IPv6 in any given day

This is a previous result of some research that I am doing in IPv6 usage.

From the access in IPv6 received by lacnic.net (just www) this is the distribution of OSs and browsers in a random day that I selected on September:

{'Googlebot': 170, 'Windows': 2878, 'Unknown': 772, 'Linux': 3933, 'Macintosh': 2214}
{'Konqueror': 99, 'Firefox': 5732, 'Microsoft Internet Explorer': 1174, 'Chrome': 844, 'Opera': 383, 'Safari': 729}

Errata: It's not a day, it's a week

Need a botnet, only $9.00 the hour

Adding a bit of salt to the problem of botnets and the topic about "Attack as a Service (AaaS)" (not sure if the term really exists) this note is intersting:

Study finds the average price for renting a botnet

http://www.zdnet.com/blog/security/study-finds-the-average-price-for-renting-a-botnet/6528

"Based on an experiment conducted by researchers from VeriSign’s iDefense Intelligence Operations Team, involving 25 different "rent a botnet" underground marketplace propositions, they were able to conclude that the average price for renting a botnet is $67 for 24 hours, and $9 for hourly access."

Some other articles about bontnets:

The attack of the opt-in botnets

http://www.zdnet.com/blog/security/attack-of-the-opt-in-botnets/6268

The biggest cloud on the planet is owned by ... the crooks

http://www.networkworld.com/community/node/58829

The Cloud of real time for London 2012

I just read about an article about a "Cloud of real time information for London 2010". I wrote a bit in my blog in Spanish, there is an automatic translation here.

I won't write too much about it, I would prefer to you to go to the Cloud website or to the original article from TechCrunch or in . However, I would say that the project seems quite a challenge and I am looking forward to hearing more about it in the near future.

DoS/DDoS news resources

Considering the hype about DoS and DDoS in the last days as consequence of attacks to Twitter, Facebook and LiveJournal I decided to include some of my information sources in this blog. I did some redesign of the right bar. I included some DoS and DDoS news, they are a set of news manually selected by me. I take the news from different sources and I apply some basic filtering and data-mining I come with them. They can be also accessed here if you want to include them in your RSS reader.

"Security news from Twitter" are posts about DoS/DDoS attacks collected from twitter. This is a little bit noisy with around 30-50 posts per day. Some of the posts are repeated or uninterested (from my perspective) but it works as a source for my tools that extract some information for them. The raw feeds are here and here.

Finally I included some general IT security news from twittsecurity. Twittsecurity is a bot that shares security news in Twitter. It searches and selects IT security news using a hybrid method (automatic and human assisted). Feel free to follow it.

Some Machine Learning Libraries

I've been doing some experiments using "machine learning" on several projects and I would like to talk a bit about them. For now all I am coding in Python, but also I'll comment on some Java and C++ libraries.

A simple to use is FANN (Fast Artificial Neural Network). It also has ports for Python and other languages (PHP, Java, Perl, etc.. Although the Python version of Python did not work for me for some reason).

For Support Vector Machines I used LIBSVM (A Library for Support Vector Machines). In the website you can even find a number of recommendations for using SVMs. Other libraries supporting SVM are PyML and MLPy (but for some reason the compilation did not work on my machine, so I used LIBSVM).

A very interesting library implementing a Naive Bayes Classifier is Orange. I have not tested but it looks good, plus, it has good documentation and links to various datasets.

If you are interested in Reinforcement Learning, Tiles is a library in Python (also in C + + and Lisp) that allows you to "transform" the inputs to a value function represented by an array of tiles. In general, to represent a state in high resolution tiles are better than just simple states.

If you want a "decision tree" you can use this that is included and explained in the book "Collective Intelligence". I think that the algorithm used is based on ID3.

And finally, mahout. This is an Apache Foundation project. For now is out of my reach to test it. I do not have the infrastructure or the need to use it. It is based on Hadoop and mapreduce concepts. Very interesting.


