Blinkie Lights: Network Monitoring with Arduino

Video thumbnail (Frame 0) Video thumbnail (Frame 1028) Video thumbnail (Frame 11310) Video thumbnail (Frame 14628) Video thumbnail (Frame 16534) Video thumbnail (Frame 17635) Video thumbnail (Frame 21794) Video thumbnail (Frame 24515) Video thumbnail (Frame 27268) Video thumbnail (Frame 28819) Video thumbnail (Frame 34063) Video thumbnail (Frame 36595) Video thumbnail (Frame 38053) Video thumbnail (Frame 38951) Video thumbnail (Frame 43219) Video thumbnail (Frame 44450) Video thumbnail (Frame 46282) Video thumbnail (Frame 47187) Video thumbnail (Frame 48559) Video thumbnail (Frame 49810) Video thumbnail (Frame 50945) Video thumbnail (Frame 53834) Video thumbnail (Frame 55292) Video thumbnail (Frame 57047) Video thumbnail (Frame 58042) Video thumbnail (Frame 59355) Video thumbnail (Frame 60399) Video thumbnail (Frame 61670) Video thumbnail (Frame 63093) Video thumbnail (Frame 66423) Video thumbnail (Frame 68090) Video thumbnail (Frame 69807)
Video in TIB AV-Portal: Blinkie Lights: Network Monitoring with Arduino

Formal Metadata

Title
Blinkie Lights: Network Monitoring with Arduino
Title of Series
Author
License
CC Attribution 3.0 Unported:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Identifiers
Publisher
Release Date
2013
Language
English

Content Metadata

Subject Area
Abstract
Remember the good old days, when you'd stare at Rx and Tx on your shiny new Supra 1200bps modem, and actually know what the heck was going on? Systems tend to talk a lot more nowadays, and somewhere along the line I completely lost track of who mine hangs out with. And I kind of miss my blinkie lights. But we live in a world of Arduino and cheap LEDs - maybe there's a way to play with electronics, talk about security, and show the kids a thing or two - all at the same time. Imagine if one of those USB toys on your desk could actually give you an indication of which countries you were trading packets with, or alert you to unusually long-running sessions. 'cerealbox' will demonstrate how an 8x8 multicolor LED matrix, Arduino, and a network monitoring program can be used to make an LED-based sniffer for around 60. And if that doesn't sound interesting, just wait until you see Port Scan Inferno. Steve Ocepek was one of the original team behind Wholepoint, a computer security consultancy that later merged with Trustwave. As Director of Security Research for Spiderlabs, he is in charge of all signature development for all products, maintaining and updating open source projects, researching new threats, providing intelligence to premier clients, pursuing security advisories, and supporting other SpiderLabs teams during technical engagements. Ocepek's accomplishments include discovering and patenting a new method of detecting wireless clients from the wired network, as well as creating the "thicknet" framework to analyze protocols for Man-in-the-Middle attack surface. He has a featured as a keynote speaker at industry conferences such as Blackhat in both the USA and Europe, and OWASP AppSec. Ocepek is a Certified Information Systems Security Professional (CISSP) and a member of Northeast Ohio Information Security Forum.
Software Real number Computer network Bit
Existential quantification Presentation of a group Scheduling (computing) Serial port Multiplication sign System administrator Real-time operating system Solid geometry Medical imaging Sign (mathematics) Different (Kate Ryan album) Cuboid Information security Touchscreen Broadcast programming Feedback Keyboard shortcut System administrator Solid geometry Hecke operator Connected space Cognition Right angle Quicksort Information security Modem Asynchronous Transfer Mode Slide rule Trail Game controller Computer file Link (knot theory) Variety (linguistics) Computer-generated imagery Virtual machine Mathematical analysis Rule of inference Internetworking Natural number Energy level Normal (geometry) YouTube Metropolitan area network Arithmetic progression Modem Weight Expert system Mathematical analysis Theory Planning Computer network Line (geometry) Extreme programming RAID Word Software Visualization (computer graphics) Intrusion detection system Physical constant Communications protocol
Cognition Service (economics) Differential (mechanical device) Multiplication sign Computer-generated imagery Tap (transformer) Set (mathematics) Real-time operating system Neuroinformatik Pie chart Fluid statics Different (Kate Ryan album) Term (mathematics) Visualization (computer graphics) Directed set Data conversion Game theory Metropolitan area network Email Simultaneous localization and mapping Forcing (mathematics) Expression Graph (mathematics) Projective plane Variance Bit Term (mathematics) Cognition Connected space Word Visualization (computer graphics) Video game Condition number Right angle Peripheral Quicksort Cycle (graph theory) Videoconferencing Spectrum (functional analysis) Arc (geometry)
Operations research Dataflow Cognition Real number Archaeological field survey Mathematical analysis Continuous function Sequence Symbol table Cognition Sequence Logic Operator (mathematics) Telecommunication Pattern language Pattern language Right angle Aerodynamics
Computer program Touchscreen Existential quantification Pixel Multiplication sign Survival analysis Real-time operating system First-person shooter Vibration Mechanism design Pattern language Cuboid Volumenvisualisierung Physical system Pattern recognition Touchscreen GUI widget Feedback Bit Pattern matching System programming Volumenvisualisierung Pattern language Peripheral Quicksort Spacetime Laptop GUI widget Real number Graph coloring Computer icon Sound effect Revision control Goodness of fit Peripheral Surjective function Focus (optics) Information Forcing (mathematics) Mathematical analysis Variance Computer network First-person shooter Cartesian coordinate system Word Maize Software Network topology Matrix (mathematics)
Point (geometry) Computer program Dynamical system Statistics Reduced instruction set computing Run time (program lifecycle phase) Flash memory Chaos (cosmogony) Data storage device Graph coloring Fluid statics Hooking Whiteboard Telecommunication Hacker (term) Befehlsprozessor Computer hardware Static random-access memory Matrix (mathematics) Integrated development environment Data structure Modem Default (computer science) Serial port Static random-access memory Projective plane Serial communication Code Bit Mereology Limit (category theory) Reduced instruction set computing Type theory Word Befehlsprozessor Fluid statics Software Computer hardware Telecommunication Video game Whiteboard Matrix (mathematics) Window Spacetime
