The Spinning Cube of Potential Doom

An anonymous reader writes "This month's Communications of the ACM (does not seem to have a link to online text) has an article about The Spinning Cube of Potential Doom, a security visualization tool that I first saw at SC2003. The cube displays data from Bro along 3 axes and creates interesting visual results (port scans, barber poles, lawnmower). This definitely makes patterns in all that 'boring log data' jump out. This is a very interesting development, the ability to monitor in real time and replay historical security related information. Definitely a step towards the new types of tools we will need to secure hosts and networks."

Comments

Security is only one possible area for innovation

[CreamOfWheat]

When the eventual goal of having this data displayed in a real time setting the applications of usefulness will be startling. Data that had to be updated manually during the conference, will be available to researchers to do tci-square analysis to approximate the optimum network efficencies. Even use in the business sector and th ability to analyze huge databases will be quite amazing, although at least a half-decade down the road. Besides the primary educational aspect of the Cube, the secondary goal of the Cube will see fruition as to how investigate new techniques in visually analyzing network traffic and also to develop a tool that would potentially assist those involved with computer security. Really fascinating stuff.

Too bad...

[kdougherty]

Too bad Cisco didn't have this a couple weeks ago when they needed it!

dude!

[eegad]

I live in the spinning cube of potential doom. At least that's what my co-workers call it.

Re:dude!

[orthogonal]

I live in the spinning cube of potential doom. At least that's what my co-workers call it.

It sounds like something "Robert S." Rumsfeld would use to "persuade" "designated terrorists" in Abu Ghraib to talk.

I guess the use of "potential" in the title reminds me of so-called "Rumsfled Poetry":

"As we know,
There are known knowns.
There are things we know we know.
We also know
There are known unknowns.
That is to say
We know there are some things
We do not know.
But there are also unknown unknowns,
The ones we don't know
We don't know."

--Rumsfeld, at a February 12, 2002, Department of Defense news briefing

Re:dude!

[DerekLyons]

I guess the use of "potential" in the title reminds me of so-called "Rumsfled Poetry":

If you've ever taken a logic or philosophy class, or seriously studied science, or have been formally trained in troubleshooting real mission critical hardware/software (by that I mean the Space Shuttle, or a nuclear submarine, or a nuclear weapon, not your sales database)... Then that 'poetry' makes perfect sense.

Matter of fact, I used to say something much like that to the techs I was training to work on nuclear tipped missiles. So did the guys who taught me ASW. So did the official documents used to learn ASW tactics... In all of these these things, failing to take care to make sure that all your unknowns are known, or at least accounted for, can kill.

It only sounds ignorant to the ignorant.

Spinning Cube of Doom?

[stratjakt]

Sounds like the Time Cube.

But then, you stupid ignorant mind-traitors cant understand time cube having been manipulated by your word god.

Need new tool

[nizo]

Now we need tools that scan in a pattern that causes little devil faces to appear inside the cube, just to freak the sysadmin out. Words could be fun too.

Disappointment...

[The Human Cow]

Man, when I heard it could display data along 3 axes I was hoping for a error message featuring a little projection of somebody saying "Help me Obi-Wan Kenobi, you're my only hope."
Sad.

Can anyone explain the data we're seeing?

[Goobermunch]

Okay, so I see the pretty pictures, but what do they mean. Can anyone explain how to interpret that data?

--AC

Re:Can anyone explain the data we're seeing?

[upside]

It sets three variables onto three axes to show network traffic between your network and the net:

1) Your IP range
2) The entire IP range
3) Destination port

It's useful for things like picking up semirandom port scans that you might not detect based on textual data (see "barber poles").

Entire para:

"The Cube takes this connection information stored in the Bro files and displays it in a graphical format which can be more readily understood by people who are unfamiliar with networking and computer security techniques. The 'X' axis of the display (shown in red) represented the SCinet address space, which ranged from 141.221.128.0 - 141.221.255.255. The 'Z' axis (shown in blue) represented all possible IP address space (0.0.0.0 - 223.255.255.255). Multicast traffic (224.0.0.0 and above) was not displayed. The 'Y' axis (shown in green) represented the port number number (0-65535). Some well known port numbers include 22 (ssh), 25 (smtp), 80 (http). "

Re:Can anyone explain the data we're seeing?

