This is Charlie Vera and Mike Larson and Paul Strip polluting Torrent Meta Data.  Awesome.  Thank you!  Alright we know that this is going to get a lot of press attention we want you all to use our logo in anything you write about this please. Alright we are going to move quick because we appreciate that you are busy so that TLDR is that. Intrusion detection systems can and do sniff out to our users.  And we think that's bullshit.  So we brought false positives for everybody.  The Torrent overview.  There is directory authorities you get a consensus doc that your client caches and it's so similar to HTTPS, HTTP and HTTPS that we can make your web browser generate false positives in an IDS.  We understand there's always opportunity costs we've made some attempts to reduce it other talks going on at the conference that you're missing.  It's up. There's some car hacking going on.  We decided to cover the physical portion of the hack backers way to car hacking. 
>>>:  They covered the digital part when full coverage for car attack.  Alright.  I'm the graph designer.  I created that awesome logo that you saw I dabble in security cause privacy is the utmost importance.  Yes so just like you were interested in security and privacy but were also interested in arts and crafts here's one of our projects >>>:  Ah yeah.  The the fake the badge contest.  If you go you go to June and show them your fake badge you win a black badge. So do that. 
>>>:  OK. So if you download Torrent warning number 6 of 6 on the down load page, is that, the fact that you're using Torrent like it provides the anonymity in the sense that people monitoring the wire can't see where you're going but it doesn't hide the fact that you are using Torrent So the wording on this is a little, is a little vague on the webpage but essentially it means an IDS can detect that you are using Torrent and log it. And sometimes this can have real consequences like in the case of the Harvard bomb threat kid.  So if you're unfamiliar.  Kid wanted to get out of finals.  He sent an email via Gorilla Mail connecting over Torrent. Turns out he was one of the handful of Torrent users on the Harvard Campus at the time.  So the same day they were able to track down trough the logs and interview him and get a confession.  Although he hasn't been formally indicted yet. 
>>>:  Is Torrent safe?  That depends on what safe means. Understanding Torrent, they are pretty up front with what it's designed to do and what it's not.  There has been quite a few talks about that.  
>>>:  And so Runa Sandvik from the Torrent project presented a very good talk last year that you all should watch if your curious. 
>>>:  Endpoint security is still important.  You've got vulnerabilities in the software that your using that could RCV exploit it.  For example Onion browser and the Firefox exploit that you may be familiar with. To help with that is portal that is a person named Doug Q.  Doug the Grout.  So you have the device that you can put upstream and if your endpoints were compromised, it'll end up not leaking any data.  
>>>:  Alright, So we brought a portal a pie to give away.  It's supposed to be for certified Unix network technicians only, ah, but we're just going to give it away to somebody in the audience.  We think it's fine cause a lot of you all look like cunts.   
So the bridging issue defaults matter as it's set up if you were to use it by default, Torrent creates a bunch of signatures that will show how they're getting caught, but if you use these pluggable transports that use various forms of steganography they can be used to obfuscate the fact that you are connecting Torrent, but that is not one of the direct goals of Torrent itself, to be clear. 
OK, so we're gonna show some signatures here in a few minutes and when you initially look at them it's a little confusing because there matching different pieces and different places and essentially fall into these three categories. Either clients connecting to the Torrent network or connections coming from the Torrent network or leaking information. Stuff that should have, traffic that should have been routed over a Torrent tunnel, but was not.  IDS, is sort of a boring routine thing and a lot of you all may not bother to keep up to date with the latest IDS news.  So we're going to start like if you're not familiar with the 1998 insertion of Asian Idala service paper, it's worth reading even now.  And then nothing happened for a couple of years.  A conference of history here. Finally like in 2004, still nothing happens.  Nothing happened for a while.  And then last year Cisco bought Sourcefire for 2.7 billion.  Came with an explosion, for sure.  So you're up to date on what's been happening with IDS. 
>>>:  So here's some example rules that will, will trigger these snort, the highlighted red portion is all that it takes to trigger an alert.  Which would be support of someone using Torrent at that time.  You can see the examples there and the java script at the bottom is what we have assembled to induce those quote false positives.  
>>>:  And it's important to note that these VRT rules actually aren't going to work in a default client configuration.  To give you an example of the first one just matching that straight http content but from the directory specification, but that traffic now by default, it goes over like a one hop to our circuit.  In the second case this has been the signature, while it's still in the official VRT rules would only match like a Torrent 0.1 client when there is still client certificate validation.  You can read about that at the link there.
>>>:  Similar rules matching binary content the like 05 hex onion is matching like the dot onion that you see in DNS.  Same thing on for exit. That you see in red.
>>>:  And if your not familiar with reading historic rules the piece between the pipes is just a raw match on a hex representation of bytes.
>>>:  So the ten bytes are just straight from the, the DNS flags. 
>>>:  I revoke when I said dot. There's no dot.  Yeah there's no dot. The number ahead of the TLD is just the length of the TLD. And that's straight from the RFC.
>>>:  So for this one ET open also has a bunch of rules that's detecting traffic from Torrent nodes like as we mentioned very quickly in the discussion in the beginning there's a, the a Torrent relays and the Torrent accents there all, it's all published information.  So in this case you see, this is just an example of hundreds and hundreds of straight IP naturals for traffic source from Torrent Nodes so in the case of the first one.  We need to make a TCP connection from a Torrent Note to your host to generate the false positive so in that case what we did is there's our Torrent relay that we stood up called imposter and on there is running a web server. 

