DAVIX Visualization. Workshop

Transcription

1 V DAVIX Visualization D X Workshop

2 V DAVIX Visualization D X Workshop Jan. Monsch at iplosion. com Raffael. Marty at secviz. org

3 Chief Security Splunk> Passion for Visualization Senior Security Analyst DAVIX initiator and engineer Applied Security Visualization Paperback: 552 pages Publisher: Addison Wesley (August, 2008) ISBN:

4 Raffael Marty Jan P. Monsch Chief Security Splunk> Passion for Visualization Senior Security Analyst DAVIX initiator and engineer Applied Security Visualization Paperback: 552 pages Publisher: Addison Wesley (August, 2008) ISBN:

5 Workshop Preparation 30 DAVIX CDs - DAVIX image - DAVIX manual Copy files to your disk and hand the CD to your neighbor! - PCAP file for analysis in /root Recommended setup VMware Player or VMware Fusion Bridged or NAT networking VM setup assistance: Chapter and in the manual Configure host to access DEFCON wireless network

6 Agenda DAVIX Visualization Example analysis Hands-on analysis Show us what you got 4

7 Agenda DAVIX Visualization Example analysis Goal: You can use DAVIX to analyze your data! Hands-on analysis Show us what you got 4

8 Visualization Questions Who analyzes logs? Who uses visualization for log analysis? Who has used DAVIX? Have you heard of SecViz.org? What tools are you using for log analysis? 5

9 V D X Data Analysis and Visualization Linux DAVIX

10 What is DAVIX? Live Linux CD system based on SLAX 6 - Software packages are modularized - Easy customizable - Runs from CD/DVD, USB stick or hard drive Collection of free tools for data processing & visualization - Tools work out of the box - No compilation or installation of tools required Comes with documentation - Quick start description for the most important tools - Links to manuals and tutorials

11 Why Did We Build DAVIX? No free solution offering wide range of visualization tools - Huge hurdle for people to get start with visualization Cumbersome to get tools running - Compiler issues, e.g. gcc 3 vs. gcc 4 - Dependencies with uncommon and old libraries - Different runtime environments DAVIX Goals - Getting tools running is simple User can concentrate on analysis - Easy customizable Users can add missing things - Perfect workspace to get you started with visualization!

12 User Interface - Menu Organization Menu organized around the information visualization process Capture Process Visualize Tools often cover more than one category - Afterglow Process, Visualize Additional tools/services: - Apache, MySQL, NTP

13 Tools Capture - Network tools Argus Snort Wireshark - Logging syslog-ng - Fetching data wget ftp scp Processing - Shell tools awk, grep, sed - Graphic preprocessing Afterglow LGL - Date enrichment geoiplookup whois/gwhois Visualization - Network Traffic EtherApe InetVis tnv - Generic Afterglow LGL Viewer Mondrian R Project * Non-concluding list of tools

14 PDF User Manual Quick start guide Network setup information Tool usage examples Links to online resource: Tool home pages, manuals, tutorials Customizing DAVIX - Customizing ISO image - Creating new modules - Installation on USB stick or hard drive

15 User Manual in the Menu The manual is browsable by chapter or individual tool chapters

16 The Manual Is Not Not an introduction to security analysis methodologies Not a collection of security analysis use-cases Not covering exhaustive examples - The usage examples are not security related - It is a quick usage guide for the tools Look at Raffael s book to get these details!

17 Customizations The DAVIX and SLAX can be modified in two ways - LZM modules Adding or removing modules in the directory slax/modules Modules are highly compressed software packages - rootcopy Overwrite or add individual files of LZM modules by copying modified files to the directory slax/rootcopy LZM modules can be generated out of standard Slackware or dropline GNOME packages using tgz2lzm

18 Visualization

19 Information Visualization Process Capture Process Visualize 16

20 Data Formats CSV / TSV ,80, ,failed ,80, ,success TM3 Source Port Destination Action STRING INTEGER STRING STRING DOT digraph structs { graph [label= My Graph ]; node [shape=ellipse]; edge [len=1]; ram -> activity 1 ; failed GML } ram [fillcolor=white]; 17

21 AfterGlow 1.x Parser CSV File AfterGlow Graph LanguageFile Grapher aaelenes,printing Resume abbe,information Encrytion aanna,patent Access aatharuy,ping digraph structs { graph [label="afterglow 1.5.8", fontsize=8]; node [shape=ellipse, style=filled, fontsize=10, width=1, height=1, fixedsize=true]; edge [len=1.6]; } "aaelenes" -> "Printing Resume" ; "abbe" -> "Information Encryption" ; "aanna" -> "Patent Access" ; "aatharuv" -> "Ping" ;

22 AfterGlow 1.x Parser CSV File AfterGlow Graph LanguageFile Grapher aaelenes,printing Resume abbe,information Encrytion aanna,patent Access aatharuy,ping digraph structs { graph [label="afterglow 1.5.8", fontsize=8]; node [shape=ellipse, style=filled, fontsize=10, width=1, height=1, fixedsize=true]; edge [len=1.6]; } "aaelenes" -> "Printing Resume" ; "abbe" -> "Information Encryption" ; "aanna" -> "Patent Access" ; "aatharuv" -> "Ping" ;

23 An Example Analysis

24 Worms in Mobile Networks Problem: Find worms in mobile networks Data: Call Detail Records (CDR) GMT GMT xxxx xxxx GMT GMT image/jpeg CHEC1_MMSC1 MM4Rrecord 0 1 MM xxxx xxxx xxxx Process: cat mms.cdr awk -o VFS=, {print $5, $6} Visual Transformation:

25 Multimedia Message Service 21

26 Multimedia Message Service Service Numbers? 21

27 Multimedia Message Service 22

28 Multimedia Message Service Long Chains 22

29 Hands-on Analysis

30 Let s Go Captures are in /root/davix_workshop_captures.pcap Find something interesting? Come show! Hints: tcpdump -nlr /root/davix_workshop_captures.pcap tcpdump2csv.pl afterglow.pl -h bar.pl -h

31 AfterGlow # Variable and Color variable=@violation=("backdoor Access", "HackerTool Download ); color.target="orange" if (grep(/$fields[1]/,@violation)); color.target="palegreen" # Node Size and Threshold maxnodesize=1; size.source=$fields[2] size=0.5 sum.target=0; threshold.source=14; # Color and Cluster color.source="palegreen" if ($fields[0] =~ /^111/) color.source="red" color.target="palegreen" cluster.source=regex_replace("(\\d\+)\\.\\d+")."/8"

32 Thank You S secviz. org E V C I Z davix. secviz. org