[Have Blue]

The cube displays 3 pieces of information (assuming you know how TCP works):

• The X axis represents the local IP. Every computer on the LAN is at a unique location on this line.
• The Z axis represents all possible IP addresses. Every computer in the *world* is a unique location on that line, so every possible connection that can be made between a SCinet computer and an external system is somewhere on the "floor" of the cube. Think of it like an old phone switchboard.
• The Y axis represents the port number, so as two computers establish multiple TCP connections to each other they "stack" and move up towards the top of the cube.

The upshot of all this is that all network activity on the LAN during a specific time period can be placed in this cube. And once it's here in visual form, it becomes easy for a human operator to apply our brain's pattern recognition abilities to the problem of noticing unusual activity, which is hard to do with just a text dump from a normal IDS. Normal Internet usage would be a single point, or a small vertical line, which would represent a single persistent TCP connection for a specific service (for SSH or something) or a small number of TCP connections established momentarily (for a stateless protocol like HTTP), and this can be seen in the example as a lot of random dots scattered throughout the cube.

If there was an attack in progress, it would be some sort of procedural scan from one external system (a single Z location, or a constant depth in the example) across the LAN address space (going left to right) and/or the ports on a single LAN system (going up and down). A simple port scan would be a solid vertical line, as the attacker hit each port on a single system in sequence (Z and X constant, Y varying). I think there's one of these visible in the example, in the back; this short vertical line would be an attacker hitting all the privileged service ports between 0 and 1024. A more advanced attack pattern would attempt to randomize the ports it scanned or hit several different IPs - in a text log, this would be very hard to pick out from the "random" connections that a normal busy LAN is also handling, so the attacker could go undetected for some time. But on the Cube, this would appear as a filigree of closely packed dots all at the same depth (Z would be constant, X and Y varying), and would be immediately obvious to a human viewer.

This isn't really meant to convey detailed information, it's just supposed to let the admin see at a glance that something suspicious may be happening, by making the data easier to examine as a whole.

Re:Can anyone explain the data we're seeing?

[SiliconEntity]

Let me give a little commentary about what's in the sample cube pic. (BTW, does anybody have a mirror of the animation?)

We have a 3 dimensional cube shown on a 2 dimensional display, so the image can be a little confusing. Every dot represents a connection attempt to a machine at the conference, presumably mostly laptops being used by attendees. Successful connections are shown in "white" supposedly, but on my display they look gray. The colored dots are all unsuccessful connections, connection attempts where the machine did not respond. The presumption is that the vast majority of these are attacks and scans.

The left to right access represents the IP address of the machine at the confernece being attacked. Back to front is the IP address of the machine doing the attacking, from out on the internet. Bottom to top is the port number. To aid in viewing, the unsuccessful connections are shown in a color that represents the port, i.e. their height in the cube. That's all the color means. Red and orange are at the bottom for low numbered ports, then through yellow, green and blue in the middle ports, up to purple and back to red at the top for high number ports.

Now let's take a look at the picture. The main feature that jumps out is that most of the dots are colored; there are a lot more attacks than successful connections. Presumably these laptops are not hosting many legitimate servers. Second, we see that most of the dots are orange, meaning that they are attempts to connect on low numbered ports. That makes sense, as most services listen on standard low numbered ports of 1024 or less, or a bit more. That's why we see so many orange dots. Those are attempts to connect to web servers, mail servers, various Windows services that are known to be vulnerable, etc.

Another feature of the orange dots is that they are largely clustered towards the back, which would mean that the attacks are coming from Internet addresses which are relatively low in the address range. Looking closely, I make it out to be about 1/4 of the way from the back to the front, which would correspond to IP addresses of around 64.X.X.X. If we look at the first field of IPV4 addresses, ARIN (North America) has 24, then 63-70; APNIC (Asia/Pacific) has 60-61; RIPE (Europe) has 62, then 80-84, and all of them go on up from there. I'm not sure of the worldwide distribution of IP addresses but I suspect that accounts for the fact that many of the attacks and scans are coming from the 60-80 range or so, on the graph. There's another cluster of IPV4 address assignments in the 198-222 range, and that corresponds to a weak cluster of orange dots near the front of the cube, at the bottom.