Touchscreen Existential quantification Pixel Code Java applet Multiplication sign View (database) Source code IP address Bookmark (World Wide Web) Fluid statics Semiconductor memory Hash function Static random-access memory Matrix (mathematics) Cuboid Process (computing) UDP <Protokoll> Information security Library (computing) God Email Touchscreen Static random-access memory Point (geometry) High-level programming language Serial communication Electronic mailing list Maxima and minima Formal language Connected space Array data structure Process (computing) Hexagon Green's function Right angle Physical system Programmschleife Row (database) Point (geometry) Random number Table (information) Link (knot theory) Flash memory Virtual machine Online help Graph coloring Coprocessor Code Transcodierung Twitter String (computer science) Green's function ASCII Address space Metropolitan area network Game controller Electronic data processing Serial port Inheritance (object-oriented programming) Code Number Pointer (computer programming) Table (information) Communications protocol Library (computing) Address space
Touchscreen Mereology
Scripting language Emulator Execution unit Serial port Open source
Touchscreen Pattern matching Closed set Multiplication sign View (database) Analogy Website Right angle Quicksort Shareware Number
Scripting language Type theory Code Real number Intrusion detection system Real-time operating system Parameter (computer programming)
Server (computing) Key (cryptography) Code Plastikkarte Bit Open set Connected space Web 2.0 Uniform resource locator Mathematics Googol Software Website Window Modem
Mereology
Scripting language Data model Mathematics Telecommunication Transport Layer Security Data storage device Data storage device God
Metre Asynchronous Transfer Mode Functional (mathematics) Metre Type theory View (database) Different (Kate Ryan album) View (database) Matrix (mathematics) Equaliser (mathematics) Position operator Asynchronous Transfer Mode
Metre NP-hard Computer program Term (mathematics) Code Asynchronous Transfer Mode
Game controller Link (knot theory) Computer file View (database) Equaliser (mathematics) 1 (number) Public domain Rule of inference Web 2.0 Direct numerical simulation Matrix (mathematics) Local ring Enterprise architecture Addition Email Matching (graph theory) Menu (computing) Line (geometry) Arithmetic mean Video game Right angle Remote procedure call Whiteboard Communications protocol Local ring Row (database)
Metre Computer program Empennage Game controller View (database) Code View (database) Normed vector space Graph coloring
Computer program Server (computing) Touchscreen Local area network View (database) Structural load Virtual machine Denial-of-service attack Number Web 2.0 Direct numerical simulation Computer configuration Flag Quicksort Local ring
Metre Web 2.0 Direct numerical simulation Existential quantification Different (Kate Ryan album)
Web page Point (geometry) Link (knot theory) Hooking Website Right angle Communications protocol
Message passing Multiplication sign Quicksort Graph coloring
Message passing Computer file View (database) Right angle Graph coloring Communications protocol God
Noise (electronics) Call centre Existential quantification Zoom lens Letterpress printing Mereology Cartesian coordinate system Neuroinformatik Software Pattern language Right angle Information security Metropolitan area network
Metre Trail Asynchronous Transfer Mode Link (knot theory) Online help View (database) Information overload Information overload Mereology Coprocessor 2 (number) Number Neuroinformatik Connected space Mathematics Message passing Personal digital assistant Computer science MiniDisc Right angle Electronic visual display Message passing Metropolitan area network Asynchronous Transfer Mode
Mapping Sound effect Right angle Asynchronous Transfer Mode
Point (geometry) Asynchronous Transfer Mode Scripting language Serial port Open source Code Weight Logic Cuboid Communications protocol UDP <Protokoll> Message passing Scripting language Game controller Serial port Information overload Code Hecke operator Maxima and minima Bit Open set Message passing Software Figurate number Window
Revision control Computer program Link (knot theory) Link (knot theory) Website Right angle Computer programming Library (computing)
so got the guy talked about freaking blinky lights today I'm gonna be talking a little bit about how to do something kind of off-the-wall network monitoring with Arduino I always want to play with electronics and get some stuff going with blinky lights and I've always been just a real fascinator kind of one of those people sit there and stare at the at the switch watch the lights kind of turn off and on and just kind of get mesmerized I don't know what the deal is with me but stop lights whatever you can pretty much just just get me to stop what I'm doing if you you know put something in front of me that's that's turn on and off so my name is Steve Steve was epic no Steve so this is my this is my talk just a quick note the
quality of some of the images in the presentation are of the homemade variety because of some legality reasons for not allowed to use the copyright images and things of that nature so i do apologize in advance for for some of the quality here so so just kicking right off so this is kind of where I came from right the the idea of modem Inge and there used to be kind of this concept that you could kind of see what the heck you were doing while you're online you had rd and SD like kind of original like blinking my favorite blinky lights in the world which meant actually rd was always the best because it meant you were downloading something so there was this kind of visual cognition tactile feedback pride tactiles wrong works I think it's like physical whatever but it's like a feedback kind of like I do something I push something on this you know on my keyboard I see it on the screen and then I know what's going over my serial port going off the phone line because I see this kind of blinky light thing happening right so then a lot of stuff happened from then so progressing through time I kind of just took arbitrary things out of the the history of network King so I think like there was like 56 k and then net-net splosion thank you i think there was like explosion of net internet stuff and then youtube was somewhere in there and a bunch of other stuff and a mobile and now there's a cloud and that I think he's like smoking a cigarette I got one of these like disclaimers hear about that you shouldn't do that but it's like a it's um so it's it's kind of like this lot of stuffs happen right the whole idea of this slide I think I think this what I was thinking was basically stuffs a lot faster tcp/ip protocol diversity it's it's not just as simple as already an SD anymore because your tech talking a lot of a protocols letterford host a lot different stuff going on the same time it's a very very chatty thing we got going on somewhere along the line we sort of lost track of what our machines are doing it's just and and so we've got this you know this idea this link light we also have like connection pools longer sessions stuff like that I don't know what the hell my machines do anymore right and and yeah might