I love it, I love an stop.
This is for them, this is for them.
Okay guys, please have your seat.
Now we can start.
Okay, good morning.
Today I'm going to talk about the network trafficking
This is a short version of a talk.
I see my talk.
I play that the sheriff has the conference in November.
So if you want you can go to the sheriff's conference.
It will be a long talk more than one hour and a half.
So this is the contents.
That's just to give you an idea of what is happening.
Who am I?
I'm a software open source software developer.
Okay, and I also teach at university.
I contribute to various software applications, including
the washers, ricards, and so on.
And today I'm going to talk about an open source library called NDPI.
For those of you who have been here years ago,
I made a presentation during the COVID days about this library.
So today I'm going to focus on the fingerprinting part.
The library is open source, you can see the read here, you can download it.
It's probably the only open source, the pocket inspection library available today.
I transfer more or less everywhere from embedded system to big system.
We can scale up to one hundred and plus gigabit or two to a small embedded device.
And not only contains DPI text techniques,
but also contains algorithms for doing traffic analysis, for data clustering,
for something that everybody calls AI, but it's probably not the AI which is a clustered or
unsupervised AI.
So what is the topic today?
Today I'm going to talk about an act of fingerprints.
I'm going to give you an introduction to an act of fingerprints.
To explain what they are, what they are not.
And I also, I'm going to differentiate between the initial flow fingerprint.
So that is the topic of this talk from other type about behavior fingerprint.
So let's start with the term.
So the net of fingerprint is a way to, usually, passively, identify
and guide the specific properties of pockets.
You know that today, the first question is, okay, about the traffic today is encrypted.
Okay, encryption is an opportunity, I would say, is not a problem.
Of course, you cannot see the payload, but I think that does not bear.
That's not real bad.
If somebody uses encryption, there is a good reason for that.
And I like that.
But the fact that you have encrypted payload, it means that you have encryption case.
You have other, let's say, properties that are useful.
That you don't have with clear text traffic.
The bug number one of internet days of the internet today is that everybody can inject a pocket on the wire
and the pocket is accepted if it looks good.
So you don't know exactly who is doing what.
So the only way to know that, you have to put in a layer on top of layer.
And then at the end, you will have encryption.
Encryption case, blah, blah, blah.
I don't, it's a long story to, I don't want to talk about that today.
That allows me to say, okay, look at us inject it.
So the term, the thing that sometimes uses a word that it's about means use about unique.
Okay.
The thing that is not unique, it's a way to classify traffic.
So if somebody is injecting a pocket, similar to the pocket sent by somebody else,
it's not true.
So you have to trust the pocket.
Unfortunately, pocket never lies, it's not true.
Because unfortunately, you can inject any pocket to the wire and you have to trust them.
So this is what, I think the print.
And basically, you can use the print for various reasons.
The first thing is for is a for labeling traffic.
So you want to have a nice pie chart of the traffic flowing in your network.
Say, there is a lot of TLS.
So there is a lot of streaming today, probably here.
Act force them.
And based on that, you can create some specific methods.
For instance, the round trip time is not great.
Or there are some loss on RDP.
You can segment networks.
So if you think you print the HTTP, the initial core,
it's okay.
This is not the Windows machine.
I don't want to see it on my network because it can be dangerous.
So let's put it on a special V-line.
It's not a problem.
Otherwise, cybersecurity.
If you see a device that is at the same time,
an Android machine, a Mac or a Linux,
that is something wrong.
At the fingerprint as a bug, probably not.
Or it's the device.
It's a long other people to come to the network.
There are a bunch of virtual machines.
There are two ways of doing fingerprint.
Today, I'm going to focus on the passive part.
Passive means that you collect traffic.
You look at the traffic.
You create your own fingerprint.
And you say, this is the fingerprint.
Otherwise, there is the active fingerprint.
So basically inject traffic on the network.
And you try to collect information that you cannot collect with
a simple example of that is free.
So we tell us 1.3.
Only the initial part of the negotiation,
the client echo, is in clearer time.
It's becoming more and more encrypted.
But it's in clearer time.
So you can decode it, let's say.
Otherwise, the rest of the communication,
which is the certificate or the server,
hello, it's in clearer.
