, you can graph all of that iptables log data you have laying
around on your system, and sometimes some interesting outliers can show up that
indicate malicious activity.
At the SOURCE Boston conference in Boston
last week I gave talk entitled "Advanced Linux Firewalls"
(slides). The conference
attendance was good considering that this is the first year the conference was
offered, and I look forward to next year.
I managed to see a few talks, and two that stood out from the crowd were
Roger Dingledine's talk "How To Make
Tor Play Well With The Rest Of The Internet",
and Andrew Jaquith's talk
"Not Dead But Twitching: Anti-Virus Succumbs to the
Scourge of Modern Malware". Roger highlighted several technology research
and development areas for the Tor project,
including the ability to use UDP instead of TCP for Tor virtual circuits.
This is of particular interest to me, since it would mean that
SPA packets could be routed over the Tor network without having to resort to
the establishment of full TCP connections (which breaks the "single packet" part
of "SPA"). Andrew gave some interesting perspectives on malware trends, including
the fact that malware over time is becoming more targeted while at the same time
exhibiting high variability. The end result is that malware authors are able to
attack the weakest link in the creation of signatures for malware detection - the
people that reverse engineer malware. Because human resources are scarce and slow
when it comes to reverse engineering (there is no fully automated mechanism for
this yet), malware authors are able to essentially perpetrate a DoS against
vendors that offer malware detection.
The iptables logging format provided by the Netfilter project contains a wealth
of detailed information about network traffic. Nearly every interesting field
in the network and transport layer headers is logged by iptables. By combining
the graphing capabilities of 