you know I like my netstat hurts I'm actually thinking about getting a bumper sticker says but that I guess the the bad sign is when a two-minute pcap file is larger than a two minute mp3 I think we have some serious stuff going on the wire so it all comes down to the fact that dude the activity light is solid man it's just not basically we have one LED right it's like a total missed opportunity because you got like this one LED and it says something's happening and so you do it's like is something happening it says yeah something's happening it's like solid it's like that's all we can ask that's all we can that's all we really know so again I really apologize to this especially for this especially like whoever's involved because apparently whoever takes pictures these guys copyrights their images too but the basically it comes down to this Richard bait lick and Bruce Schneier if you want it if you want you know if I want to legitimize what I'm doing up here the industry experts are saying monitoring first monitoring first on the grassroots most lowest level is what we're talking about here which is the the little blinky lights on the front of the modem you know monitoring first if you take it to its extreme is kind of knowing what the hell your machine is doing at a time the actual quote from Bruce by the way those are muscles I want to make sure you knew he had a shirt on there okay that's but but basically what Bruce Schneier said in cryptogram actually 2001 about ten years ago monitoring should be first step in a network security plan something administrator can do today to provide immediate value so that makes me feel a little more legitimate in this talk but basically that's the concept right if you know what the hell's going on you can do something about it and I think we skip monitoring we go right to enforcement I know that's what happened you know with network access control I was in that business for a long time and we would come into networks and say hey we're going to kick everyone's ass and that's not supposed to be here week everybody off and and and you get them all fired up and and people would come up with these really cool rules it sounds really nice like hey if they're transferring this much fun you know this much data at this data raid at this time of day then kick their butt and then the CEO would come in be on its way out of town at 9pm try to copy the the presentation down for the boardroom and get kicked off the network and everybody get fired and we'd lose the account so the so the idea is that why is that why did that happen why do people want to enforce before monitoring right that's kind of goofy because if you're monitoring you know that that kind of stuff happens you'd know that that rule is crazy right we try to create this kind of big brain that says oh we're going to feed this brain all its data and then the data it's going to learn and it's going to understand your network better than you do and then it's going to make these kind of interesting rules you know if you take it a step farther and you're talking about some of this you know the learning mode and things like that don't get me wrong I mean we need that stuff we need to make it better but we need to also understand what the heck's going on so you start talking about monitoring and it's like we'll wait a minute we have all this cool stuff and I you know I on the side I like to write these little miniature screenplays and throw them the trash so you get to see one so basically you mean like IP SIDS snacks sniffers scrapers yeah okay and then no I mean like what the you know okay yeah WTF the box is doing right and then yeah but try Wireshark newbie and then it just kind of devolves from there I don't really know what happened after that but there's something about the fact that wireshark is for analysis and then I don't think that has any value at all but um but basically the so the idea is that Wireshark the takeaway is it wire sharks for analysis okay and not for the kind of thing I'm talking about which is this real-time kind of tactile I keep using that Miss using that word but this sort of real-time feedback that you're getting from from the thing to like the
old days right something it's good excuse for add we know it sounds good on a DEFCON schedule freakin blinky lights it's okay and of course something gives you visibility so now i'm going to start butchering some other words okay
visibility vs. visualization I don't know there's no this is me talking about trying to figure out how to do like the differentiation that's not that these words totally you're going to look them in the dictionary and they have this does the this difference this is just me kind of trying to express something but I'm going for some of this peripheral okay I'm talking something that is going to tap in your cognition okay cognition talk about that in mail in a little minute a little bit here I'm making up my own distinctions but visualization I'm thinking of as like the Wireshark right i'm thinking of visualization as maybe even these beautiful graphs that do stuff and they're like big pie charts and and top kyle looking things and and all sorts of beautiful things you do with static data sets because you have a lot of computational time to kick this thing's but right you have like a big bunch of data and you've always cut all these cycles and you can visualize something statically i'm trying to go for something a little different on the other hand the spectrum which is like the real time stuff okay so it's more tactical military term visibility is thinking about i used to i think my closest stint with the Navy was playing secret service on the converse 64 so it was like it said visibility low visibility poor and then like battleship would sneak up on you and kill you and then I load the trainer and kill everyone else but the the the thing was that there's this idea that you only have a certain amount of this ability only a certain amount of ability to react to what's happening based on what you can see right so visibility visualization taps into our ability to reason right to figure things out it answers questions visibility might our visualization excuse me might like it cause us to it might answer questions visibility is more like it taps into our cognition okay and maybe it causes us to
ask questions I only sort of know what I'm talking about real-time cognition but examples are driving like video games and like things like sports and I just kind of realized that's probably like a really bad thing to bring up at Def Con but but the but basically yeah so so so it's like the real time kind of like why are you good at sports it's not because while i sit down i get the basketball and i sit down i project the the arc and i'm going to exert the right amount of force to get in the basket it's because I don't know man I just that's what I do right I just whatever it is they do in basketball I just like slam on those guys all day or something it's like the one where they yeah okay so so direct connection between the senses right so it's because you're able to like react to something you're able to see it it's a corner your I being able to do something about it right it's the same a video game a little sniper and you know whatever you can you can get really good at that but you're not thinking about yours doing it it's acute perception of sight variances in stimuli which sounds like freaking awesome here's the scholarly reference
