ssl research with bro
play

SSL Research with Bro Johanna Amann International Computer Science - PowerPoint PPT Presentation

Feb 08, 2023 •254 likes •733 views

SSL Research with Bro Johanna Amann International Computer Science Institute johanna@icir.org http://www.icir.org/johanna Bro History Academic Host Context Time Machine Publications Summary Stats Enterprise Traffic HILTI DPI Concurrency

  1. SSL Research with Bro Johanna Amann International Computer Science Institute johanna@icir.org http://www.icir.org/johanna

  2. Bro History Academic Host Context Time Machine Publications Summary Stats Enterprise Traffic HILTI DPI Concurrency Tor SSL PLC Modeling OCSP Speed TRW 
 Android Root Certs Certificate Ecosystem State Mgmt. Heart bleed TLS Electronic Comm. Bro Cluster 
 Independ. State Spicy Shunt Certificate 
 NetControl Transparency Parallel Prototype Input Framework VAST Anonymizer 
 Active Mapping BinPAC Context Signat. Backdoors Stepping DPD SSL Trust USENIX Paper Stones Autotuning 2nd Path SSL Errors 2016 2016 1995 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2015 2014 v2.4 Broker, Plugins, v2.2 OCSP, SCT, 
 DTLS/KRB File Analysis v2.0 ERSPAN Vern writes Summary Stats v0.7a90 v1.5 User Experience v0.2 v0.8aX/0.9aX 
 v2.5, 1st line of v0.6 Profiling BroControl 1st CHANGES SSL/SMB SMB, NetControl, code RegExps v1.1/v1.2 State Mgmt entry STABLE releases VNC, StartTLS Login analysis when Stmt BroLite v2.1 Resource tuning v2.3 IPv6 Bro SDCI Broccoli Performance Input Framew. DPD SNMP, Radius, SSL++ v1.4 v0.4 
 v0.7a175/0.8aX v1.0 LBNL starts using Bro DHCP/BitTorrent HTTP analysis Signatures Bro Center BinPAC operationally HTTP entities Scan detector SMTP IRC/RPC analyzers NetFlow IP fragments 
 IPv6 support 64-bit support Bro Lite Deprecated Linux support User manual Sane version numbers v1.3 v0.7a48 0.8a37 Ctor expressions Communication Consistent CHANGES GeoIP Persistence Conn Compressor Namespaces Log Rotation

  3. Bro SSL - v1.5.3 Client Server ? Client hello Server hello Certificate ssl_certificate_seen ssl_certificate (Server Key Exchg) ssl_conn_attempt ssl_conn_alert Client Key Exchange ssl_conn_server_reply ssl_conn_weak Change Cipher Spec ssl_conn_established ssl_session_insertion Finished ssl_conn_reused process_X509_extensions Change Cipher Spec ssl_X509_error Finished Encrypted application data

  4. Bro SSL Events - v2.0 to 2.2 client_hello server_hello ssl_session_ticket_handshake ssl_established x509_certificate ssl_extension ssl_alert

  5. Bro SSL Events - v2.3 client_hello server_hello ssl_session_ticket_handshake ssl_established x509_certificate ssl_extension ssl_alert

  6. Bro SSL Events - v2.3 client_hello ssl_stapled_ocsp ssl_change_cipher_spec server_hello ssl_encrypted_data x509_extension ssl_session_ticket_handshake ssl_dh_server_params x509_ext_basic_constraints ssl_established ssl_change_cipher_spec x509_ext_subject_alternative_name x509_certificate ssl_handshake_message ssl_extension_elliptic_curves ssl_extension ssl_encrypted_data ssl_extension_application_layer_protocol_negotiation ssl_alert ssl_extension_ex_point_formats ssl_extension_server_name ssl_server_curve

  7. Bro SSL Events - v2.4 client_hello ssl_stapled_ocsp ssl_change_cipher_spec server_hello ssl_encrypted_data x509_extension ssl_session_ticket_handshake ssl_dh_server_params x509_ext_basic_constraints ssl_established ssl_change_cipher_spec x509_ext_subject_alternative_name x509_certificate ssl_handshake_message ssl_extension_elliptic_curves ssl_extension ssl_encrypted_data ssl_extension_application_layer_protocol_negotiation ssl_alert ssl_extension_ex_point_formats ssl_extension_server_name ssl_server_curve