>>>:  That this is just the source code.  It just joins, it's going to connect back to you when you connect to it.  So this will gen, generate a hit on that ET open signature, showing a connection from the Torrent network to you.  In the second case it's a little more difficult to generate EDP traffic from java script from your browser.  So what we did to get an EDP packet is we looked at some of the relays, some of the relays also happen to be DNS servers.  So we set up some lame delegations under the domain lame delegation dash lame delegation dot net... and, did some, added some  host names that point to these Torrent Nodes that are also DNS servers, so when you look at those domains.  Your domain server is going to get an x domain response from those boxes generating a Torrent alert source from the Torrent network destined for your DNS, your recursive DNS server.  Oh, and I guess I should actually show that that's in place. So this is the Torrent node, this is the IP address, this is the emerging threads, and it's in the list of hundreds and hundreds of Torrent Torrent that come with that rule set.
>>>:  Another idea, this is the code that matches.
 >>>:  Okay, it's just matching the subject and issuer from the TLS handshake because as there's Torrent does not use valid host names as use just sort of a random string of characters, so it looks for those weird looking certs and if there is enough of them, bro will send an alert, but because it's just a TLS handshake that it's matching on, you can just point your browser to any Torrent node, make that TLS handshake, and trigger that alert.  
>>>:  A lot of the pros and cons to using java script. The publishing parts probably the most relevant, this can be induced through cross eyed scripting, for example if you want to frame someone, if they're, you know,   on the Torrent network a lot of people use time correlation at networks, that's another source that you can use to get this java script code running that would induce these IDS alerts. And there some examples, you just essentially plug that into your code on your site internet.  Wherever you want to have these alerts triggered.  And you'll start generating the alerts on the, on the nids. 
>>>:  So all of the users of your website can become fake torrent users providing coverage from, for everybody that uses torrent from those networks. 
>>>:  And I would totally trust us to host that java script. I wouldn't recommend pulling it down for audinate yourself. 
 >>>:  So there's a few limitations we had to work around here.  Here's most of them. 
>>>:  So like Exostar you can't write arbitrary headers so there's things like the user agent that the spec doesn't allow you to overwrite.  So that has to come from the browser. The browser can't make just arbitrary connections to TCP ports, there's a handful that are prohibited.  There's a black list of ports.  There used to be attacks, cross protocols, scripting attacks that allowed you to like send email from a browser by pointing it to an IP address port 25 posting and hoping that the mail server would like ignore all of the HB header information and just match the ASCII text of the post body.  So a list of those ports you can find them in the tangled web.  From a browser, java script perspective, you don't have a lot of ability to generate EDP traffic.  But of course all the matches, Torrent doesn't tunnel EDP all the matches are probably going to be DNS, and of course you can generate DNS traffic and there's also a challenge in getting, like for the first batch of signatures we saw.  Where we're just matching simple bytes like at to our server.  It's hard to a, from an https site to generate, clear text traffic because the, mixed content warnings are pretty robust, they follow all sorts of weird use cases like following redirects, calling other protocols, calling web sockets, like you can't call a, a non-encrypted web socket from an encrypted site.  So if you have suggestions on getting around mixed content warning we'd like to hear them.
>>>:  There's various other detection techniques.  Here's a few. There's time synchronization.  One published.  There's the TBD user agent.  And 512 byte cells. Want to cover those in any detail? There's URL's if you need that.  
>>>:  So I, I think the most interesting one is user agent so the Torrent browser has a fixed user agent that's like a trade off to prevent finger printing, like if your familiar with pan opticote, pan opticlick project, like a, there's a lot to identify you, in a, a normal browser user agent,  >>>:  Yeah, so this is all generic.  Like, essentially all you need is a device so the TCCPA piece stack that is would take data from a protocol  and end up connecting to an arbitrary host with some data so we just, this would apply to any of those protocols we just abused browsers because they're really popular, but there's, @ so pot et introduces this question. Is it possible to write any rules that cannot be spoofed.   Yes, there is.  If people change the protocol, but it, it does a lot. 
>>>:  Okay so what we would like you to do is go to the website and put post your IO.  And let us know if it triggers IDS alerts.  If you're responsible for security infrastructure. If it doesn't work, take a look yourself, let us know what you think the traffic should be.  And there's contact information on the website. I'd be happy to help you, we'd be happy to help you figure out how to generate matches against your closed source tools.  If you want to help, again, visit the website and support the Torrent project.  One key part about supporting anonymity online is here it's a very popular opinion, but when you get back to the real world a lot of people, it's not a popular opinion, a lot of people are more worried about terrorists and pedophiles than supporting freedom on line. Alright, there's a quick summary, if you have questions meet us in the chill out room after this talk and thank you very much.  And we have some important research to introduce from our colleague, Joe. 
 >>>:  Okay guys, this is about to be some heavy shit here.  When we were doing this Torrent stuff, we ran into these packets and we were going through these leaked documents that Snowden let us view... turns out that there's these walking bipedal nuclear tanks.  And, there's a code name "Metal Gear". And we were going through these packets and they seemed to be using all the game protocols as Stego to hide their real, their real process. And as we were going through this we started seeing these repeated pites.  Now little did we know it had something to do with bitwise operators and exclusive stuff, so we outsourced it to Snowden and he actually figured it out for us and it's this thing called exwhore.  So we we're not able to read their traffic with these nuclear tanks and supposedly they want us to think that somebody reverse engineered these video games and the network protocol and if you hack your PS2 and PS3 your going to start playing this game again  But that's not the truth.  So we're going to go ahead and describe this protocol for you so you can start checking it out.  And actually, find out the truth, so there's these command identifiers right here, and they tell the client what it's actually going to do.  And the palletes will be in the end and there's an MD5 check sum that will de verifications across them.  All you have to do is MD5 the payload with the command header and you're good to go.  So you can go ahead and hop on this.  And actually find out what they're actually doing with "Metal Gear".  Supposedly, there's an amphibious one that's going to be coming out soon, and just go ahead and start exploring from there. ... Fucking Chemtrails, man!