that it I think this means what I think I'm talking about which is real-time cognition is best described not as a sequence of logical operations performed a discreet symbols kind of hanging in there on that one but as a continuously changing pattern of neuronal activity so I when I take away from that this poor Michael Spivey who got cited at Def Con and Rick Dale of University of Memphis and Cornell University there you go what I take away from that is it's a flow it's not so much that you stop doing something it's not like a chunked up like general analysis is it's more like this flow it's like this tie end to human stuff so with that that's enough of that crap let's play with electronics
all right
so this whole USB think so um it's going to light up here in a minute I'll show you the idea of these peripherals I thought well if you have things like you know USB sniff shooters and ninja detectors and LED christmas trees it's this huge market like thinkgeek makes you know a lot of money on this stuff if you have all this stuff thats hanging around your desk maybe that's the place to put this I started off this idea actually a while ago thinking that I was going to put it in some little window in the side like like you put in maybe a little square something somewhere on the screen and that's all well and good except every stinking application just is like a it'll just grab focus from you all day long if you ever try to preserve something on the screen unless unless you tap into some sort of OS call like stay on top or you know whatever that you know you're not going to you're not going to be able to do that it's just it's going to get clock it's going to get thrown away there's also like the dashboard icons and stuff like you could flip to dashboard but that's not always there right you have to hit the dashboard button dashboard pops up and I don't want this big flashing thing it says you got you know you got owned like 20 minutes ago you know I'd rather have something there's also like little widgets in this in the system tray where you have about five pixels to work with so I thought you know I want something on the desk because look there's a lot of room around the desk where the laptops it's ok there's election actually a lot of room there so let's that's a good reason another good excuse to do something with Arduino the crazy idea is I want to render network data on LED matrix a real time ok I want to use things like color of motion stuff that I can do any creative whatever thing I can I can somehow put together to to actually show what's happening I want to get a feel for it I want to tap into this pattern matching people real good at this I mean it's like that thing where something's wrong with the car I'm terrible at this stuff I'm not a mechanic many stretch the imagination but I know that you know if something's going on and I turn the wheel certain way and I get this a little bit of vibration I get this a little bit of feedback I I noticed that it's different you know maybe there's some cars that move a certain way and some you know and you can get just you you just naturally sort of take in how this thing's working when you start driving around you you know whatever and it starts vibrating you know hey that's different I think goes back the cavemen it's like they came out and there's like seven Buffalo out there and then they came out at the same time next year and it's like there's two buffalo out there and it's like dude it's time to get the hell out of here you know we got to find more Buffalo it's like this pattern matching it's actually based on our ability to survive I think it's a survival mechanism to be honest with you so cereal box is the
name of this thing nope no cute name anything the word cereal box like the cute version with SE RI al was taken by some I don't know something of a 90s some other program so I just like well how it's got cereal box and the reason I call it that is because I know how many people in here like have read the back of cereal boxes I mean do you guys kind of know what I mean I see some hands are like nodding yeah I know what you mean I mean it's just the most inane on the back of those things you know it's like why the hell am i doing the maze to get like you know the cocoa bird or whatever to the freakin you know so we can get his hookup at the end of this I don't get it you know but I do it why why do i do this to myself when the reason is honestly the reason is because it's there that's why i wish i could tell you something smarter than that i wish it was i wish i could actually say that it's because I don't know something to do with my childhood and and something that had to do with you know market analysis but nets just because they're okay and and the the thing is that we're big on that if it's there we'll play with it and that's what I want I want this thing to be there right I want to be in the background I want to be something we can kind of see out of the corner of our I that's why caught by the way cereal box okay so you know so pattern detection it lets us see the variances without digging in it's just enough it's just enough information I can't I mean I got you know I'll show this here in a minute when i get it doing stuff but I've got this much space to work with okay I've got a tiny tiny little bit of space to work with so I can't do all the things i would want to do I can't see all things want to see but maybe that's good may that's fun force me to think well what do I really need to see right so I base it on the