PS: If you want more resources about machine learning, these are my delicious bookmarks on the topic.

Some NS-2 code to simulate DoS and DDoS attacks

This is some basic TCL code that used for some simulations. This code works on the NS-2 network simulator.

Simple simulation with flow monitors. It creates 4 nodes: 1 UDP source and 1 TCP source (FTP), 1 destination node and 1 transit node. It monitors the flows coming in and out from the queue in the link between the transit and destination node. It dumps the trace data to a flow file.

Ping Flood . It creates two nodes. Node 1 floods ping packets to Node 2. It could be useful to simulate Denial of Service attacks.

Simple DoS Attack. It creates a topology of 7 nodes. Two nodes generate valid traffic (one UDP and another TCP in the form of FTP). Another node generates and UDP DoS.

SPAM and the commerce of fear

A few days ago I commented that the spammers would soon begin sending mails about medication against the swine flu and replacing the old viagra SPAM. Shortly after, the US-CERT warned of phishing attacks using this new vector for social engineering and the SANS published a list of sites that could generate malware/phishing /scams (according to the particular domain names selected).

Well today I received my first flu-related SPAM. Also, visiting a news site I found this ad from Google Ads. The ads are not malware sites (at least these three do not appear to be, but try them at your own risk), but certainly they plan to profit from the people's fear.



Well, I think that we humans are quite predictable.

The big news today about Conficker ... is that there is no news

For the moment everything looks calm. Although it is almost April 1 throughout the whole world there is not yet any news about of the end of the world. Today, the media expected big problems as result from the spreading of the worm conficker and the new "payload" that would be activated.

More than a result of a large patch campaign, I think that the famous worm exploited a large media campaign that exaggerated and overestimated its effects. I expect this to be just another day in the life of a security research. Anyway, if something happens, I will be updating my twitter and my tumbr (this is Spanish only). In case of infection or pro-action against the worm, here are some resources.

The BBC, the botnet and other DDoS attacks

No doubt that the most commented DDoS news of the week were related to the botnet that the BBC hired. In fact it was the staff of one of its programs called Click. The program's goal was to demonstrate how easy it is to hire a botnet to perform criminal activities. The botnet was used to send SPAM to a especially set account and to launch a DDoS attack to security company website's specifically set for this purpose. Although the ethics of the action has been critiqued, the fact is that they have demonstrated how easy and cheap it is to hire such services.

In other news, Jose Nazario of Arbor Networks in hiss presentation at SOURCE Boston commented about the new "trends" in cyber crime. Nazario said that cyber criminals are not just selling kits for running malicious software on unprotected computers. Now they sell services for script-kiddies and criminals who are just not good enough to use the malware by themselves. The audio of the presentation here.

The DDoS attack to the torrent site Mininova continued during this week. Here you can see some trends in traffic that the attacks have generated.

The Spanish version of this post here.

DDoS in March

To the surprise of some, the Pirate Bay website was under a DDoS attack earlier this week. Still no news about the intellectual authors. The site is stable for now.

According to an analysis of the anti-virus firm Sophos, the worm Confiker could start a DDoS attack to some sites, including Soutwest Airlines. The collateral damage would be a DoS due to the spread of the worm. The note on TechRepublic.

And the torrent's site Minova has been attacked by a DDoS. According to TorrentFreak the attack has reached the 2 Gbps peak. It seems to come from bot networks that appear to be in Germany and Argentina.

Feed Analysis

Well, this is post is more a plead for help than a real post.

I need to analyse a RSS feed that I have been generating by searching for twitts related to DoS and DDoS attacks. In order to do it soon and with not so much effort I would like to avoid programming something (may be using feed parser or XML_RSS). What I would like to do is:

1. Get the average post per day, week and month
2. Get the average for a specific week and month
3. Get the all items for a specific date
4. If possible, to graph the number of items by day, week and month

If somebody knows a webservice to do that, please let me know to my e-mail, by a comment here or just send me a twitt. I would really appreciate!

