17 February 2011
Visualizing a VOIP security attack

Through our support of the Honeynet Project, we recently attempted a new approach to visualizing attacks on their VOIP honeypots.

With the increase in popularity of VOIP telephony, attacks are becoming more prevalent. The compromise of a VOIP system can cost the victim over $100,000 in real cash. For example, an Australian based company suffered $120,000 in toll fraud as a result of a VOIP compromise - read the full story here.

The video is intended to be a high level (if not stylized) visualization of the early stages of a cyber criminal compromising a VOIP system.


See the 640 wide standard definition version
See the 900 wide high definition version (please be patient while loading)

Credit to gltail, a ruby based tool to which we fed heavily modified logfiles, and Johann Pachelbel for his Canon.

25 October 2010
Mouse movement study


We wanted to find some interesting analogue data which could be collected and analysed quickly, and for this analysis to produce reasonably useful real world output. Well, we didn't have to look much further than the humble computer input device, the mouse (or in this case, a trackpad. All recordable by products like IOGraph). The goal of this analysis is to suggest improvements in the application design, screen layout, workflow, and of course the habits of the end user themselves. This is done by studying how the user interacts with the computer while performing ordinary, everyday tasks.
Here are the broad constraints of the data gathering exercise.
  • Approx 9 days of casual activity, from a volunteer using an Apple 13 inch laptop, using the inbuilt "trackpad" device
  • The user is experienced with computers
  • Computer was left on, never rebooted
  • The majority of usage is Internet browsing/twitter etc
  • Small amount of document creation, email, word documents, spreadsheets
  • Small amount of photo browsing
  • Main apps are Web browser, email client, Twitter client "Tweetdeck" with approx 10 columns, and a Internet Chat client
  • itunes running
This animation shows cumulative movements over time.

Now for the "reasonably useful output". Some interesting points can be made, note there are some obvious hotspots where the mouse was drawn to:
  • The top right is the screen lock "hot corner" where the user moves the mouse to lock the screen while away from the keyboard
  • There is a horizontal band towards the bottom right. This was due to the Tweetdeck framework not supporting horizontal two finger scrolling
  • The grouping at the bottom is the application dock, where user went to swap between applications
  • The clusters at the top and the middle are mostly email checking, and pushing "favourite" buttons inside the web browser (eg news)
Of course this data is very specific to the surfing habits of the user. The point is that efficiencies can be increased by changing some habits, improving workflow and application layout, and by introducing some useful features of the system itself (eg the multi finger gestures offered on the Mac). Examples include example keyboard shortcuts, and numerous trackpad gestures. The layout of the applications could also be changed to decrease the travel distance of mouse movements.

This concept can be stretched further to study highly repetitive task-orientated computing environments. Examples include Call centres and data entry environments where slight improvements in application design and usage patterns can produce significant gains in production, not to mention support higher levels of user engagement.
20 September 2010
Slides from various conferences - Data visualization and VOIP security

Over the last month, we delivered presentations on the following topics:
- Examples of data visualization of security datasets
- The Honeynet Project
- VOIP security and honeypot deployments and attack results
- VOIP attacker/defender demonstrations

The conferences are summarised below, and since the slide decks are somewhat similar, a summary set of slides has been prepared and can be downloaded here. Thanks go to the AFP, AISA and the ICT for the opportunity to share our research, results and ideas with the Law enforcement, academic and AISA communities.


20 September 2010
Spring update 2010

It's been very exciting and busy 6 months at dataviz Australia, here are some of the projects we've been working on since our last update.

  • Engagement with CERT Australia (Australian Federal Attorney General's Department)

  • Engagement with BHP Billiton (worlds largest diversified miner)

  • "ATM Voyager": Development of an interactive ATM performance data visualization tool suite as part of wider "Bank Voyager" product

  • Piloting of ATM Voyager with a major Australian bank

  • Preparation for NSW Fraud squad, and the NSW crime commission "ID Theft taskforce" on employing data visualization to identify credit card fraud/skimming

  • Honeynet Project: Administering and mentoring students in Google funded program "Summer of Code 2010"

  • Honeynet Project: Forensic Challenge on VOIP

  • Honeynet Project: VOIP internet attack research

  • Presentations at the AFP's High Tech Crime Conference, AISA Sydney and Melbourne branches, and the Ballarat Innovation ICT Cluster on data visualization and security.