  8. Bro SSL Events - v2.5 client_hello ssl_stapled_ocsp ssl_change_cipher_spec server_hello ssl_encrypted_data x509_extension ssl_session_ticket_handshake ssl_dh_server_params x509_ext_basic_constraints ssl_established ssl_change_cipher_spec x509_ext_subject_alternative_name x509_certificate ssl_handshake_message ssl_extension_elliptic_curves ssl_extension ssl_encrypted_data ssl_extension_application_layer_protocol_negotiation ssl_alert ssl_extension_ex_point_formats ssl_extension_server_name ssl_server_curve

  9. Bro SSL Events - v2.5 client_hello ssl_stapled_ocsp ssl_change_cipher_spec server_hello ssl_encrypted_data x509_extension ssl_session_ticket_handshake ssl_dh_server_params x509_ext_basic_constraints ssl_established ssl_change_cipher_spec x509_ext_subject_alternative_name x509_certificate ssl_handshake_message ssl_extension_elliptic_curves ssl_extension ssl_encrypted_data ssl_extension_application_layer_protocol_negotiation ssl_alert ssl_extension_ex_point_formats ssl_extension_server_name ssl_server_curve ssl_extension_signature_algorithm

  10. Bro SSL Events - v2.5 Completely working DTLS support client_hello ssl_stapled_ocsp ssl_change_cipher_spec server_hello ssl_encrypted_data x509_extension More StartTLS ssl_session_ticket_handshake ssl_dh_server_params x509_ext_basic_constraints ssl_established ssl_change_cipher_spec x509_ext_subject_alternative_name TLS 1.3 support x509_certificate ssl_handshake_message ssl_extension_elliptic_curves ssl_extension ssl_encrypted_data ssl_extension_application_layer_protocol_negotiation ssl_alert ssl_extension_ex_point_formats ssl_extension_server_name ssl_server_curve ssl_extension_signature_algorithm

  11. Bro SSL Events - master client_hello ssl_stapled_ocsp ssl_change_cipher_spec server_hello ssl_encrypted_data x509_extension ssl_session_ticket_handshake ssl_dh_server_params x509_ext_basic_constraints ssl_established ssl_change_cipher_spec x509_ext_subject_alternative_name x509_certificate ssl_handshake_message ssl_extension_elliptic_curves ssl_extension ssl_encrypted_data ssl_extension_application_layer_protocol_negotiation ssl_alert ssl_extension_ex_point_formats ssl_extension_server_name ssl_server_curve ssl_extension_signature_algorithm

  12. Bro SSL Events - master client_hello ssl_stapled_ocsp ssl_change_cipher_spec server_hello ssl_encrypted_data x509_extension ssl_session_ticket_handshake ssl_dh_server_params x509_ext_basic_constraints ssl_established ssl_change_cipher_spec x509_ext_subject_alternative_name x509_certificate ssl_handshake_message ssl_extension_elliptic_curves ssl_extension ssl_encrypted_data ssl_extension_application_layer_protocol_negotiation ssl_alert ssl_extension_ex_point_formats ssl_extension_server_name ssl_server_curve ssl_extension_signature_algorithm x509_ocsp_ext_signed_certificate_timestamp ssl_extension_supported_versions ssl_extension_psk_key_exchange_modes ssl_extension_signed_certificate_timestamp ocsp_request ocsp_request_certificate ocsp_response_status ocsp_response_bytes ocsp_response_certificate ocsp_extension

  13. Bro SSL Events - master client_hello ssl_stapled_ocsp ssl_change_cipher_spec server_hello ssl_encrypted_data x509_extension ssl_session_ticket_handshake ssl_dh_server_params x509_ext_basic_constraints OCSP support ssl_established ssl_change_cipher_spec x509_ext_subject_alternative_name SCT Support (Certificate Transparency) x509_certificate ssl_handshake_message ssl_extension_elliptic_curves ssl_extension ssl_encrypted_data ssl_extension_application_layer_protocol_negotiation TLS 1.3 extensions ssl_alert ssl_extension_ex_point_formats ssl_extension_server_name ssl_server_curve ssl_extension_signature_algorithm x509_ocsp_ext_signed_certificate_timestamp ssl_extension_supported_versions ssl_extension_psk_key_exchange_modes ssl_extension_signed_certificate_timestamp ocsp_request ocsp_request_certificate ocsp_response_status ocsp_response_bytes ocsp_response_certificate ocsp_extension