If you're not the inspector,
an anti-finger-printly-like police at Jarby's doing,
is possible to fingerprint the server,
even though the server is suddenly traffic
that the passively cannot be analyzed.
So advantage that passively,
totally passively means nobody knows that you're doing that.
Unfortunately, there are some limitations.
Those are the limitations I told you.
Fortunately, present in modern processing.
There will be more and more limitations.
So we have heard a lot about quick before.
There are protocols like quick by design and highly information.
And I said, this is great.
I'm not saying it is bad.
So there are various fingerprinted methods.
First, the method is about protocol.
So you want to bring the protocol itself.
So the HTTP, remote desktop,
protocol, this type of things.
Other methods don't look at the protocol,
but look at the content.
So for instance, if you see traffic,
there was Firefox settings, services,
modzilla.com, probably somebody's using Firefox.
So not only you fingerprint the environment,
but you fingerprint the application.
There are similar examples.
You know, applications today are very chatty.
They connected to various things.
In particular mobile phones and Android,
and iOS are talking a lot,
it's pretty easy to fingerprint them.
And that's important.
That's important to give an idea of
the user's way in a passive way.
So in real life, you can use it for
it's a browser fingerprinting.
If you want to make statistics,
policy enforcement, you can decide
by device or type of things they can do,
or they cannot do.
Hopefully you can prioritize the traffic.
So let's say, if there is important traffic,
like streaming, this type of streaming,
I want to give this traffic a priority.
I want to give less priority, let's say,
to a fine transfer to a Dropbox update,
because they can happen slowly.
But this type of traffic,
either it is fast.
So it's reliable.
It doesn't flicker.
All people will not like it.
That is the main thing.
So we are not doing that for spying people,
but there are good reasons
in the network for doing that.
If you want to create a fingerprinter,
there are many tutorials that talk about that.
It looks like it's a fantastic,
super complex thing, but it is not rocket science.
I tell you, the fingerprint.
So basically you have to take some specific attributes
of the protocol you want to fingerprint,
for the traffic you want to fingerprint,
make sure that you ignore.
Attributes that are not important,
or that are random.
So for instance, in TLS, there is an extension called
Greece.
It has been put by that by Google.
You should ignore it,
because every communication has a different type of value.
So if you simply take the payload,
you create a hash,
say this is the fingerprint it's wrong.
So you have to take the information that makes sense.
So for instance, if you want to fingerprint
at TLS communication, you should ignore the domain name,
or the rest you are connecting to,
because it changes for the time.
But I want to fingerprint the client,
I don't want to fingerprint the traffic you are making.
So I want to know,
whether you are using Modela,
file, folks or another application,
or I want to know,
on a very specific factor,
where it's super important,
that nothing has to change.
Like, you know,
an industrial network,
where you make medicaments.
So if you see that a fingerprint of a device
has changed, you have to check whether
somebody has updated the device,
or there is a problem on your plant.
That's very important.
So fingerprint is not just about curiosity.
It's about making sure without inspecting,
going deep,
but things are working as it should.
That's very important.
So it's not rocket science.
For instance,
this is an example of the fingerprint implemented
by NDPI for the TCP stack.
So we take some parameters that make sense.
We try to make, you know,
assumption on the usage.
So we define them in ranges.
For example, it's a typical example.
So you cannot take the single value,
because when you have,
by hope, it can be decreasing.
If it is a range,
it's not the exact value.
And you create this string.
When you create this string,
and then this example of the extension that we
are put through NDPI in white shark.
So you can see the fingerprint on it.
Is it what, what can I do with this fingerprint?
Okay, what's the need beside the hash?
Okay, I'm going to show you that.
So for instance,
looking at the fingerprint,
we can know interesting properties of the device.
Let's have a look for instance,
at Apple.
Okay, everybody thinks,
okay, I buy a device.
It's made by the same manufacturer.
It's a sale.
No, it's not true.
So for instance, if you look at the operating system,
that's interesting.
Also, if we look at the TCP options,
we can figure out what this has been generated by an iPhone
or an iPad.
So you can restrict, for instance,
the network.
Okay, or you can say,
okay, if I want to make my statistics,
this type of device.
For instance, you know exactly if it's a Windows machine,
because Windows machine does not use the timestamping option.