Arduino Uno which is real cool as a little bored based on a ship called the atmel atmega328 I'm not a hardware hacker I am stressed imagination these tools are really nice makes it really easy to do this stuff it's an eight bit risc cpu it's 16 mega hertz so pretty powerful but i'll tell you it's got 32 pay a flash which means that's how big your program can be once it's compiled but it's only got 2k it's got 2k of SRAM which is a real real interesting thing especially if you're going to do anything you know kind of higher-end you definitely will push that pretty much with any project you do to chaos Ram what that means is you know that's how much space you actually have to actually do your stuff right that's where you destroy your s where you store your dynamic data structures your static data structures those can sit in flash you can access those at runtime but your stat at your dynamic data structures which of course network data is anything you know it's if anything it's dynamic you get to store that in your in your restroom usb-powered there's a serial communication with a chip it's cadets it's the atmega you to that the only reason i bring that up there's no hardware handshaking so those of you go back to the modem days it's like I'm sitting here in 2001 I'm telling I'm talking about this hardware and an RTS cts would be like a feature I almost had to write x onyx off on this thing but I could as you know you can't I mean I'd have to flash the the thing and I don't know how to do that so basically I just made it run kind of slow i decided well at that point I remember 9600 baud was pretty good it's a pretty good you know that's that's the speed that it's kind of rated at or comes that by default so I just figured well anything I do I'm going to keep it inside of this window one of my limitations is 9600 baud you can get that for about 30 bucks there's
also something called a color shield this is a really cool little thing this is a something that the things for a do we know are called shields so when you see the word shield that means that's an ad on board for the Arduino and this one is a that has a chip on it to control LEDs so it makes it very easy you'll see a lot of if you go on to youtube and you type in Arduino LEDs you'll see a lot of wire wrap and bread boards and stuff where people are doing a lot of cool stuff there but they're having to do it all manually and hook all the stuff up together this makes life a lot easier if you're going to play with with LEDs blinky lights I teach studio sells it for fifteen dollars it's and they also sell a multicolor LED matrix for about 21 so at the end of the day we're at about 66 bucks for this so not too bad i mean if somebody picked this up and started making a whole bunch of them mass-producing probably get down really cheap you know probably produce something like this for 10 bucks or something but for hobbyists electronics you know that's not too bad and you can
do a lot of other stuff with this is the nice thing you're not just stuck with whatever this is so the design goals have to be simple have to i'm going to send stuff from the host the host of course it can't sniff it's just us be so i have to have a sniffer on the box on my own box but then the sniffers going to send that data whatever whatever data i'm interested in over the serial link and it's gonna it's going to render it on the yard we know cereal box the code that's right i'm going to do arduino is in charge of rendering that to the screen okay that's its job its job is to render anything i send it to the screen I don't have to ks ram minimal data process saying should be easy I want you guys to be able to play with this the source code you already have it this is kind of fun I don't know if you know this you already have this it's on the the source code for it is on the DEF CON DVD so you actually have it right now so I was hoping I'm kind of glad that not everybody got up and left I thought maybe that was going to do it so I saved it to the middle but I think I think we're okay so data points here's what I'm sending MAC address IP address tcp or UDP port and country code here's the light here's the what it looks like okay this is so i can say i wrote my own protocol but really all i did was i just took like one was open to his clothes and then I just put a bunch of other stuff in hex separated by commas so if you could call that a protocol yeah then so what I'm trying to show off in front of the girls i say i wrote my own protocol but really you you guys know the truth just it's just nine it's just that many characters however many characters that is across serial link all that stuff's already there by the way they succeed good enough I know you guys are getting antsy to see some stuff so by the way text processing and see this is the kind of thing that where I'm kind of a purist and I always think well or I think of myself as a purist which is probably completely false but I think of like man why do we have these high-level languages like Java and Ruby and all this stuff when I could just be pregnancy and I it's like the good old days and I really really want to like just take advantage of every little register on my processor and do everything like super fast and and you kids these days and all that kind of curmudgeon e stuff but the but then I then you actually sit down it's like ok rock star now you have to process a string and see right and it's like a son of a bitch so the so this is this is the thing I mean you should see a lot of this kind of stuff it's probably full of God knows what a security you know something's going to look totally pone your cereal box but but it's it's a yeah you know it's basically just taking one one character at a time going through the ASCII table I have ASCII table in calm or whatever in my bookmarks now and just staring at it so this is the cool stuff color dunya library it's huge help and dealing with the LEDs setting an LED so for those of you hon just try to figure out how to do this very simple there's some there's some basic code there to do it if I when he set coordinate 3x 3y 82 blue i'm going to do set pixel directly or I could do it using a pointer and do increment I didn't write this this is by this dude link lomatic and he's awesome i sent him an email let him know i'm going to be doing this talk so i said some recording of this but i was just very impressed with it's very very cool library this is
something i did this is this was kind of my contribution right where i had this problem where i couldn't i only have 32 k a flash and 2k SRAM I didn't want steris or a big static table in memory to convert recode you're going to see why this is important here in a minute to RGB values so what you're going to see is one of the views there's two views i'm going to show you one view is going to show you all the connections that are on it's going to fill up the the matrix the LED matrix with all the different country all the different sessions that are being done by the machine it's going to color code them according to what country using geoip what country I'm talking to okay how I did that was basically took the country code and using the random thing that's inside of see I just kind of made up a color on the fly the random is pseudo random so it's not really random it's always going to be the same so once you learn the color for a country and oddly enough us was Green so I thought that was kind of interesting but that some other countries were red when you'll find those out on your own but it was kind of apt I'm just saying so it's just the way that it worked it you just sort of realize how that basically yes this is the only bats us because I've memorized that it's not I don't even have a list I couldn't give you a list i would have to actually send all the country codes to this thing to give you a list of all the colors it's going to do it on the fly but it's always going to be the same and then so yeah the first letter turns to green the result in green the trends in the blue and all this stuff so okay so
