ssl research with bro
play

SSL Research with Bro Johanna Amann International Computer Science - PowerPoint PPT Presentation

Dec 30, 2022 •172 likes •848 views

SSL Research with Bro Johanna Amann International Computer Science Institute johanna@icir.org http://www.icir.org/johanna SSL Client Server Client hello Server hello Certificate (Server Key Exchg) Client Key Exchange Change Cipher Spec

  1. SSL Research with Bro Johanna Amann International Computer Science Institute johanna@icir.org http://www.icir.org/johanna

  2. SSL Client Server Client hello Server hello Certificate (Server Key Exchg) Client Key Exchange Change Cipher Spec Finished Change Cipher Spec Finished Encrypted application data

  3. SSL Client Server client_hello Client hello (extensions) server_hello Server hello (extensions) Certificate x509_* events (Server Key Exchg) ssl_handshake_message Client Key Exchange ssl_handshake_message Change Cipher Spec ssl_change_cipher_spec Finished ssl_encrypted_data Change Cipher Spec ssl_change_cipher_spec Finished ssl_encrypted_data Encrypted application data ssl_encrypted_data

  4. Bro History Academic Host Context Time Machine Publications Summary Stats Enterprise Traffic HILTI DPI Concurrency Tor SSL PLC Modeling OCSP Speed TRW 
 Android Root Certs Certificate Ecosystem State Mgmt. Heart bleed TLS Electronic Comm. Bro Cluster 
 Independ. State Spicy Shunt NetControl Parallel Prototype Input Framework VAST Anonymizer 
 Active Mapping BinPAC Context Signat. Backdoors Stepping DPD SSL Trust USENIX Paper Stones Autotuning 2nd Path SSL Errors 2016 1995 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2015 2014 v2.4 Broker, Plugins, v2.2 DTLS/KRB File Analysis v2.0 Vern writes Summary Stats v0.7a90 v1.5 User Experience v0.2 v0.8aX/0.9aX 
 v2.5, 1st line of v0.6 Profiling BroControl 1st CHANGES SSL/SMB SMB, NetControl, code RegExps v1.1/v1.2 State Mgmt entry STABLE releases VNC, StartTLS Login analysis when Stmt BroLite v2.1 Resource tuning v2.3 IPv6 Bro SDCI Broccoli Performance Input Framew. DPD SNMP, Radius, SSL++ v1.4 v0.4 
 v0.7a175/0.8aX v1.0 LBNL starts using Bro DHCP/BitTorrent HTTP analysis Signatures Bro Center BinPAC operationally HTTP entities Scan detector SMTP IRC/RPC analyzers NetFlow IP fragments 
 IPv6 support 64-bit support Bro Lite Deprecated Linux support User manual Sane version numbers v1.3 v0.7a48 0.8a37 Ctor expressions Communication Consistent CHANGES GeoIP Persistence Conn Compressor Namespaces Log Rotation

  5. Bro SSL - v1.5.3 ssl_certificate_seen ssl_certificate ssl_conn_attempt ssl_conn_alert ssl_conn_server_reply ssl_conn_weak ssl_conn_established ssl_session_insertion ssl_conn_reused process_X509_extensions ssl_X509_error

  6. Bro SSL - v1.5.3 Client Server ? Client hello Server hello Certificate ssl_certificate_seen ssl_certificate (Server Key Exchg) ssl_conn_attempt ssl_conn_alert Client Key Exchange ssl_conn_server_reply ssl_conn_weak Change Cipher Spec ssl_conn_established ssl_session_insertion Finished ssl_conn_reused process_X509_extensions Change Cipher Spec ssl_X509_error Finished Encrypted application data

  7. Bro SSL - v2.0 client_hello server_hello ssl_session_ticket_handshake ssl_established x509_certificate ssl_extension ssl_alert

  8. Bro SSL - v2.1 client_hello server_hello ssl_session_ticket_handshake ssl_established x509_certificate ssl_extension ssl_alert

