Bro Network Programming Language & Bro-ids v2.1 Detecting Expiring SSL Certificates

Presented by Liam Randall 2013-3

ABOUT ME History  17 Years Consulting (1995)  BS in CS from XU  Dozens of Vender Certs  Speak/Train- Shmoocon, Skydogcon  “Applied NSM” Summer of 2013  #Bro  #SecurityOnion  [email protected]  @Hectaman Twitter/IRC

LINKS

github.com/bro github.com/liamrandall

#Bro_IDS @Hectaman @Bro_IDS

http://bro-ids.org http://liamrandall.com

OVERVIEW

“Can Bro IDS tell me when my SSL/TLS Certificates are about to expire?”

It already does.

FOLLOW ALONG Documentation http://www.bro-ids.org/documentationgit/scripts/policy/protocols/ssl/expiring-certs.html TL;DR: Add the following to your local.bro  @load policy/protocols/ssl/expiring-certs.bro  redef SSL::notify_certs_expiration = ALL_HOSTS; ( LOCAL_HOSTS, REMOTE_HOSTS, ALL_HOSTS, NO_HOSTS )

SSL/TLS USE CASES Widespread + + + + +

Credit Checks Authorization and Accounting Supply Chain Management e-Commerce Marketing

HTTPS

SMTP POP/IMAP

SSL/TLS VPN

SIP (DTLS)

DEMONSTRATION @load policy/protocols/ssl/expiring-certs.bro redef SSL::notify_certs_expiration = ALL_HOSTS; sudo broctl check sudo broctl install sudo broctl restart

DEMONSTRATION @load policy/protocols/ssl/expiring-certs.bro redef SSL::notify_certs_expiration = ALL_HOSTS; sudo broctl check sudo broctl install sudo broctl restart

DEMONSTRATION @load policy/protocols/ssl/expiring-certs.bro redef SSL::notify_certs_expiration = ALL_HOSTS; sudo broctl check sudo broctl install sudo broctl restart

DEMONSTRATION @load policy/protocols/ssl/expiring-certs.bro redef SSL::notify_certs_expiration = ALL_HOSTS; sudo broctl check sudo broctl install sudo broctl restart

DEMONSTRATION @load policy/protocols/ssl/expiring-certs.bro redef SSL::notify_certs_expiration = ALL_HOSTS; sudo broctl check sudo broctl install sudo broctl restart

DEMONSTRATION @load policy/protocols/ssl/expiring-certs.bro redef SSL::notify_certs_expiration = ALL_HOSTS; sudo broctl check sudo broctl install sudo broctl restart

DEMONSTRATION @load policy/protocols/ssl/expiring-certs.bro redef SSL::notify_certs_expiration = ALL_HOSTS; sudo broctl check sudo broctl install sudo broctl restart - or test from the command line bro –r test.pcap expiring-certs.bro config.bro

REAL WORLD: TLS EDITION Clients

Partners

REAL WORLD: TLS EDITION Clients

Partners

REAL WORLD: TLS EDITION Clients

Partners

REAL WORLD: TLS EDITION Clients

Partners

REAL WORLD: TLS EDITION Clients

Partners

REAL WORLD: TLS EDITION Clients

Partners

REAL WORLD: TLS EDITION Clients

Partners

REAL WORLD: TLS EDITION Clients

Partners

CONCLUSION

“How much will it cost your organization to not run Bro IDS?”

Bro Network Programming Language & Bro-ids v2.1 - GitHub

HTTPS. SMTP. POP/IMAP. SSL/TLS. VPN. SIP. (DTLS). SSL/TLS USE CASES. + Credit Checks. + Authorization and Accounting. + Supply Chain Management. + e-Commerce. + Marketing. Widespread ...
Download PDF
1MB Sizes 15 Downloads 297 Views
Report