now is the part of talk where I try to show you how this works first what I'm going to do so here's the challenge as you can see I was wearing a shirt there don't let him fool you okay it's just v-neck something it was it was late at night you know but there's my main problem you can't tell what the hell's going on there right I mean the whole thing is that there's it's it's it's all blown out so this was the challenge I was like how am I going to go for a DEFCON i'm going to show these guys how it's worked so i'm into two ways i'm going to show it on there and just kind of do the little hold it up like show-and-tell in front of school thing and then I've got a movie that will show up on the big screen we I had a found this whole camcorder it's like the only way I could do this the old camcorder had like a exposure switch and I could turn the exposure way down actually looked real good so but me it's now this i work this out with the AV guy
we'll see if this works here okay cool
so let me jump over here here's what I'm
doing so that basically this is a perl script comes with it's also on the DVD I'm doing pearl may make this a little bigger pearl debts pearl CB PL it gives you usage if you don't not do it they interface the IP the source IP and the
actual serial port that it's going to
talk to so remember thus going over serial it's actually serial emulation over USB I guess it's not really emulation its actual serial but so
parole CB PL blah blah blah and get that going and then from there I'm down here I'm just this is thus i'm doing the tcp replay things so what should happen if we're lucky and the demo gods don't frown on us there we go ok so what's happening here is I'm doing a tcp replay from some stuff some pcap stuff i recorded and what's happening is every time something comes up it's going to render it to the screen actually i think i picked the wrong one but you can kind of get an idea of what this looks like actually i think this is about to freak out i picked the port scan one I think I think the port scan one yeah I picked the port scan one so it just kind of well ok now so you spend sixty six dollars on this thing and everybody comes by your desk in like really seriously ok so let's try another one that's not quite as crazy as that actually I stopped the wrong thing I work through this stuff like 20 million times and then I get up here and crap all over myself ah let's do browsing browsing sounds good so let's start start up our our Damon again it's real simple to reset itself if you stop it does give you a feel for you know playing around with this stuff and how this works so don't worry guys in the back we're going to show it on the big screen here in a minute but just to give you sort of a feel right again it's hard to it's going to be much better on the screen because in the screen you can see what I'm doing and there's this analog remember this all about comparing and pattern matching but what's happening is as I connect to different websites the lights are turning on lights turn off as connections open and close or turning here we go you know here's some more some more and it just kind of floating around like that so that's view number one this sits on your desk you have 128 520 lights actually it's two screens of 64 so if you go over 64 what will happen is and hope not under serving anyone here this a kind of a wide room but the the lights will if it goes over to over 100 over 60 for you'll start getting two different screens it'll switch back and forth using a timer so I'll just set that there and let it sort of just see it's kind of like active right now like I was doing a whole bunch of stuff there so its just oh there's some blue there's some blue there it's there it flipped over to the other screen okay so you see I get really excited about that I have a hard time set it down so now we'll show the movie and the movie will help let me see here so first one is the session
this is we're doing the session view so
again very similar to what you just saw
in real code in real time so zooming in
here this is the Arduino IDE okay so this is going to this is where you type the code if you want to write code I mean you can type in whatever you want but this has the upload button is actually handy you know you push the upload button you send it over to serial and then it flashes the Arduino with the code from the thing so then coming over
here there's our perl script thing again you just fire that off really the only argument is just going to set up and then from there I'm gonna pan down and this is much easier on the eyes you can see the little guy start to fill up
there so there's some stuff going on so if your network card was a giant modem and it had LEDs on it I think this is something like what it would look like
and so then i zoom out a little bit and you start seeing where I'm browsing the web and do another stuff I'm trying not i'm trying to be cognizant that this is
pretty impressive ended at DEFCON so I'm going to like kind of unoffensive sites and things that don't have my session key in the URL I also cleared out the google search window ahead of time and
so yeah pretty much pretty boring stuff here but there is something coming up that is particularly interesting um as far as like the the country code you notice everything is green so all the stuff I've been going to is in the US so here in a second it's going to go and we just kind of keep talking it's going to go to another country and we'll see how the lights kind of change so you notice that as it's just sitting there nothing's happening this is kind of interesting interesting to me anyway that you know these these connections stick around so I'm going to do up they all went away that's just the way the web servers work right they have that connection open thing you're connecting to Apache it's leaving the session open for a while it's preserving his connection pools here we go some blue some blue you're going to tell other
people others talking to be like there was this part and he hits something it was blue it was awesome and so that's
because i went to BBC UK so you see there's still smattering of other things it was like green and blue and Tiger Woods on there and then there's a guy the frowny face so I had to click on him
and so and that wasn't at all what I was expecting by the way so basically this
is the thing right this is the session thing ok ok so that's cool now back to
and see if I can get back here this is going to be the trick
