ssl research with bro
play

SSL Research with Bro Johanna Amann International Computer Science - PowerPoint PPT Presentation

Feb 08, 2023 •254 likes •733 views

SSL Research with Bro Johanna Amann International Computer Science Institute johanna@icir.org http://www.icir.org/johanna Bro History Academic Host Context Time Machine Publications Summary Stats Enterprise Traffic HILTI DPI Concurrency

  1. SSL Research with Bro Johanna Amann International Computer Science Institute johanna@icir.org http://www.icir.org/johanna

  2. Bro History Academic Host Context Time Machine Publications Summary Stats Enterprise Traffic HILTI DPI Concurrency Tor SSL PLC Modeling OCSP Speed TRW 
 Android Root Certs Certificate Ecosystem State Mgmt. Heart bleed TLS Electronic Comm. Bro Cluster 
 Independ. State Spicy Shunt Certificate 
 NetControl Transparency Parallel Prototype Input Framework VAST Anonymizer 
 Active Mapping BinPAC Context Signat. Backdoors Stepping DPD SSL Trust USENIX Paper Stones Autotuning 2nd Path SSL Errors 2016 2016 1995 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2015 2014 v2.4 Broker, Plugins, v2.2 OCSP, SCT, 
 DTLS/KRB File Analysis v2.0 ERSPAN Vern writes Summary Stats v0.7a90 v1.5 User Experience v0.2 v0.8aX/0.9aX 
 v2.5, 1st line of v0.6 Profiling BroControl 1st CHANGES SSL/SMB SMB, NetControl, code RegExps v1.1/v1.2 State Mgmt entry STABLE releases VNC, StartTLS Login analysis when Stmt BroLite v2.1 Resource tuning v2.3 IPv6 Bro SDCI Broccoli Performance Input Framew. DPD SNMP, Radius, SSL++ v1.4 v0.4 
 v0.7a175/0.8aX v1.0 LBNL starts using Bro DHCP/BitTorrent HTTP analysis Signatures Bro Center BinPAC operationally HTTP entities Scan detector SMTP IRC/RPC analyzers NetFlow IP fragments 
 IPv6 support 64-bit support Bro Lite Deprecated Linux support User manual Sane version numbers v1.3 v0.7a48 0.8a37 Ctor expressions Communication Consistent CHANGES GeoIP Persistence Conn Compressor Namespaces Log Rotation

  3. Bro SSL - v1.5.3 Client Server ? Client hello Server hello Certificate ssl_certificate_seen ssl_certificate (Server Key Exchg) ssl_conn_attempt ssl_conn_alert Client Key Exchange ssl_conn_server_reply ssl_conn_weak Change Cipher Spec ssl_conn_established ssl_session_insertion Finished ssl_conn_reused process_X509_extensions Change Cipher Spec ssl_X509_error Finished Encrypted application data

  4. Bro SSL Events - v2.0 to 2.2 client_hello server_hello ssl_session_ticket_handshake ssl_established x509_certificate ssl_extension ssl_alert

  5. Bro SSL Events - v2.3 client_hello server_hello ssl_session_ticket_handshake ssl_established x509_certificate ssl_extension ssl_alert

  6. Bro SSL Events - v2.3 client_hello ssl_stapled_ocsp ssl_change_cipher_spec server_hello ssl_encrypted_data x509_extension ssl_session_ticket_handshake ssl_dh_server_params x509_ext_basic_constraints ssl_established ssl_change_cipher_spec x509_ext_subject_alternative_name x509_certificate ssl_handshake_message ssl_extension_elliptic_curves ssl_extension ssl_encrypted_data ssl_extension_application_layer_protocol_negotiation ssl_alert ssl_extension_ex_point_formats ssl_extension_server_name ssl_server_curve

  7. Bro SSL Events - v2.4 client_hello ssl_stapled_ocsp ssl_change_cipher_spec server_hello ssl_encrypted_data x509_extension ssl_session_ticket_handshake ssl_dh_server_params x509_ext_basic_constraints ssl_established ssl_change_cipher_spec x509_ext_subject_alternative_name x509_certificate ssl_handshake_message ssl_extension_elliptic_curves ssl_extension ssl_encrypted_data ssl_extension_application_layer_protocol_negotiation ssl_alert ssl_extension_ex_point_formats ssl_extension_server_name ssl_server_curve