Another feature we can see is some vertical structure in the blue and cyan dots, especially to the left and the right. These represent port scans, where a particular host machine is making connection attempts to a series of port numbers on a particular target machine. Such scans show up as vertical lines. Here we don't have a full line but only aligned dots, so we may be missing some packets, or the scan may be accessing only selected ports.

Well, that's about as far as I can go with my analysis. But you can see that if you had a real-time display of the last N minutes or seconds of activity, it would show you a visual picture of scans into your network. Probably be pretty hypnotic. Of course I'm not sure it makes sense to pay somebody to stare at it all day... you'd probably want to run a sped-up version at the end of the day and see if anything untoward leaped out.

Does this have to do with

[BodyCount07]

this cube of doom?

bah

[mrtroy]

This is old news.

Security companies are just reacting to Swordfish...which used the opposite tool...it was spinning cubes that joined together when you successfully exploited the system.

Re:bah

[DoctorDeath]

Swordfish brought to life was my first thought. A poor graphic representation of programmers code is now a reality. What's next flip open communicators? Oh wait...

I wonder....

[telstar]

Wonder if they've got one of these monitoring DOS attacks now that they've been posted on Slashdot.
Here's the 31 meg AVI if you want to make it spin faster.

Re:I wonder....

[itwerx]

Here's the 31 meg AVI if you want to make it spin faster.

Link is dead already (they yanked the file). :(

If this continues...

[Kirijini]

If this becomes a trend, and "Secutiry Visuallization Tools" become widespread... then people will begin to say that movies like Hackers and such were just "before their time."

Do we really want that?

Re:If this continues...

[TigerNut]

It's pretty inevitable. There will always be extensions to today's technology, and likewise there will be visionaries (authors and screenwriters) who will try to imagine what that extended technology will look like and what it will feel like to use it. The visual scanning is pretty cool. What if you took a port-access logger output and assigned to each port a particular note, duration, or loudness? You'd hear white noise for the most part, but any nonrandom access would quickly be evident as a chirp, whistle or popping.

Working in a cube farm is hard enough

[Anonymous Coward]

Now I have to figure out how to get in and out while it's spinning?

And it's a good damn thing I've got a wireless LAN connection, so my cat5 cable won't get all twisted up.

I beg to differ

[broothal]

"Definitely a step towards the new types of tools we will need to secure hosts and networks."

I'm sorry, but I do not agree. While it makes it easy to visually detect intrusion attempts, it is of no use in the daily life of a BOFH. I have the responsibility of quite a number of machines. Most of the time, they don't require attention. So I don't pay them any. Then, once in a while, something extraordinary is happening, and I'm being alerted by an automatic monitoring system. That means I can use my day on all the important things (like hanging out on IRC etc). Visualizing network intrusion attempts is cool, but it's not a tool for me.

Re:I beg to differ

[Minwee]

The daily life of most admins include something called "Talking To Managers".

Having a shiny toy with brightly coloured lights on it is a vital part of that excercise for many of us. We NEED this. We NEED it to have the Fisher-Price logo on it and play short musical bits when you push on the buttons. We NEED to be able to say "Here is a pretty picture. You like pretty pictures, don't you? The brightly coloured parts show bad people. Oooh, brightly coloured. Look at the picture. Do you like the picture? Good, now there are a few things we need to discuss about next year's budget..."

Automated monitoring systems that handle problems for you make you (and themselves) look unnecessary. Pretty pictures with lights can be used to show everybody you work for just how important you really are.

Just like in Tron!

[beatleadam]

The cube displays data from Bro along 3 axes and creates interesting visual results (port scans, barber poles, lawnmower).

"So Cube...do you see anyone invading us from the 201.163.x.x range?" "YES"

"That's Tron. He fights for the Users."

virtual ICE?

[dashersey]

This is evocative of william gibson's concept of ICE -- in a massively distributed computing environment with a direct-brain virtual-reality interface as primary, you interact with security systems visually.

They appear as complex crystalline structures with no obvious holes other than the known authentication interfaces.