  9. Bro SSL - v2.1 Several bug fixes client_hello server_hello Parsing TLS server extensions works ssl_session_ticket_handshake More information in log file ssl_established x509_certificate ssl_extension ssl_alert

  10. Bro SSL - v2.2 client_hello server_hello ssl_session_ticket_handshake ssl_established x509_certificate ssl_extension ssl_alert

  11. Bro SSL - v2.2 Several bug fixes client_hello server_hello Client/server random available ssl_session_ticket_handshake ssl_established Support TLS 1.2 x509_certificate ssl_extension ssl_alert

  12. Bro SSL - v2.3 client_hello server_hello ssl_session_ticket_handshake ssl_established x509_certificate ssl_extension ssl_alert

  13. Bro SSL - v2.3 client_hello ssl_stapled_ocsp ssl_change_cipher_spec server_hello ssl_encrypted_data x509_extension ssl_session_ticket_handshake ssl_dh_server_params x509_ext_basic_constraints ssl_established ssl_change_cipher_spec x509_ext_subject_alternative_name x509_certificate ssl_handshake_message ssl_extension_elliptic_curves ssl_extension ssl_encrypted_data ssl_extension_application_layer_protocol_negotiation ssl_alert ssl_extension_ex_point_formats ssl_extension_server_name ssl_server_curve

  14. Bro SSL events - v2.4 client_hello ssl_stapled_ocsp ssl_change_cipher_spec server_hello ssl_encrypted_data x509_extension ssl_session_ticket_handshake ssl_dh_server_params x509_ext_basic_constraints ssl_established ssl_change_cipher_spec x509_ext_subject_alternative_name x509_certificate ssl_handshake_message ssl_extension_elliptic_curves ssl_extension ssl_encrypted_data ssl_extension_application_layer_protocol_negotiation ssl_alert ssl_extension_ex_point_formats ssl_extension_server_name ssl_server_curve

  15. Bro SSL events - v2.4 First DTLS support client_hello ssl_stapled_ocsp ssl_change_cipher_spec server_hello ssl_encrypted_data x509_extension TLS record layer fragmentation ssl_session_ticket_handshake ssl_dh_server_params x509_ext_basic_constraints ssl_established ssl_change_cipher_spec x509_ext_subject_alternative_name x509_certificate ssl_handshake_message ssl_extension_elliptic_curves ssl_extension ssl_encrypted_data ssl_extension_application_layer_protocol_negotiation ssl_alert ssl_extension_ex_point_formats ssl_extension_server_name ssl_server_curve

  16. SSL Protocol Basics • Record based protocol • Records do not have to map to TCP packets • Record header is never encrypted, only payload is 
 (after the handshake is done) Type Version Length Payload Record Header

  17. SSL Protocol Basics • Record based protocol Common record types: • Records do not have to map to TCP packets • Change Cipher Spec • Record header is never encrypted, only payload is 
 • Alert (after the handshake is done) • Handshake Type Version Length Payload • Application Data Record Header

  18. SSL Protocol Basics • Record based protocol • Records do not have to map to TCP packets • Record header is never encrypted, only payload is 
 (after the handshake is done) Type Version Length Payload Record Header

  19. Fragmentation Version: Length: Type: server_hello 1.2 66 Handshake

  20. Fragmentation Version: Length: Version: Length: Type: Type: server_hello certificate 1.2 66 1.2 3804 Handshake Handshake

  21. Fragmentation Version: Length: Version: Length: Version: Length: Type: Type: server_… ..hell.. o certificate 1.2 40 1.2 20 1.2 3810 Handshake Handshake

  22. Bro SSL events - v2.5 client_hello ssl_stapled_ocsp ssl_change_cipher_spec server_hello ssl_encrypted_data x509_extension ssl_session_ticket_handshake ssl_dh_server_params x509_ext_basic_constraints ssl_established ssl_change_cipher_spec x509_ext_subject_alternative_name x509_certificate ssl_handshake_message ssl_extension_elliptic_curves ssl_extension ssl_encrypted_data ssl_extension_application_layer_protocol_negotiation ssl_alert ssl_extension_ex_point_formats ssl_extension_server_name ssl_server_curve