  8. Bro SSL Events - v2.5 client_hello ssl_stapled_ocsp ssl_change_cipher_spec server_hello ssl_encrypted_data x509_extension ssl_session_ticket_handshake ssl_dh_server_params x509_ext_basic_constraints ssl_established ssl_change_cipher_spec x509_ext_subject_alternative_name x509_certificate ssl_handshake_message ssl_extension_elliptic_curves ssl_extension ssl_encrypted_data ssl_extension_application_layer_protocol_negotiation ssl_alert ssl_extension_ex_point_formats ssl_extension_server_name ssl_server_curve

  9. Bro SSL Events - v2.5 client_hello ssl_stapled_ocsp ssl_change_cipher_spec server_hello ssl_encrypted_data x509_extension ssl_session_ticket_handshake ssl_dh_server_params x509_ext_basic_constraints ssl_established ssl_change_cipher_spec x509_ext_subject_alternative_name x509_certificate ssl_handshake_message ssl_extension_elliptic_curves ssl_extension ssl_encrypted_data ssl_extension_application_layer_protocol_negotiation ssl_alert ssl_extension_ex_point_formats ssl_extension_server_name ssl_server_curve ssl_extension_signature_algorithm

  10. Bro SSL Events - v2.5 Completely working DTLS support client_hello ssl_stapled_ocsp ssl_change_cipher_spec server_hello ssl_encrypted_data x509_extension More StartTLS ssl_session_ticket_handshake ssl_dh_server_params x509_ext_basic_constraints ssl_established ssl_change_cipher_spec x509_ext_subject_alternative_name TLS 1.3 support x509_certificate ssl_handshake_message ssl_extension_elliptic_curves ssl_extension ssl_encrypted_data ssl_extension_application_layer_protocol_negotiation ssl_alert ssl_extension_ex_point_formats ssl_extension_server_name ssl_server_curve ssl_extension_signature_algorithm

  11. Bro SSL Events - master client_hello ssl_stapled_ocsp ssl_change_cipher_spec server_hello ssl_encrypted_data x509_extension ssl_session_ticket_handshake ssl_dh_server_params x509_ext_basic_constraints ssl_established ssl_change_cipher_spec x509_ext_subject_alternative_name x509_certificate ssl_handshake_message ssl_extension_elliptic_curves ssl_extension ssl_encrypted_data ssl_extension_application_layer_protocol_negotiation ssl_alert ssl_extension_ex_point_formats ssl_extension_server_name ssl_server_curve ssl_extension_signature_algorithm

  12. Bro SSL Events - master client_hello ssl_stapled_ocsp ssl_change_cipher_spec server_hello ssl_encrypted_data x509_extension ssl_session_ticket_handshake ssl_dh_server_params x509_ext_basic_constraints ssl_established ssl_change_cipher_spec x509_ext_subject_alternative_name x509_certificate ssl_handshake_message ssl_extension_elliptic_curves ssl_extension ssl_encrypted_data ssl_extension_application_layer_protocol_negotiation ssl_alert ssl_extension_ex_point_formats ssl_extension_server_name ssl_server_curve ssl_extension_signature_algorithm x509_ocsp_ext_signed_certificate_timestamp ssl_extension_supported_versions ssl_extension_psk_key_exchange_modes ssl_extension_signed_certificate_timestamp ocsp_request ocsp_request_certificate ocsp_response_status ocsp_response_bytes ocsp_response_certificate ocsp_extension

  13. Bro SSL Events - master client_hello ssl_stapled_ocsp ssl_change_cipher_spec server_hello ssl_encrypted_data x509_extension ssl_session_ticket_handshake ssl_dh_server_params x509_ext_basic_constraints OCSP support ssl_established ssl_change_cipher_spec x509_ext_subject_alternative_name SCT Support (Certificate Transparency) x509_certificate ssl_handshake_message ssl_extension_elliptic_curves ssl_extension ssl_encrypted_data ssl_extension_application_layer_protocol_negotiation TLS 1.3 extensions ssl_alert ssl_extension_ex_point_formats ssl_extension_server_name ssl_server_curve ssl_extension_signature_algorithm x509_ocsp_ext_signed_certificate_timestamp ssl_extension_supported_versions ssl_extension_psk_key_exchange_modes ssl_extension_signed_certificate_timestamp ocsp_request ocsp_request_certificate ocsp_response_status ocsp_response_bytes ocsp_response_certificate ocsp_extension

  14. TLS 1.3 ts 1505018739.255782 id.resp_h 104.19.196.102 version TLSv13-draft18 cipher TLS_AES_128_GCM_SHA256 curve x25519 server_name tls13.cloudflare.com established T cert_chain_fuids - client_cert_chain_fuids - subject - issuer -