Recommend Documents

BRO AND BRO-IDS - GitHub
Feb 17, 2013 - Larger Data Pipes; 10 x10 Gbps. Variety of Traffic. ISPs, Multinationals .... A vulnerable version of software was detected: Safari 4.0.0-Mobile ..... The compromised companies are not the final target. ... july-2012_itl-bulletin.pdf.
BRO AND BRO-IDS - GitHub
Feb 25, 2013 - DIRECTORY STRUCTURE bin etc. Include lib share bro base misc protocols ftp http irc smtp … frameworks utils broctl policy securityonion site ...
The Nile Programming Language - GitHub
Skia (Chrome, Android) ... if (currE->fLastY == curr_y) { .... Speedup on 40 core machine. 1. 10. 20. 30. 40. 0. 5. 10. 15. 20. 25. 30. 35. Cores. S p eed u p ...
The Ruby Programming Language - GitHub
You'll find a guide to the structure and organization of this book in Chapter 1. ..... Determine US generation name based on birth year ...... curly braces: "360 degrees=#{2*Math::PI} radians" # "360 degrees=6.28318530717959 radians" ...... of comput
IMAGI- Child Friendly Programming Language - GitHub
2. Introduction. Project Motivation. With the technology industry developing at a rapid pace, the need for more programmers increases everyday. Little options exist to introduce programming to kids successfully, this is why our team decided to attack
Build Your Own Programming Language with JavaScript - GitHub
Build Your Own. Programming Language ... Parser generators! OMeta-JS. Jison. PEG.js. JS/CC ... ook/LISP%201.5%20Programmers%20Manual.pdf.
Programming - GitHub
Jan 16, 2018 - The second you can only catch by thorough testing (see the HW). 5. Don't use magic numbers. 6. Use meaningful names. Don't do this: data("ChickWeight") out = lm(weight~Time+Chick+Diet, data=ChickWeight). 7. Comment things that aren't c
Interactive Console for the C Programming Language ... - GitHub
ccons. Interactive Console for the C. Programming Language. COMP 490 - Computer Science Project I. Concordia University - Winter 2009 by Alexei Svitkine.
Pawn The Language - GitHub
1. Foreword. “pawn” is a simple, typeless, 32-bit “scripting” language with a C-like syn- ... language in my publication in Dr. Dobb's Journal and the years since. .... cesses and runs on conforming Pawn programs —either interpreters or com
Programming Mobile Web - GitHub
Wordpress. Theme. Plugin. Joomla. Theme. Add on. Drupal. Module. Theme. More … Forum. Vanilla. esoTalk. Phpbb. More … More … Web server. Apache.
Open Shading Language 1.9 - GitHub
1 Introduction. 1. 2 The Big Picture. 5. 3 Lexical structure. 11. 3.1 Characters . .... OSL shaders are not monolithic, but rather can be organized into networks of ...
The C programming Language
A preprocessing step performs macro substitution on program text, inclusion of other .... Chapter 1 is a tutorial on the central part of C. The purpose is to get the ...... As an illustration of some of the bit operators, consider the function getbit
FRC Java Programming - GitHub
FRC Java Programming Last Updated: 1/11/2016 ..... NI Update Service .... network. When you have entered the team number and the roboRIO is connected, ...
Programming ESP8266-01 - GitHub
Programming ESP8266-01. Using ... Use Arduino IDE 1.6.5 (not higher). Page 7. Start Upload in Arduiono IDE via FTDI. • If you are using this board press the left.
Elementary programming - GitHub
VI Machine code. 9 .... nothing but consumes the same amount of time. zjmp %23 does : ... takes a register and displays the character the ASCII code of which is ...
Heterogeneous Parallel Programming - GitHub
The course covers data parallel execution models, memory ... PLEASE NOTE: THE ONLINE COURSERA OFFERING OF THIS CLASS DOES NOT ... DOES NOT CONFER AN ILLINOIS DEGREE; AND IT DOES NOT VERIFY THE IDENTITY OF ...
The C programming Language
3. The for statement. 4. Symbolic Constants. 5. Character Input and Output. 1. .... assignment or a function call, can be a statement. Pointers provide for .... The only way to learn a new programming language is by writing programs in it. The first 
Sliceable Network Management API - GitHub
virtualizing all layer 2 functions the API distributes resource management such ... can be categorized as Infrastructure as a Service (IaaS) in the cloud computing.
The C programming Language
developed, since both the system and most of the programs that run on it are written in C. The language, however, is not tied .... Most can be written in C, and except for the operating system details they conceal, are ... Chapter 7 describes the sta
VDM-10 Language Manual - GitHub
Overture Technical Report Series. No. TR-001. May 2017 ... Document history. Month. Year Version Version of Overture.exe Comment. April ... Contents. 1 Introduction. 1. 1.1 The VDM Specification Language (VDM-SL) . ..... 13.3.1 Classes .
ActionScript® 4.0 Language Specification - GitHub
Dec 13, 2012 - Computer Software Documentation,'' as such terms are used in 48 C.F.R. §12.212 ... Dec 5 2012 Added syntactic support for variable-length unicode escape ...... 365. Expression. 366. ReferenceExpression = Expression. 367.