Those who hack/defeat them are called "icebreakers" and they use software which has its own visual attack signature to distract or deflect(overload/DNS attack) the ice or to find hidden cracks (exploits)

Visionary stuff (pun partially intended).

Re:virtual ICE?

[scrytch]

Give Gibson's work another read: it's just the "cowboys" who got an interface that direct, it required very expensive and specialized neurosurgery to install, and it required quite a bit of special firmware to create the visualizations, some of which would probably have been simply visual flair ala "skins", perhaps created in order to harness psycological reactions to perception (e.g. make the stuff you scan as "dangerous" look really baaaad) .

He also mentions that ordinary people got something a good deal more pedestrian, more like the Metaverse than Gibson's Matrix (or as we might say now, more like the Matrix than the funky green overlay Neo got ... I'd stay away from using those movies for parallels tho).

Re:virtual ICE?

[James Lewis]

I disagree. Gibson's whole description of icebreaking was interesting science fiction, rather than something that was really attempting to make an informed guess on how future computer systems would work. For one thing, users could be killed by the security systems through their connection. It seems increadibly unlikely to me that this would ever occur, since any system connected to the internet should be able to handle disconnections, and so one could be produced on purpose the moment trouble showed up. But obviously, it made for a much more exciting plot. The same goes for the visual stuff, it's a lot more interesting than someone spending days maticulously banging away at a system. Gibson's a great author, but I think it silly to give him credit for things he obviously didn't intend in his books. By is own admission, Gibson is no techie. He writes fiction, and trying to pull deeper meaning (or predictions of the future) out of it is a waste of time.

what a great name

[surreal-maitland]

it looks like a great tool for ferretting out new styles of attack, even though it's use to an individual trying to protect his/her network is rather limited. the automated system that someone else mentioned sounds much more useful.

Re:Security is only one possible area for innovati

[Laxitive]

Besides the primary educational aspect of the Cube, the secondary goal of the Cube will see fruition as to how investigate new techniques in visually analyzing network traffic and also to develop a tool that would potentially assist those involved with computer security.

Yes. The Cube knows all. It will make everything all right again. The Cube has been sent to help us. We must trust the Cube.

All hail the Cube.

-Laxitive

Sorry, absolutely nothing of value to add to this. I just liked the way you referred 'the Cube' using proper-noun capitalization, and spoke of it as a single entity.

If only I had this when...

[teamhasnoi]

I was hacking teh Gibson, *I* would have gotten in Acid Burn's undies. :(

I wonder...

[daemonc]

I wonder what the 3D graph of a Slashdotting looks like...

Re:I wonder...

[aliens]

Actually it's not so much a 3D graph as it is a flatline of the server's heartbeat.

Re:I wonder...

[Have Blue]

I imagine it would look like a thick, mottled square or blob drawn on a plane perpendicular to the X axis. It would represent a large number of external systems (large Z extent) connecting to a single web server (single X value) and taking up a large number of ports with HTTP transfers (large Y extent).

The human mind: A better monitoring system?

[zipwow]

I think the point of this interface is that the data is more easily interpreted, allowing the human-user to notice patterns that automated scripts would miss. This could be done either in real time, or as a visualization tool for historical files. The latter usage seems like it would be of interest if you're trying to determine the source of a break-in.

For real-time monitoring, your point about mutliple systems is very valid, but what if this approach could be scaled up to allow you to visually inspect the whole system for a number of problems? Perhaps an entire array of cubes, each for a subnet or an individual system, focusing on those that pique your interest.

This idea may be able to mesh with the glanceable objects idea (just the idea, not their chicken egg specifically). If it is informative enough, it could allow you to periodically check some aspects of your whole system for things that you either can't write scripts to do, or don't have time to write scripts for.

-Zipwow

Re:The human mind: A better monitoring system?

[Danny Rathjens]

Precisely. Using the human mind as a filter is the whole point. There is also a project called peep that does this with sound.

Peep - Allows real-time aural monitoring of network information Peep aims to represent network information in real-time (and therefore eliminate searching through large logs of information to find problems) by using sound to represent the vast amount of available information about network status and to help identify network problems and irregularities.

The project looks a bit stalled, but it's still a really cool idea. You could probably find some stories about it in /. archives too, ;) I thought it was neat that apparently nasa follows this philosophy with sounds for astronauts to filter/interpret on the space shuttle.