  14. TLS 1.3 ts 1505018739.255782 id.resp_h 104.19.196.102 version TLSv13-draft18 cipher TLS_AES_128_GCM_SHA256 curve x25519 server_name tls13.cloudflare.com established T cert_chain_fuids - client_cert_chain_fuids - subject - issuer -

  15. OCSP HTTPS OCSP Server Server client hello server hello OCSP request More handshake messages OCSP reply Application data Measuring the Latency and Pervasiveness of TLS Certificate Revocation L. Zhu, J. Amann, J. Heidemann, PAM 2016

  16. @load files/x509/log-ocsp ts 1438374033.033189 id FVty9v3KTnCvbg0Xf2 hashAlgorithm sha1 issuerNameHash 74241467069FF5E0983F5E3E1A6BA0652A541575 issuerKeyHash 0159ABE7DD3A0B59A66463D6CF200757D591E76A serialNumber 017447CB30072EE15B9C1B057B731C5A certStatus revoked revoketime 1421494379.000000 revokereason keyCompromise thisUpdate 1436321024.000000 nextUpdate 1443459307.000000

  17. Certificate Transparency CT Log CA Webserver Browser

  18. Certificate Transparency CT Log CA Certificate Webserver Browser

  19. Certificate Transparency CT Log CA Certificate Certificate Webserver Browser

  20. Certificate Transparency CT Log CA Certificate Certificate SCT Webserver Browser

  21. Certificate Transparency CT Log CA Certificate Certificate SCT Webserver Browser Certificate, SCT in TLS Ext.

  22. Certificate Transparency CT Log CA Webserver Browser

  23. Certificate Transparency Precertificate CT Log CA Webserver Browser

  24. Certificate Transparency Precertificate CT Log CA SCT Webserver Browser

  25. Certificate Transparency Precertificate CT Log CA SCT Certificate (with 
 Precertificate SCT) Webserver Browser

  26. Certificate Transparency Precertificate CT Log CA SCT Certificate (with 
 Precertificate SCT) Webserver Browser Certificate. Transform, Validate

  27. Certificate Transparency CT Log CA Webserver Browser

Download Presentation
Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend

TRESPASSING KNOWLEDGE RESEARCH AS BEING, RESEARCH AS DOING, RESEARCH AS PRACTICE. Research is

TRESPASSING KNOWLEDGE RESEARCH AS BEING, RESEARCH AS DOING, RESEARCH AS PRACTICE. Research is

1 Emma Bolland: Lecture for the MFA Art, Society & Publics. Duncan of Jordanstone College of Art and Design. 11/2/2014 TRESPASSING KNOWLEDGE RESEARCH AS BEING, RESEARCH AS DOING, RESEARCH AS PRACTICE. Research is not the privilege of

469 views • 13 slides
What is research? An Introduction COM 432 Dr Yeoh Kok Cheow What is research? Research is the

What is research? An Introduction COM 432 Dr Yeoh Kok Cheow What is research? Research is the

What is research? An Introduction COM 432 Dr Yeoh Kok Cheow What is research? Research is the systematic collection and interpretation of information. Research, more precisely, preliminary research, sheds light on the problem. It helps to

930 views • 49 slides
Tuberculosis Researches in Thailand

Tuberculosis Researches in Thailand

TB research lab >> TB research lab >> TB research lab >> TB research lab >> TB research lab >> TB research lab >> TB research lab >> TB research lab >> MMU MMU MMU MMU MMU MMU MMU MMU

227 views • 11 slides
An introduction to Open Research Library Research Services Research Data Service Research

An introduction to Open Research Library Research Services Research Data Service Research

An introduction to Open Research Library Research Services Research Data Service Research Engagement Librarians Kellie Snow Catherine Dack Zosia Beckles Cath Borwick Alex Clarke Course objectives By the end of the session you will be able

676 views • 63 slides
Types of Research and Research Design By Dario Kuzmanovi Office of Research Integrity UCR

Types of Research and Research Design By Dario Kuzmanovi Office of Research Integrity UCR