Practical Artificial Intelligence and Machine Learning

I gave this presentation yesterday in Ignite UK North in Leeds. It is about Artificial Intelligence and Machine Learning, it contains a little bit of theory, practical examples and some resources to dig a little bit more on the topic. It does not go very deep in details though.



Le Monde (the translated version here) reports that the web site of the French Embassy  in China has been inaccessible for a few days. The cause is an apparently DDoS. The attack seems to be a consequence of the political tensions between China and France as result of the meeting of the french president Sarkozy with the Dalai Lama in Poland.

This is another case of the infamous cyber-war.

 

New DoS and DDoS coming?

  The SANS Internet Storm Center reports that some worms exploiting the new Microsoft RPC vulnerability (MS08-067) are been seen on the wild. As I wrote before (here for the automatic translation by Google) this is critical vulnerability from the same family that brought us worms as Blaster. 

Fortunately as mentioned by Steve Gibson in Security Now the Internet has changed a lot from those past experiences. Today most Windows XP (with SP2) and Windows Vista hosts have the firewall on by default that minimizes the risk of infection. However many Windows 2000, 98 and 95 computers, most of them forgotten in some computer room are still in a high risk. I wonder if this will be another endemic disease that will be living in the Internet as their cousins.

Here there is the report from F-Secure for the interested people. And, wait for at least some minor disruptions generated by compromised machines.

TCP monitoring in NS

Today I was asking in how to monitor TCP connections on NS-2. Then I decided to blog about the topic.

First you need a TCP agent and maybe with a FTP or some sort of application (I suppose that you already have some nodes):

#Setup a TCP connection set tcp1 [new Agent/TCP]
$tcp1 set class_ 2
#Attach tcp to node n0 $ns attach-agent $n0
$tcp1 set sink [new Agent/TCPSink]
#Attach a sink to node
n1 $ns attach-agent $n1 $sink $ns connect $tcp1 $sink
$tcp1 set fid_ 1
#Setup a FTP over TCP connection
set ftp0 [new Application/FTP]
#Link tcp agent with FTP application
$ftp0 attach-agent
$tcp1 $ftp0 set type_ FTP

Now, create a procedure to print some TCP information

proc update_tcpinfo {} {
global ns file_out time_step
set now [$ns now]
set window [$tcp set cwnd_]
set avgwind [$tcp set awnd_]
set rtt [$tcp set rtt_]
set acks [$tcp set ack_]

Then you have window, avgwind, rtt and acks that you can print out to screen or to a file (an output file or may be the tracefile, I would recommend a separate trace file).

puts $file_out "$now $window $avgwind $rtt $acks"

And call the procedure every time_step

$ns at [expr $now + $time_step] "update_tcpinfo" }

To declare your outfile just do it as the trace and nam files are normally initiated:

#Open flow file set file_out [open flow_trace.txt w]

And do not forget to close it:
#Define a 'finish' procedure
proc finish {} {
global ns nf tf file_out
$ns flush-trace
#Close the NAM trace file
close $nf

#Close the Trace file
close $tf
#Close outputs file
close $file_out
#Execute NAM on the trace file, uncomment the next line to exec NAM automatically
#exec nam out.nam & exit 0
}


Call the procedure and run the simulation

$ns at 0.5 "updatetcpinfo" #Call the finish procedure after 5 seconds of simulation time $ns at 5 "finish" #Run the simulation $ns run

This is only pseudo code and it could have some errors. I prepared a working file that can be found here:

DoS video with captions

Well, I started to play with the new YouTube feature to add captions to your video. I think that my video of the DoS attack simulation is better explained with captions. This is the same video that I have used in some of my research work and paper presentations.

I do not why but the embedded video did not show the captions, so the link is here.