Remember!

[telstar]

Warning: Pregnant women, the elderly and children under 10 should avoid prolonged exposure to the Spinning Cube of Potential Doom.
Caution: the Spinning Cube of Potential Doom may suddenly accelerate to dangerous speeds.
the Spinning Cube of Potential Doom Contains a liquid core, which, if exposed due to rupture, should not be touched, inhaled, or looked at.
Do not use the Spinning Cube of Potential Doom on concrete.

Discontinue use of the Spinning Cube of Potential Doom if any of the following occurs:
Itching
Vertigo
Dizziness
Tingling in extremities
Loss of balance or coordination
Slurred speech
Temporary blindness
Profuse sweating
Heart palpitations

If the Spinning Cube of Potential Doom begins to smoke, get away immediately. Seek shelter and cover head.
the Spinning Cube of Potential Doom may stick to certain types of skin.

When not in use, the Spinning Cube of Potential Doom should be returned to its special container and kept under refrigeration...

Failure to do so relieves the makers of the Spinning Cube of Potential Doom, Wacky Products Incorporated, and its parent company Global Chemical Unlimited, of any and all liability.

Ingredients of the Spinning Cube of Potential Doom include an unknown glowing substance which fell to Earth, presumably from outer space.

the Spinning Cube of Potential Doom has been shipped to our troops in Saudi Arabia and is also being dropped by our warplanes on Iraq.

Do not taunt the Spinning Cube of Potential Doom.

the Spinning Cube of Potential Doom comes with a lifetime guarantee.

the Spinning Cube of Potential Doom

ACCEPT NO SUBSTITUTES!

Re:Remember!

[delus10n0]

At least give credit where credit is due!

SGI did this years ago

[green pizza]

Back in the "what possible use would anyone have for 3D?" days, Silicon Graphics made gobs of 3D utilities such as this. Many exist today as viewers for their (awesome) Performance CoPilot system for IRIX and Linux. Over time they learned that most admins perfer text most of the time. But man, fddivis on a large monitor sure does make the NOC look way more productive to the suits!!

They even had a 3D intra-website link manager at one time!

Missing the point?

[Hythlodaeus]

Did someone just discover that data can be graphed? What is the innovation here?

Re:Missing the point?

[Herkum01]

Management: That looks good but can you use a pie chart instead? I just get whoozy looking at it...

Boon to social engineers!

[stratjakt]

Got some slick, nobody's fool sysadmin you need to get past?

Well, cook up a portscan that will look like a giant, spinning Mr Goatse, or some racial slurs, etc..

Boss walks past, geek gets fired, replaced by bosses moron nephew who is more than happy to give you the keys to the server when you call and identify yourself as the Hamburglar.

Re:check out the video!

[JebuZ]

Same thing, but hosted by Akamai9 (faster).

No, it has to do with..

[Conspiracy_Of_Doves]

this one

Old stuff, new usage

[bellwould]

Visible Decisions (acquired by Visual Insights in 2000) has been doing graphical visualization for 15 years - check this out for a demo.

Re:Gleming the cube

[k98sven]

those web sites didn't work. The urls have been Slashdotted already.

Yup. And they're .gov top domain!
Given the PATRIOT act, does this mean we're all terrorists now?

I'll get the "Free Taco!" campaign started right now, just in case. We can only hope the general public will misunderstand.

(I'm hungry, so?)

This and the orb?

[novakane007]

Remember the ambient orb?
Thinkgeek used to sell them, but I couldn't think of something I would find it useful for. This would be perfect. Just have a globe on your desktop that changes colors based on the data provided by the cube matrix. If the orb starts turning crimson, you know that that your network is in need of administrative attention.

It's interesting, alright - to HOLLYWOOD...

[Digital Avatar]

...I can see it now:

I know this... this is UNIX!

Would you like to play a game>

In Rod We Trust

[runlvl0]

All hail the Cube.

from "Deep Space Homer"
Buzz: Homer Simpson was the real hero here. He jury-rigged the door closed using this.
Man 1: Hey, what is that?
Man 2: It's an inanimate carbon rod!
Everyone: Yay!