  23. Bro SSL events - v2.5 client_hello ssl_stapled_ocsp ssl_change_cipher_spec server_hello ssl_encrypted_data x509_extension ssl_session_ticket_handshake ssl_dh_server_params x509_ext_basic_constraints ssl_established ssl_change_cipher_spec x509_ext_subject_alternative_name x509_certificate ssl_handshake_message ssl_extension_elliptic_curves ssl_extension ssl_encrypted_data ssl_extension_application_layer_protocol_negotiation ssl_alert ssl_extension_ex_point_formats ssl_extension_server_name ssl_server_curve ssl_extension_signature_algorithm

  24. Bro SSL events - v2.5 Completely working DTLS support client_hello ssl_stapled_ocsp ssl_change_cipher_spec server_hello ssl_encrypted_data x509_extension More StartTLS ssl_session_ticket_handshake ssl_dh_server_params x509_ext_basic_constraints ssl_established ssl_change_cipher_spec x509_ext_subject_alternative_name x509_certificate ssl_handshake_message ssl_extension_elliptic_curves ssl_extension ssl_encrypted_data ssl_extension_application_layer_protocol_negotiation ssl_alert ssl_extension_ex_point_formats ssl_extension_server_name ssl_server_curve ssl_extension_signature_algorithm

  25. ICSI Notary Outgoing SSL Sessions Internal Internet Network Bro Network Monitor Data Provider Collector Storage & Evaluation

  26. Notary - Collected features Available ciphers Timestamp Version Analyzer Error Packet loss Hash(client session ID) Client & Server TLS extensions Selected cipher Hash(client IP , server IP) Content length Server certificates Hash(server session ID) Connection history Server IP Ticket lifetime hint Duration Server Name Indication Client EC curve Client EC point formats DH parameter size Number Client Certs Send & received bytes Client & Server ALPN TLS Alerts

  27. Notary - Certificates

  28. http://notary.icsi.berkeley.edu

Download Presentation
Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend

TRESPASSING KNOWLEDGE RESEARCH AS BEING, RESEARCH AS DOING, RESEARCH AS PRACTICE. Research is

TRESPASSING KNOWLEDGE RESEARCH AS BEING, RESEARCH AS DOING, RESEARCH AS PRACTICE. Research is

1 Emma Bolland: Lecture for the MFA Art, Society & Publics. Duncan of Jordanstone College of Art and Design. 11/2/2014 TRESPASSING KNOWLEDGE RESEARCH AS BEING, RESEARCH AS DOING, RESEARCH AS PRACTICE. Research is not the privilege of

469 views • 13 slides
What is research? An Introduction COM 432 Dr Yeoh Kok Cheow What is research? Research is the

What is research? An Introduction COM 432 Dr Yeoh Kok Cheow What is research? Research is the

What is research? An Introduction COM 432 Dr Yeoh Kok Cheow What is research? Research is the systematic collection and interpretation of information. Research, more precisely, preliminary research, sheds light on the problem. It helps to

930 views • 49 slides
Tuberculosis Researches in Thailand

Tuberculosis Researches in Thailand

TB research lab >> TB research lab >> TB research lab >> TB research lab >> TB research lab >> TB research lab >> TB research lab >> TB research lab >> MMU MMU MMU MMU MMU MMU MMU MMU

227 views • 11 slides
An introduction to Open Research Library Research Services Research Data Service Research

An introduction to Open Research Library Research Services Research Data Service Research

An introduction to Open Research Library Research Services Research Data Service Research Engagement Librarians Kellie Snow Catherine Dack Zosia Beckles Cath Borwick Alex Clarke Course objectives By the end of the session you will be able

676 views • 63 slides
Types of Research and Research Design By Dario Kuzmanovi Office of Research Integrity UCR

Types of Research and Research Design By Dario Kuzmanovi Office of Research Integrity UCR