  15. OCSP HTTPS OCSP Server Server client hello server hello OCSP request More handshake messages OCSP reply Application data Measuring the Latency and Pervasiveness of TLS Certificate Revocation L. Zhu, J. Amann, J. Heidemann, PAM 2016

  16. @load files/x509/log-ocsp ts 1438374033.033189 id FVty9v3KTnCvbg0Xf2 hashAlgorithm sha1 issuerNameHash 74241467069FF5E0983F5E3E1A6BA0652A541575 issuerKeyHash 0159ABE7DD3A0B59A66463D6CF200757D591E76A serialNumber 017447CB30072EE15B9C1B057B731C5A certStatus revoked revoketime 1421494379.000000 revokereason keyCompromise thisUpdate 1436321024.000000 nextUpdate 1443459307.000000

  17. Certificate Transparency CT Log CA Webserver Browser

  18. Certificate Transparency CT Log CA Certificate Webserver Browser

  19. Certificate Transparency CT Log CA Certificate Certificate Webserver Browser

  20. Certificate Transparency CT Log CA Certificate Certificate SCT Webserver Browser

  21. Certificate Transparency CT Log CA Certificate Certificate SCT Webserver Browser Certificate, SCT in TLS Ext.

  22. Certificate Transparency CT Log CA Webserver Browser

  23. Certificate Transparency Precertificate CT Log CA Webserver Browser

  24. Certificate Transparency Precertificate CT Log CA SCT Webserver Browser

  25. Certificate Transparency Precertificate CT Log CA SCT Certificate (with 
 Precertificate SCT) Webserver Browser

  26. Certificate Transparency Precertificate CT Log CA SCT Certificate (with 
 Precertificate SCT) Webserver Browser Certificate. Transform, Validate

  27. Certificate Transparency CT Log CA Webserver Browser

Recommend

TRESPASSING KNOWLEDGE RESEARCH AS BEING, RESEARCH AS DOING, RESEARCH AS PRACTICE. Research is

TRESPASSING KNOWLEDGE RESEARCH AS BEING, RESEARCH AS DOING, RESEARCH AS PRACTICE. Research is

1 Emma Bolland: Lecture for the MFA Art, Society & Publics. Duncan of Jordanstone College of Art and Design. 11/2/2014 TRESPASSING KNOWLEDGE RESEARCH AS BEING, RESEARCH AS DOING, RESEARCH AS PRACTICE. Research is not the privilege of

469 views • 13 slides
What is research? An Introduction COM 432 Dr Yeoh Kok Cheow What is research? Research is the

What is research? An Introduction COM 432 Dr Yeoh Kok Cheow What is research? Research is the

What is research? An Introduction COM 432 Dr Yeoh Kok Cheow What is research? Research is the systematic collection and interpretation of information. Research, more precisely, preliminary research, sheds light on the problem. It helps to

930 views • 49 slides
Tuberculosis Researches in Thailand

Tuberculosis Researches in Thailand

TB research lab >> TB research lab >> TB research lab >> TB research lab >> TB research lab >> TB research lab >> TB research lab >> TB research lab >> MMU MMU MMU MMU MMU MMU MMU MMU

227 views • 11 slides
An introduction to Open Research Library Research Services Research Data Service Research

An introduction to Open Research Library Research Services Research Data Service Research

An introduction to Open Research Library Research Services Research Data Service Research Engagement Librarians Kellie Snow Catherine Dack Zosia Beckles Cath Borwick Alex Clarke Course objectives By the end of the session you will be able

676 views • 63 slides
Types of Research and Research Design By Dario Kuzmanovi Office of Research Integrity UCR

Types of Research and Research Design By Dario Kuzmanovi Office of Research Integrity UCR

Types of Research and Research Design By Dario Kuzmanovi Office of Research Integrity UCR 12/9/16 Research Step into the unknown Process of discovering new knowledge Attempt to advance current information Fed definition of research

665 views • 19 slides
MS Research Revolution Research that will STOP MS in its tracks. Research that will RESTORE

MS Research Revolution Research that will STOP MS in its tracks. Research that will RESTORE

MS Research Revolution Research that will STOP MS in its tracks. Research that will RESTORE whats been lost. Research that will END MS forever. NOW, we need everyone to be a champion in the MS Research Revolution. Presented by Haley Titus

347 views • 8 slides
Where will your research take you? Why Do Research?

Where will your research take you? Why Do Research?