Time magazine cover: "In Rod We Trust"

Data visualization using Strange Attractors

[freelunch]

About 18 months ago, Slashdot posted an article The Black Ops of TCP/IP: Paketto Keiretsu 1.0 Release with a nice collection of unconventional networking tools.

Included was a very cool tool, Phentropy, for visualizing arbitrary data using Strange Attractors. You may recall a paper on TCP/IP Sequence number analysis that highlighted the usefulness of Strange Attractors for data visualization.

Phentropy plots an arbitrarily large data source (of arbitrary data) onto a three dimensional volumetric matrix, which may then be parsed by OpenQVIS. Data mapping is accomplished by interpreting the file as a one dimensional stream of integers and progressively mapping quads in phase space.

OpenQVIS is a neat package and could fill a lot of arbitrary data viz needs.. But damned if I have been able to get the thing to build under Linux. The project could really use some help, and I think a lot of good could come of it. The Phd types who wrote it seem to have mostly moved on..

What a pity it will not be useful for too long...

[PaulBu]

... After all the $$M spent on cute visualization and PR promotion of the technology, evil authors of port-scanners just add two lines:

pseed=urand(); iseed=urand(); /* this */
for(port ...)
for(ip ...){
port ^= pseed; ip^=iseed; /* and this */
probe(ip,port);
}

or use some fancier one-to-one mapping and the dots in your cube are again "random" to the naked eye.

(On a side note, why whoever implemented that "barberwire"-producing scanner did not do this at the time, I can not understand).

Paul B.

saw it as SC2003 as well...

[painehope]

I busted out my laptop and sat down and started port-scanning some friendly IPs in front of the screen, only to be disappointed that I'd have to wait something like 10 minutes to see my spray coming out.

It was still pretty cool, and I'm sure half of the traffic on it was people like who kicked off port scans just to see themselves on the screen ;p

Mirror?

[ktulu1115]

Could someone who has downloaded the movie please post a mirror? All of the existing links posted are already 404.

Re:What a pity it will not be useful for too long.

[khrtt]

The time is NOT a display variable in the Cube. Your "enhanced" scanner would produce the same pattern as it would without the randomization. The order in which the scan's packets reach its target, and the dots are put on the display does not even change the resulting picture.

Now, the "barbwire" scan tries a port on each host. This could be made less distinguishable by randomizing the port, rather than using linearly increasing port numbers for the IP range, which produces the evel-looking diagonal slashes in the picture.

All Glory to the HypnoCube

[Slau]

Thanks for the /. and the comments folks, although I'm not sure if the web admins are gonna talk to me anymore. :-/ I got paged about the /. while I was watching Shrek 2. What happened to Fiona's Dad? Missed that part...oh well... The Cube is still a work in progress. I originally developed it to keep wandering jaded conference attendees mesmerized by pretty moving colors. Hopefully it'll inspire people to develop new ways of educating the wormy masses that they need to take security seriously.

We have something similar

[Isomer]

I work for a network research group ("WAND") at Waikato University in New Zealand. We have a similar visualisation which you can see various stages of evolution here, there are also some animations.

The universities internal network IP range is mapped onto the left hand face of the cube, the rest of the world is mapped onto the right face. They are mapped so similar addresses are clustered together and addresses further apart are uh, further apart. A box represents one packet, the volume of the particle is proportional to the size of the packet, and the colour is based on port number.

Also we "light" each end of the connection for a bit after the packet has been sent. So machines appear to be glowing in the colour of the traffic they are sending.

We use it to show off "networks" to people who think we just sit at computers and type into stuff, however it has been very useful to detect attacks and broken machines since they provde distinctive patterns. Portscans are a series of "sparkly" packets. Network scans are a row of marching lines. Virii infected machines appear as a cone centered on the infected machine.

My favorite...

[Nugget]

Much lower tech, but my favorite example or a conference's realtime security monitoring is this whiteboard from the 2000 Monterey BSDCon.

It's a brutal but compelling reminder that we should all avoid unencrypted telnet/pop3/imap.

Consider spending some time today getting STARTTLS running on your mail server. Or consider getting IMAP/SSL going. Or consider figuring out GnuPG or S/MIME email once and for all. Don't be part of the problem.