Revision 3 Under DDoS by ... MediaDefender

This has been around the twitter world and it is funny and serious. Some days ago Revision 3, a new media company that distribute their content via Internet was under a DDoS attack. They just released in their blog that the attack came by no other than MediaDefender. MediaDefender is a dark company paid by content distributors in order to disrupt, hack and to do other non ethical activities with the flag of "Anti-piracy". It results that Revision 3 uses bittorrent, a very common P2P tool to distribute ITS OWN content.

Many questions raise with these actions. What was Mediadefense doing against Revision3? Are legal their actions? What are the MediaDefender's criteria to "disrupt" torrent sources?

I honestly hope that Revision 3 take some legal action against this attack. I think that is enough with the danger that website owners face today with attacks from botnets, it is not good to add more attack sources such as this type of companies.

New Updates in my research page

I just realized that my research page it is a little bit difficult to manage and that I was using my wiki like a blog. So I will do some changes. Among them I plan to integrate and use more web 2.0 technologies, e.g. I will add my papers in CiteUlike, I will manage my links in Del.icio.us with tags, I will post some news using twitter and Yahoo Pipes and so on. Probably I even will start using Google Sites to host the pages instead of the university infrastructure.

DDoS attacks in the Olympics?

According to Jean-Michel Louboutin, Executive Director of Interpol Police the main security risk in the Olympic Games is the physical security of the visitors (and Chinese people as well). I agree with that, however I think that in the interview with PCWorld he subestimate the effect of a DDoS attack. The Chinese Internet infrastructure might be stronger against a DDoS than Estonian, but in a synchronized attack some services such as news reports or the Internet communication of visitors may be compromised. It is true that according to MessageLabs the infamous botnet "Storm" seems to shrunk; although these are good news (and less DoS could be launch) we are not sure if the small size of Storm is due to better security practices or just that another group of hackers has taken control of the botnet.

I read a comment in the Bruce Schneier's Blog about security: Never say "never", "this is impossible", "this will not happen". I honestly wish to be wrong, but I am sure that it will be more than one attack against the olimpyc infrastructure and at least one will success.

This post in spanish

NS-2 Memory exhaustion

1078404057

I recently started to run a big simulation (68 agents and nodes) in NS-2 to test my intrusion detection algorithm using reinforcement learning. When I ran the simulation for more than x time, it started freezing the host and it ended killing the process. I look for errors in the code and nothing. I freed some disk space thinking that it could be that the log files were using all the available space. It worked a little until I ran the configuration x + y time.


I suspect about memory use and I increase the memory in the host machine (I was using vmware, so it was easy) with good results. However, as I increased the simulation time the solution became and endless cycle (that will end in no more memory available in the machine hosting the vmware). I started looking for problems in how I was using the memory in my code. I found some links about how to debug memory allocations in NS. I must say that I could not make them work, any way the links are here:


NS-2 debugging tips
dmalloc


Of course I sent an e-mail to the ns-users e-mail list, and as always it was useless (it seems that anybody likes to answer smart questions and newbies always post dumb ones -that no body replies either -). After reading the ns-manual again, I found that I could (or I must I am not sure) free the packets that I used. It is that I developed a new type of agent. The interaction and information shared between agents is of course through special packets that I define.


So, the call is:


Packet::free(pkt);

I call it in the method that receives the packet just after reading the packet data that I need:

void RL_MAgent::recv(Packet* pkt, Handler*)
{
// Access the IP packet
hdr_ip *iph = hdr_ip::access(pkt);
// Access the RL header for the received packet:
hdr_rl* hdr = hdr_rl::access(pkt);
double stime = hdr->send_time_;
int ptype_ = hdr->p_type_;
int nodeid_ = hdr->node_id_;
int src = iph->saddr();
int dest = iph->daddr();
int srcport = iph->sport();
float now_ = Scheduler::instance().clock();
Packet::free(pkt);

if (ptype_ == T_START)
{ ...

As result, my simulation only needs around of a steady 10MB of memory to run.