Types of Research and Research Design By Dario Kuzmanovi Office of Research Integrity UCR 12/9/16 Research Step into the unknown Process of discovering new knowledge Attempt to advance current information Fed definition of research

665 views • 19 slides
MS Research Revolution Research that will STOP MS in its tracks. Research that will RESTORE

MS Research Revolution Research that will STOP MS in its tracks. Research that will RESTORE

MS Research Revolution Research that will STOP MS in its tracks. Research that will RESTORE whats been lost. Research that will END MS forever. NOW, we need everyone to be a champion in the MS Research Revolution. Presented by Haley Titus

347 views • 8 slides
Where will your research take you? Why Do Research?

Where will your research take you? Why Do Research?

Where will your research take you? Why Do Research? Pursue your intellectual passions Meet mentors and peers who share your interests

536 views • 27 slides
1. CS research process Check research on prior work on this problem Who (where, when),

1. CS research process Check research on prior work on this problem Who (where, when),

Notes on research methodogy CS2001 fall 2003 Rami Melhem CS research process Writing a paper Refereeing an article Dissertation proposal Bibliographical search How to give a talk Research integrity *) most

573 views • 18 slides
Research can be fun, informative and relatively painless. All you need is a research kit and

Research can be fun, informative and relatively painless. All you need is a research kit and

Research can be fun, informative and relatively painless. All you need is a research kit and curiosity! Professor Sue Wheeler University of Leicester IACP Introduction to Research Day Dublin 12 October 2013 Dont run away yet, it may not be

405 views • 29 slides
Research Dis isrupted: Protecting Federal Research In Investments and the U.S .S. Research

Research Dis isrupted: Protecting Federal Research In Investments and the U.S .S. Research

Research Dis isrupted: Protecting Federal Research In Investments and the U.S .S. Research Work rkforce fr from COVID ID-19 Im Impacts Congressional Briefing Monday, July 27th, 2020 2:30pm 1 BRIE IEFING AGENDA Welcome &

604 views • 23 slides
Creative Research Methods Arts-based research Research using technology

Creative Research Methods Arts-based research Research using technology

Creative Research Methods Arts-based research Research using technology Mixed-methods research Transformative research frameworks Indigenous methodologies This presentation covers arts-based research; the next tech

223 views • 8 slides
9. Psychological Research and Methods Research: Big Questions Why do I need to know

9. Psychological Research and Methods Research: Big Questions Why do I need to know

9. Psychological Research and Methods Research: Big Questions Why do I need to know this? How do researchers get from hypothesis to results? What can I learn from reading research reports? How can I analyze research

578 views • 24 slides
Funding AMR research: the UK Research Councils John Savill Medical Research Council - UK MRC

Funding AMR research: the UK Research Councils John Savill Medical Research Council - UK MRC

Funding AMR research: the UK Research Councils John Savill Medical Research Council - UK MRC mission Encourage and support high-quality research with the aim of improving human health. Produce skilled researchers. Advance and

400 views • 17 slides
1. What is Operations Research (OR) 2 What is Operations Research? It is an application of

1. What is Operations Research (OR) 2 What is Operations Research? It is an application of

Unit 4 Systems Engineering Tools Deterministic Operations Research, Linear Programming Source: Introduction to Operations Research, 9th edition, Frederick S. Hillier, McGraw-Hill 1 1. What is Operations Research (OR) 2 What is Operations

905 views • 61 slides
1) Overview 2) Research Design:

1) Overview 2) Research Design:

FEP Research Design Market Research LGE 508 1) Overview 2) Research Design: Definition 3) Research Design: Classification 4) Exploratory Research 5) Descriptive Research i.

201 views • 16 slides
NICHD NICHD Research Mission & Research Mission & Research Mission & Research

NICHD NICHD Research Mission & Research Mission & Research Mission & Research

Presented at Mailman School of Public Health, Columbia University December 9, 2010 NICHD NICHD Research Mission & Research Mission & Research Mission & Research Mission & Eugene G. Hayunga, Ph.D. Eugene G. Hayunga, Ph.D.

