In our previous skill we were out in the yard. Now I'm just picking with you. We were covering
deep packet inspection but we really were out in the yard. But the reason we cover deep packet
inspection and by itself and only alluded into antivirus evasion is because while in concept
the two may be very similar in idea meaning we're just trying to get past something in practice the
two are kind of apart because in deep packet inspection we're taking a look at the data as
it goes from point A to point B over the actual network itself and generally an IDS or IPS is
going to try its best to be able to dig into the packet as much as possible to see if there's any
information we can either utilize or go through and potentially prevent from getting to the actual
system in terms of protection against fintesters like us. But when we take a look at actual
antivirus evasion the packet is delivered to that actual endpoint. It's made it to its destination
and while not all of the data is fully decrypted there are exceptions which we'll cover here in a
second. The bulk of the data is going to be unpackaged and sent to the actual system for
processing whatever program it is that we're using that data in. Think of it in terms of web
browsing. We've made a request from us going to the Google and everything inside of that packet
is going to be encrypted at our user's workstation whatever we're using to browse to the Google.
As that request packet goes to the Google it's on the actual network itself and can be subjected to
deep packet inspection. Now that's again for in transit from point A to point B and by looking at
that packet as closely as we can we can see basically all the wrapping on it the headers
and all the other basic informations going down the OSI model from layers one to seven
as applicable and then as it gets to its destination it will be unpackaged for that
actual server request. Well if there's data inside of that package that is encrypted deep
packet inspection won't be able to inspect it unless it has the actual decryption keys. So
most of the time whenever you do a encrypted request it's usually something like username
password going to the Google and so you send that information to the Google and while all the
information can be subjected to deep packet inspection you can trust that your username
password is going to be protected so that way it doesn't get out and people just start logging into
your account. Well when we look at antivirus evasion this is when the packet actually makes it
to either the endpoint or the actual Google in our example and that packet has been opened up
and once the packet is opened up it's the data inside of it's going to be decrypted for in our
example here the actual authentication service that Google is using to verify that it is in fact
our username and password. So antivirus is going to take a look at the data and contents of that
actual packet and piece it all together to make a full series of packets to form out one the data
chunk and I'll come back to that in a second too but then as the antivirus is taking a look at the
actual data inside of those different packets it's going to make a determination of is that
malicious or not and usually on the user's end when data is coming to us it's in the field of
requested data that we asked for or information that we're downloading on the internet. Now I'm
not saying we use line wire or anything like that, just playing. You think of it like let's say we're
downloading an ISO of an operating system like Kali from the internet and when we take a look at
that actual data when it's unpacked let's say it was encrypted for some reason and start going
through the whole inspection list for it then the antivirus is going to sit there and make a
determination on if any of the pieces of information are legitimate and clear of any kind of malcontent
virus malware etc depending on the type of protection that you have and we'll be going
through a couple of examples as well too. You thought I forgot didn't you? Well I did and that's
why I have the ability to edit and go back and see what I missed. I was talking about data packets
and being able to put them together because we don't just transfer one file as one packet from
point A to point B what we do is we break it up into little bitty chunks to make it easier to
slip through the actual straw. Think of our bandwidth as a straw and the width of that straw
is the size of the object that can get from point A to point B. The larger the straw in diameter the
bigger the packets that you can send. Now packets and sizes of data file or datagrams are set by
standardized RFCs that you we get from IETF but there can be exceptions made and manual
configurations put into place as well but that kind of stuff is very far and few in between so
what happens is is that one file gets broken up into many different chunks and then sent from point
A to point B and using TCP with the three-way handshake we can make sure that all of it gets
there in in terms of a sequential order or if there's an out-of-sequence packet or whatever
the case may be or if it's UDP hope for the best but whenever we send packet by packet
we have to the antivirus on the actual endpoint system that we're working with
has to get all of those packets together at the end before it can make a determination based on
its rule set if there's anything malicious inside of the data that's been put together so while the
data is downloading let's say the Kali ISO we're going to use that as an example here in a little
bit you won't see any triggers on the actual antivirus but what you will see is that once
the ISO has been downloaded like at least with my third-party antivirus solution here it will
pop alarms when everything's been downloaded and put together into that one file that was
transmitted to us in those individual data packets and that's because once it made it to
its destination it put everything back together and can be read from beginning to end
so essentially if you just only get like three quarters of the packets of the file that you're
supposed to be getting overall it's like missing chapters out of a book and trying to read the
whole thing you can't make a determination if it's really a good book or a bad book until you
finish up the last couple of chapters could be that you got chapters one through seven and they
were really good but when you get chapters eight nine to ten the book turns out to be really bad