This is used by other operating systems.
So you can create families.
Okay, not for sure say Windows 11,
Windows 10.
This is not possible.
Honestly, it's not possible.
But you can create families.
You can decide where the certain things
should happen or not happen.
It makes statistics.
That's the thing.
And then of course, if you see a Windows machine
that is accessing a lot of Android in your site,
or an iOS site,
there is a problem that doesn't work.
Okay?
And of course, you can use that for protecting yourself.
Let's take an example.
There are two very high-speed scanners.
One is Musk and the other one is Z-map.
So when you see pockets coming through,
okay, and you see those pockets,
you immediately can realize that those pockets
are generated by somebody
that's special.
Okay, socket doesn't have to answer.
I don't know if that you know the answer already.
But anyway, there are no options.
There are not these specific options on those pockets.
Because these guys are standing as fast as possible.
I wait for you to send something back.
So if you see those pockets,
you can immediately say,
I want to stop this guy.
I don't have to go further in my communication.
Because this guy is an attacker.
So it's good for protecting yourself.
This is what I mean.
Without going to deep.
And of course, there are three things that is provided.
This is the most popular one.
Okay, about TLS or quick.
We have seen a lot about TLS and quick before.
In this case, we are thinking of printing delivery.
The TLS in part also the application sitting on top of it.
The most popular one at the moment is called J-A4.
And unfortunately, it's a big crazy.
Because this one, it's an operator with respect to J-A3.
Because J-A3 is not really usable.
Because it was based on the concept that you take certain parameters of TLS.
You put them in order to create the hash.
But recently in 2013, I think, so some years ago,
Google started to shuffle them just to avoid the devices
to be fingerprinting.
So because of that, there are 2,000 fingerprints created out of the same device.
So in S&J-A4, it's sorting them and creating fingerprint.
But the point is that the guy who made it
has created other type of fingerprints that are protected by a patent.
So they want to patent that.
From point to view, from the open source standpoint,
doesn't make any sense.
But it's also a crazy idea to patent, you know,
the objective is red or blue or green from a point to blue.
Anyway, that's my opinion.
So if you look at the J-A4, you will see that it's divided in three parts.
A-B-N-C, okay.
Let's forget A for a second.
Let's take B-N-C.
If you take B-N-C, inside the N-D-P-I,
well created there, you analyze quite some traffic.
So we have created this type of list.
So I know, for instance, if a certain traffic has been created by Chrome,
or by another browser.
Of course, this list will change,
because browser are changing.
So it's a constant, you know,
updates are constant 5.
But it's interesting to understand that data.
To understand which is very substantial,
that's potentially a problem.
Okay, the one, a certain browser,
to run.
This is an instant thing.
And of course, we have integrating a favorite tool.
Why should that can do that?
We don't have a lot of time today,
so I'm going to stop more or less here.
So what I wanted to say is that,
inside the N-D-P-I, inside this library,
there are various fingerprints about various protocols.
From simple one, let's say remote desktop,
okay, or SSH, to more complicated the ones.
So the interesting one, at the end of this talk,
that, again, I have no time to discuss them today.
Again, go into the why should conference,
retrospective, you can see the talk on the video.
It's about encrypted or obfuscated traffic.
So just to make this long story short,
encryption, okay, makes traffic hard to understand.
So theoretically, you should not be able to understand, right?
But sometimes the traffic is encrypted twice, okay?
Well, it's over encrypted, let's say,
so it looks like random data.
Okay, this is the type of information that is happening.
These type of things are happening.
Oh, there are some specific VPN, like Nord VPN, for instance.
They're using special techniques to further obfuscate the traffic.
Okay, this is an interesting thing.
It's in the API library, so it's also able to understand
that the techniques used by Chinese government
in the great China firewall.
So we're also able to understand this type of things,
and to recognize this type of traffic,
which is understand this type of techniques.
Again, for protection, okay, not for attack.
Final slide, we're organizing a conference
that is somehow a mix between, you know,
the community of the community from Wayshire,
meet in Zurich, in Switzerland, in May.
There are some speakers here today that we also speak.
So with some of you, it's willing to attend
in Central Europe that would be great.
Thank you very much for being here today.
Thank you.
Any questions?