542 views • 26 slides
Certificate Transparency Logs in Practice Josef Gustafsson, Linkping University Gustaf Overier,

Certificate Transparency Logs in Practice Josef Gustafsson, Linkping University Gustaf Overier,

A First Look at the CT Landscape: Certificate Transparency Logs in Practice Josef Gustafsson, Linkping University Gustaf Overier, Linkping University Martin Arlitt, University of Calgary, Canada Niklas Carlsson, Linkping University Proc. PAM

1.13k views • 82 slides
CONIKS (KEY TRANSPARENCY) Slides adapted from Marcela Melara The problem of the PKI (Public key

CONIKS (KEY TRANSPARENCY) Slides adapted from Marcela Melara The problem of the PKI (Public key

[USENIX Security 15, Marcela S. Melara, Aaron Blankstein, Joseph Bonneau, Edward W. Felten, Michael J. Freedman] CONIKS (KEY TRANSPARENCY) Slides adapted from Marcela Melara The problem of the PKI (Public key infrastructure) A long

918 views • 59 slides
Berkeley CS276 & MIT 6.875 Merkle Trees and Transparency Logs Lecturer: Raluca Ada Popa Oct

Berkeley CS276 & MIT 6.875 Merkle Trees and Transparency Logs Lecturer: Raluca Ada Popa Oct

Berkeley CS276 & MIT 6.875 Merkle Trees and Transparency Logs Lecturer: Raluca Ada Popa Oct 12, 2020 Announcements Starting to record This lecture: Applied: practice digital signatures and CRH in a real cryptographic system

439 views • 27 slides
CSE 333 Section 1 C, Pointers, and Gitlab 1 Logistics Due Friday: Exercise 0 @ 10:00 am Due

CSE 333 Section 1 C, Pointers, and Gitlab 1 Logistics Due Friday: Exercise 0 @ 10:00 am Due

CSE 333 Section 1 C, Pointers, and Gitlab 1 Logistics Due Friday: Exercise 0 @ 10:00 am Due Monday: Exercise 1 @ 10:00 am HW0 (setup Gitlab ASAP) @11 pm 2 Icebreaker! 3 attu/CSE VM Setup and Gitlab Demo 4 Attu/CSE VM Updates and gcc 9

461 views • 32 slides
Graph Covers and Iterative Decoding of Finite-Length Codes Pascal O. Vontobel (CSL, UIUC) Ralf

Graph Covers and Iterative Decoding of Finite-Length Codes Pascal O. Vontobel (CSL, UIUC) Ralf

CSL/UIUC Graph Covers and Iterative Decoding Graph Covers and Iterative Decoding of Finite-Length Codes Pascal O. Vontobel (CSL, UIUC) Ralf Koetter (CSL, UIUC) Talk at DIMACS, Piscataway, NJ, USA Dec. 15, 2003 Vontobel/Koetter transparency

542 views • 41 slides
Future Internet of Services Future Internet of Services 3 Perspective From a TAS 3 Perspective

Future Internet of Services Future Internet of Services 3 Perspective From a TAS 3 Perspective

Future Internet of Services Future Internet of Services 3 Perspective From a TAS 3 Perspective From a TAS Danny De Cock TAS 3 Project Coordinator Slides available from http://godot.be/slides Email: Danny.DeCock@esat.kuleuven.be Future

252 views • 12 slides
Transparency-Enhancing Tools PETs PhD Course at Chalmers Tobias Pulls Karlstad University,

Transparency-Enhancing Tools PETs PhD Course at Chalmers Tobias Pulls Karlstad University,

Transparency TETs Transparency Logging A4Cloud Summary Transparency-Enhancing Tools PETs PhD Course at Chalmers Tobias Pulls Karlstad University, Sweden tobias.pulls@kau.se October 29, 2012 Transparency TETs Transparency Logging

1.05k views • 59 slides
The Theory of Web Transparency: Algorithms and Trade-offs Augustin Chaintreau 1 , Guillaume

The Theory of Web Transparency: Algorithms and Trade-offs Augustin Chaintreau 1 , Guillaume

The Theory of Bringing Privacy into Practice, 2015 1/8 The Theory of Web Transparency: Algorithms and Trade-offs Augustin Chaintreau 1 , Guillaume Ducoffe 2 , 3 , Roxana Geambasu 1 , ecuyer 1 Mathias L 1Columbia University 2Univ. Nice Sophia

339 views • 14 slides

More recommend