In summary: As predicted, the demand for meaningful and engaging ways of creating business intelligence from masssive complex data sets is getting stronger. At the same time, we are finding the demand for security and cybercrime consulting is also healthy. We have projects that involve pure security consulting, and some that involve data visualisation in other fields (eg Finance Sector). Happily we also have some projects that call for both skillsets.
08 June 2010
Trojan pong, and other Shadowserver ideas

This small experimental project was done for the Shadowserver Foundation. They are a volunteer, Not for Profit organization who deal in the capture, analysis and dissemination of data and intelligence relating to nefarious activity on the internet. Shadowserver provided us with one day worth of data (which was several gigabytes) for us to apply some known techniques, and experiment with some new ones.

The idea of this project was simply to provide some ideas as to ways to represent their massive datasets visually. There's lot of work to go, however here are few early ideas. My favourite is a light-hearted time series visualization in the theme of an old favourite arcade game originally released in 1972 "Pong".



05 June 2010
Forensic Challenge - VOIP systems

As part of my contribution to the Honeynet Project, we have released the forth instalment in the "Forensic challenge" series. This challenge is focused in the world of VOIP telephony, which is a burgeoning area and one that is unfortunately often neglected when it comes to security treatment, and in particular in the study of the threat/incident environment. I've been studying the threat environment for over 18 months, working closely with the Norwegian chapter - you can read about some of this work in my honeynet blog.

The "VOIP forensic challenge" consists of real world attack data, and poses some technical and reflective questions which challenge participants to piece together the clues, and discover some hidden attributes of the attacks. Participants will learn much about VOIP along the way, and as a result they will be better armed to mitigate the risk of attacks to VOIP systems.

For the first time, we have translated the challenge into Chinese - both Traditional and Simplified versions. This will make the challenge accessible to an additional billion people. We are very excited about this, and are hoping for unprecedented participation. In designing the challenge, we formed a team with members from Norway, Hong Kong, China, Taiwan, Singapore, France and the US. I'm continually impressed by the collaborative global environment that exsists at the Honeynet project.

If you are in a position to advertise the challenge to students or security teams - please feel free to do so. Remember the goal is to participate, enjoy and learn!

Ben Reardon
04 March 2010
After our first month

Our first month has been extremely busy and quite productive.

In particular, we've been working on two new and interesting projects. One being a consultancy in the cybercrime field for the Federal Attorney General's "CERT Australia", and the other being an innovative data visualization project involving a recent high profile incident. While this work cannot be shown publicly, if you have a need to know, and come from a Law enforcement or other appropriate security agency, please contact us to discuss.

For three of the visuals produced for this project, we used a tool called "protovis" which is a relatively new javascript library of visualization tools. Using this tool, we produced an interactive piece where items of interest could be searched, filtered and drilled down on. We also used word frequency analysis techniques to describe some attributes of this incident in a high level, but easy to understand visual.

We continue to receive interesting from several parties, particularly in the Finance and IT sectors. In relation to data visualization, in the months ahead we hope to develop our exposure into the sales and marketing space, where clearly data visualization can provide a great deal of environmental intelligence to decision makers.

10 February 2010
After our first week

We've spent much of our first week taking feedback from supporters, which has been overwhelming. Interest in the initiative has been very encouraging, and so far this week we've had the following successes:

  • We've secured a new client for an exciting consultancy project in the cybercrime field (government sector)
  • We've had over 300 visitors to this website, almost half of them on our opening day, which was great to see.
  • We've had web traffic from 20 countries, the top 10 countries in order were Australia, United States, France, United Kingdom , Netherlands, Germany, Singapore, South Africa, Greece and Switzerland.
  • We've had constructive feedback from over 30 friends and supporters - thank you all!
  • We've made an agreement with one new organization for whom we will doing probono work
In summary, it has been a fantastic start to this venture!
04 February 2010
Open for business today!

We are proud to announce that we are open for business today !
Please view our gallery to get a sense of the work we produce and the potential uses in your environment.

http://dataviz.com.au
Copyright dataviz Australia 2010
contact@dataviz.com.au