cool okay so data storage so how am i doing all that well I do sort an array I do it does have to know see I was trying to make it as stupid as possible i was trying to make make arduino stupid as possible is trying to make Perl scripts to as possible i just want everything to be stupid right i was just try to make everything stupid so I couldn't do that because they're doing oh how to be smart enough to know when I say close where it's at right I have to be smart enough to know that I'm going to close the the session so how did I do that I store the IP in the port in array there's nine bytes per array had to do the math came out to like 1.2 k I was like oh my god I took up 1.2 k that's such a beast it's like bloat bloated where you know so
there's the array multidimensional that awesome say multidimensional it's different positions of the LED matrix and then I've got a little to hex command I wrote in there a function to convert this stuff over so that's some code their meter mode so i said there's two there's two views meter mode is the next one let me go ahead and show you that think about so this is the other thing i was thinking and and again the
main thing here is you just try to get you being creative i mean the whole idea this talk is okay i did the session view i did the meter mode I want you guys thinking or somebody smarter than me to San hey what about this but mode what about this view what about this view and it you know it's all kind of stuff we could do so this is and this is still in
here this is you know I just realized
this is still running right so i probably lost most of you probably staring at that thing you know it's just distracting oh here we go so meter mode
alright so now we're going to upload the
meter code there's two different programs i originally had them combined into one program one thing was that when i combine them in the same program i think i ran out of SRAM you don't know except that the blinky lights start doing like some kind of stroh be you nasty thing I think is this scientific term and it just like I'll tell you what when this thing freaks out it freaks out hard it's kind of cool because I want to go back and just see
all the different ways we freak it out okay what this is what my recording self is trying to show you here is that the different the different things you're going to see think about a equalizer view out of like the out of like the the 80s or something like like you're like your old stereo system you know it was really cool when you got a stereo system and all of a sudden that shows up and it's like wow I can see the notes like I see the base so I can see all the trouble I can see the notes and they're jumping up and down of course that's another that was a whole nother stage in my life right where i sat in front of one of those all day so so this was this was where I kind of took it which is this stuff here we've got eight so if we got an 8 by 8 matrix we got eight lines to work with so I'm going to define web DNS remote Mayo file so these are different things so web traffic 8443 DNS traffic remote protocols like rd pssh mail stuff like pop3 and smtp file protocols i also put like Kerberos and things you would use to like get logged into your domain controllers or whatever in there so enterprise file sharing whatever stuff and then if it doesn't match that it's in under ten under ten is exclusive with those other things if it's some of the other port under 10,000 other 10,000 don't mean under finger or whatever was but under 10,000 is prime completely wrong somebody like no it's not 10 I'm gonna somebody do it so under ten ten under ten thousand and then over 10,000 is going to be the other one and then local is the only one that will pop up in addition to the other ones because if it's on local link then it'll it'll fire up there so that's that and actually you know what I'm gonna do I'm
kind of getting out of my own my own rule here what I'm gonna do before I do that is upload the I'm going to upload it to the board
we're playing with here so I'm gonna control see that I got to get off of the cereal before I upload the code there or
bad things happen so this is my other program originally I had them both like I said originally Adam combined there actually is a way to combine these you can do that it's possible it's definitely possible the thing is that the I didn't like the fact that my session view was getting clobbered by my meter view so here's the meter view okay to give you an idea each of these be in different color the colors we just looked at you can define them however you want the code but basically those little guys are going to jump up and down based on what kind of traffic you see so let me run same really it's the same I could do the same tcp replay
thing let's fire this up again it's going to reset turn on load up and then I'm going to replay that okay and so what you're going to see is stuff start jumping up and down so you notice web is jumping up and down there don't where I'm going to show this on the big screen to web is jumping up and down a lot your SE dns number of things just sort of actually i think i turned off dns this is something that's important about this this program i actually made dns an option there is one more little option here because i noticed that if you put dns in the session view you're just going to flood it with dns in there because dns is that it you know your machine just fires those off like crazy so actually I'm going to do a redo here and do an add the flag dns so that you can actually see the dns there we go and you notice that the white thing is jumping up and down to as the dns is jumping up and down well that's because the dns servers on my local network so anything that's a dns session is also going to be a local session okay so let's throw on the big screen here
so let's see so there and see my
recording selfs a lot smarter than Def Con self because he remembered to put DNS in there and actually it's kind of
its kind of flaunting it because he highlighted it you see that I guess kind of bastard so so here's the the meter and there we go so we're rocking out to DNS we're rocking out like this the you know the base is hitting and you know
something's just whaling the guitar and then so so then you you hit the different stuff like I'm showing my my kind of friendly web browsing here there we go so you notice now remember that
this is session-based if I sent every single packet over this link it would be a fire hazard right so I can't send every packet I have to send over 9,600 I have to send the link date at the session data so you might be browsing
and be opening up a bunch of pages on the same site you'd be stupid no Steve this doesn't work and it'll be like no and then you got to remember that I said this that it's only when you open up a new session so if you go to another page then it'll start working again and I hopefully will be off the hook so there's just like I say just some generic browsing going different sites so that's that's kind of fun and then I think here somewhere I start to get into another protocol so again now at this point let's see so there's some there's some stuff you know what that probably is that's probably skype skype is actually a really chatty son of a gun what you'll see to this is this was