Types of Research and Research Design By Dario Kuzmanovi Office of Research Integrity UCR 12/9/16 Research Step into the unknown Process of discovering new knowledge Attempt to advance current information Fed definition of research

665 views • 19 slides
MS Research Revolution Research that will STOP MS in its tracks. Research that will RESTORE

MS Research Revolution Research that will STOP MS in its tracks. Research that will RESTORE

MS Research Revolution Research that will STOP MS in its tracks. Research that will RESTORE whats been lost. Research that will END MS forever. NOW, we need everyone to be a champion in the MS Research Revolution. Presented by Haley Titus

347 views • 8 slides
Where will your research take you? Why Do Research?

Where will your research take you? Why Do Research?

Where will your research take you? Why Do Research? Pursue your intellectual passions Meet mentors and peers who share your interests

536 views • 27 slides
1. CS research process Check research on prior work on this problem Who (where, when),

1. CS research process Check research on prior work on this problem Who (where, when),

Notes on research methodogy CS2001 fall 2003 Rami Melhem CS research process Writing a paper Refereeing an article Dissertation proposal Bibliographical search How to give a talk Research integrity *) most

573 views • 18 slides
Research can be fun, informative and relatively painless. All you need is a research kit and

Research can be fun, informative and relatively painless. All you need is a research kit and

Research can be fun, informative and relatively painless. All you need is a research kit and curiosity! Professor Sue Wheeler University of Leicester IACP Introduction to Research Day Dublin 12 October 2013 Dont run away yet, it may not be

405 views • 29 slides
Research Dis isrupted: Protecting Federal Research In Investments and the U.S .S. Research

Research Dis isrupted: Protecting Federal Research In Investments and the U.S .S. Research

Research Dis isrupted: Protecting Federal Research In Investments and the U.S .S. Research Work rkforce fr from COVID ID-19 Im Impacts Congressional Briefing Monday, July 27th, 2020 2:30pm 1 BRIE IEFING AGENDA Welcome &

604 views • 23 slides
Creative Research Methods Arts-based research Research using technology

Creative Research Methods Arts-based research Research using technology

Creative Research Methods Arts-based research Research using technology Mixed-methods research Transformative research frameworks Indigenous methodologies This presentation covers arts-based research; the next tech

223 views • 8 slides
9. Psychological Research and Methods Research: Big Questions Why do I need to know

9. Psychological Research and Methods Research: Big Questions Why do I need to know

9. Psychological Research and Methods Research: Big Questions Why do I need to know this? How do researchers get from hypothesis to results? What can I learn from reading research reports? How can I analyze research

578 views • 24 slides
Funding AMR research: the UK Research Councils John Savill Medical Research Council - UK MRC

Funding AMR research: the UK Research Councils John Savill Medical Research Council - UK MRC

Funding AMR research: the UK Research Councils John Savill Medical Research Council - UK MRC mission Encourage and support high-quality research with the aim of improving human health. Produce skilled researchers. Advance and

400 views • 17 slides
1. What is Operations Research (OR) 2 What is Operations Research? It is an application of

1. What is Operations Research (OR) 2 What is Operations Research? It is an application of

Unit 4 Systems Engineering Tools Deterministic Operations Research, Linear Programming Source: Introduction to Operations Research, 9th edition, Frederick S. Hillier, McGraw-Hill 1 1. What is Operations Research (OR) 2 What is Operations

905 views • 61 slides
1) Overview 2) Research Design:

1) Overview 2) Research Design:

FEP Research Design Market Research LGE 508 1) Overview 2) Research Design: Definition 3) Research Design: Classification 4) Exploratory Research 5) Descriptive Research i.

201 views • 16 slides
NICHD NICHD Research Mission & Research Mission & Research Mission & Research

NICHD NICHD Research Mission & Research Mission & Research Mission & Research

Presented at Mailman School of Public Health, Columbia University December 9, 2010 NICHD NICHD Research Mission & Research Mission & Research Mission & Research Mission & Eugene G. Hayunga, Ph.D. Eugene G. Hayunga, Ph.D.

542 views • 26 slides
ilab Lab 8 - SSL/TLS and IPSec Outlook: On Layer 4: Goal: Provide security for one

ilab Lab 8 - SSL/TLS and IPSec Outlook: On Layer 4: Goal: Provide security for one

Lehrstuhl fr Netzarchitekturen und Netzdienste Fakultt fr Informatik Technische Universitt Mnchen ilab Lab 8 - SSL/TLS and IPSec Outlook: On Layer 4: Goal: Provide security for one specific port SSL (Secure Socket Layer) /

812 views • 25 slides
Lecture 14 Transport Layer Security/ Secure Socket Layer (TLS/SSL) (Chapter 9 in KPS) SSL:

Lecture 14 Transport Layer Security/ Secure Socket Layer (TLS/SSL) (Chapter 9 in KPS) SSL:

Lecture 14 Transport Layer Security/ Secure Socket Layer (TLS/SSL) (Chapter 9 in KPS) SSL: Secure Sockets Layer v widely deployed security v original goals: protocol Web e-commerce transactions supported by almost all browsers,

609 views • 21 slides
Yasser F. O. Mohammad REMIDER 1: IPSec Uses REMINDER 2: IPSec Services Access control

Yasser F. O. Mohammad REMIDER 1: IPSec Uses REMINDER 2: IPSec Services Access control

Yasser F. O. Mohammad REMIDER 1: IPSec Uses REMINDER 2: IPSec Services Access control Connectionless integrity Data origin authentication Rejection of replayed packets a form of partial sequence integrity Confidentiality

818 views • 37 slides
The Design and Implementation of Protocol- Based Hidden Key Recovery Eu-Jin Goh, S tanford Dan

The Design and Implementation of Protocol- Based Hidden Key Recovery Eu-Jin Goh, S tanford Dan

The Design and Implementation of Protocol- Based Hidden Key Recovery Eu-Jin Goh, S tanford Dan Boneh, S tanford Philippe Golle, PARC Benny Pinkas, HP Labs Our contribution A key recovery syst em which is Hidden Unfilterable

594 views • 22 slides
TLS 1.3 Eric Rescorla Mozilla ekr@rtfm.com TLS 1.3 Real-World Crypto 2015 1 Goals for TLS

TLS 1.3 Eric Rescorla Mozilla ekr@rtfm.com TLS 1.3 Real-World Crypto 2015 1 Goals for TLS

TLS 1.3 Eric Rescorla Mozilla ekr@rtfm.com TLS 1.3 Real-World Crypto 2015 1 Goals for TLS 1.3 Clean up: Remove unused or unsafe features Improve privacy: Encrypt more of the handshake Improve latency: Target: 1-RTT handshake for na ve

543 views • 27 slides
Stone Knives and Bear Skins: Why does the Internet still run on pre-historic cryptography? Eric

Stone Knives and Bear Skins: Why does the Internet still run on pre-historic cryptography? Eric

Stone Knives and Bear Skins: Why does the Internet still run on pre-historic cryptography? Eric Rescorla ekr@rtfm.com Indocrypt 2011 Indocrypt 2011 Eric Rescorla 1 Overview Our cryptographic protocols use ancient algorithms In many

860 views • 57 slides
Networking in the Ethos Operating System Jon A. Solworth Dept. of Computer Science and Center

Networking in the Ethos Operating System Jon A. Solworth Dept. of Computer Science and Center

Networking in the Ethos Operating System Jon A. Solworth Dept. of Computer Science and Center for RITES University of Illinois at Chicago Dan Bernstein, Tanja Lange, Mike Petullo, Xu Zhang, Wenyuan Fei, Pat Gavin, Andrei Wartekin, Yaohua Li,

676 views • 34 slides
Secure Socket Layer (SSL) and Trnasport Layer Security (TLS) CSE598K/CSE545 - Advanced Network

Secure Socket Layer (SSL) and Trnasport Layer Security (TLS) CSE598K/CSE545 - Advanced Network

547 views • 16 slides

More recommend