actually kind of fun while i was working on this I actually had it going a lot of times as i was working i just sort of have it going on the desk and actually i got really attached to it i go to bed with it at night now so the but the the thing is that what you'll see is we have a dispersed team and somebody over from sao paulo my friend rodrigo will send me a message oh there's me doing there it is a remote desktop I know you guys would appreciate this there's no CA right I thought you guys like that so look there's there's some other colors you know and then I think that one was purple so then you can say then after it was blue was purple so then it goes to remote desktop
because so you know you get the picture
you get different file sharing stuff you get different colors based on what you're doing so the the whole thing is
it was fun with a session view what I would see is if Rodrigo is about to send me a message is that thing that says Rodrigo is typing on in skype and so before I even knew Rodrigo was sending me anything I would see the color for southpaws for Brazil which is magenta it would show up I'd be like ah Rodrigo's can send me a message and bam Rodrigo send me a message is really cool and then it was like my other buddy Tom Mackenzie over in the UK says he's going to send me a message and also I see blue oh my god Tom McKenna's gonna send me a message right so so that is kind of fun it's kind of cool you actually learn a lot about how you're different protocols work oh here we go I didn't show you this uh I should have been talking about
this this is this is the whole thing right this is the whole this is why this
is kind of interesting security this is the security application what i'm doing here is i'm going to actually launch a port scan so it didn't really zoom in a precious em dinh there maybe i did know so i did an nmap up there in the corner in left hand corner is an nmap and check it out holy crap the the the things pegged this is that part where it's like I turn the car and it makes a funny noise I don't what the hell's going on and something's wrong and you start talking about warranty and you look at the fine print you realize you're you're out a thousand dollars but this is that part right where you know something's different the pattern matching thing it doesn't usually do that if I was in a call center and I had no idea about computers I'd no idea about networks I could stand up and say something's f'd up something's wrong the blinky lights they're doing weird man so now we
get to the fun part now we get to see
okay we get to see something cool here in a minute this was my thing about no handshaking message size 32 bytes 37 messages per second is probably about the most we can get there is another thing the think great thing about embedded the gray awesome wonderful thing about embed it is anytime you have a really really difficult computer science problem or whatever you talk to people in like disks are cheap processors are cheap computers are cheap let's just solve it by like throwing just a whole bunch of really really heavy instructions at and gives a crap so I can go you know make it a happy hour so that's not the case here right you actually it's almost like playing sudoku or something you actually it's a puzzle you have to figure out from the beginning you're you're screwed right you have to you know that you have to be very very careful and you have to be performs conscious from the from day one so you have to do the math did the 9600 baud two bites and I've 99 bites whatever I did the math i could get about top-end 37 messages per second probably realistically only about thirty two messages per second so the other thing was in session mode I had this thing that this concept that you're going to hit a ceiling and the problem is you're going to fill up 128 lights and then you're not going to know if your get in ports can't I really want that whole thing about oh man something screwed up right I want that that concept so I made something called inferno mode inferno mode is this meter that needs to that basically keeps track of how many connections are coming in and I preferred you know I was thinking preferably something's kind of psychedelic you know to like at least if you're getting like totally owned you could be like oh look man my smile blinky lights are like all up so so overload detection right define overload 90 you can just find this whatever you want that's conservative this is a very conservative number if the number of commandos are over overload mode nine is the bad one right so so i'm down to i'm down to five here so i think this is
actually gonna work out just about right here comes here comes inferno mode port
scan we're just going to end map ourselves you know it's a good example
it's reconnaissance somebody's doing
reconnaissance okay so yeah just 13 65535
so I'll let you know I didn't do the plasma effect but I did the frowny face okay um yeah so so that's the whole thing right so I think I think that's kind of the intermesh international symbol of your you're screwed right actually I tried to put it's pretty sad because you don't have a lot to work with you know you're kind of mess you're kind of screwed when you you don't even have enough room to write LOL so that is
the high point from there just so you
know that the little thing about the perl script i'm running on here it does work on snow leopard which is cool it does work on of course linux bsd whatever it's just pearl had a little bit trouble getting there working windows i think i'm going to take another stab at that because i think you know to make it universal we got to get windows in there too so i'll probably putting some on the website about this all open source course fairly simple it's using geoip i tried to keep it to a down to a minimum on the requirements of Perl scripts so hopefully it's not too hard to get going there's only two messages open and close you can make your own you don't have to use my perl script all it's doing is it's it's doing what you know you could do this in Ruby Python you could escape e to this thing you do whatever you want as long as you can talk to the serial port over 9600 baud and send those funny little messages that we're talking about earlier heck you could take the cereal box code figure out you know how it works how a network engineer would approach this problem and changed some
stuff the other ideas I had were like maybe you could make an ethernet version of this there is such a thing as Ethernet shield it would eliminate the whole USB thing but honestly I think it would probably be really really poor performance so I don't I don't know about that maybe there's better host site programs of course the most important was bigger LEDs right that's that's the that would be the big feature add there and there's some links so wait
I think pretty cool so that's what that
Feedback