Where will your research take you? Why Do Research? Pursue your intellectual passions Meet mentors and peers who share your interests

536 views • 27 slides
1. CS research process Check research on prior work on this problem Who (where, when),

1. CS research process Check research on prior work on this problem Who (where, when),

Notes on research methodogy CS2001 fall 2003 Rami Melhem CS research process Writing a paper Refereeing an article Dissertation proposal Bibliographical search How to give a talk Research integrity *) most

573 views • 18 slides
Research can be fun, informative and relatively painless. All you need is a research kit and

Research can be fun, informative and relatively painless. All you need is a research kit and

Research can be fun, informative and relatively painless. All you need is a research kit and curiosity! Professor Sue Wheeler University of Leicester IACP Introduction to Research Day Dublin 12 October 2013 Dont run away yet, it may not be

405 views • 29 slides
Research Dis isrupted: Protecting Federal Research In Investments and the U.S .S. Research

Research Dis isrupted: Protecting Federal Research In Investments and the U.S .S. Research

Research Dis isrupted: Protecting Federal Research In Investments and the U.S .S. Research Work rkforce fr from COVID ID-19 Im Impacts Congressional Briefing Monday, July 27th, 2020 2:30pm 1 BRIE IEFING AGENDA Welcome &

604 views • 23 slides
Creative Research Methods Arts-based research Research using technology

Creative Research Methods Arts-based research Research using technology

Creative Research Methods Arts-based research Research using technology Mixed-methods research Transformative research frameworks Indigenous methodologies This presentation covers arts-based research; the next tech

223 views • 8 slides
9. Psychological Research and Methods Research: Big Questions Why do I need to know

9. Psychological Research and Methods Research: Big Questions Why do I need to know

9. Psychological Research and Methods Research: Big Questions Why do I need to know this? How do researchers get from hypothesis to results? What can I learn from reading research reports? How can I analyze research

578 views • 24 slides
Funding AMR research: the UK Research Councils John Savill Medical Research Council - UK MRC

Funding AMR research: the UK Research Councils John Savill Medical Research Council - UK MRC

Funding AMR research: the UK Research Councils John Savill Medical Research Council - UK MRC mission Encourage and support high-quality research with the aim of improving human health. Produce skilled researchers. Advance and

400 views • 17 slides
1. What is Operations Research (OR) 2 What is Operations Research? It is an application of

1. What is Operations Research (OR) 2 What is Operations Research? It is an application of

Unit 4 Systems Engineering Tools Deterministic Operations Research, Linear Programming Source: Introduction to Operations Research, 9th edition, Frederick S. Hillier, McGraw-Hill 1 1. What is Operations Research (OR) 2 What is Operations

905 views • 61 slides
1) Overview 2) Research Design:

1) Overview 2) Research Design:

FEP Research Design Market Research LGE 508 1) Overview 2) Research Design: Definition 3) Research Design: Classification 4) Exploratory Research 5) Descriptive Research i.

201 views • 16 slides
NICHD NICHD Research Mission & Research Mission & Research Mission & Research

NICHD NICHD Research Mission & Research Mission & Research Mission & Research

Presented at Mailman School of Public Health, Columbia University December 9, 2010 NICHD NICHD Research Mission & Research Mission & Research Mission & Research Mission & Eugene G. Hayunga, Ph.D. Eugene G. Hayunga, Ph.D.

542 views • 26 slides
Research and Reflexology What is Research? Research is a process or activity that leads to the

Research and Reflexology What is Research? Research is a process or activity that leads to the

Research and Reflexology What is Research? Research is a process or activity that leads to the development of knowledge and expertise. It encompasses a variety of activities that are used to expand knowledge. Research - like any other

456 views • 3 slides
National Water Research Group Mauritius Research Council (MRC - Chair) Agricultural Research

National Water Research Group Mauritius Research Council (MRC - Chair) Agricultural Research

Mauritius Research Council National Water Research Group Mauritius Research Council (MRC - Chair) Agricultural Research & Extension Unit (AREU) Albion Fisheries Research Centre (AFRC) Association des Hteliers et Restaurateurs de l'le

663 views • 34 slides
Clinical Research Office: Services From To of a Clinical Research Study C LINICAL AND T

Clinical Research Office: Services From To of a Clinical Research Study C LINICAL AND T

Clinical Research Office: Services From To of a Clinical Research Study C LINICAL AND T RANSLATIONAL S CIENCE A WARD (CTSA) NIH Definition of Clinical Research Pat ient -orient ed research. Research conduct ed wit h human subj ect s (or

373 views • 12 slides
NAFAE: Research Practice Practice Research Studio Based Research Methodology Deleuze and

NAFAE: Research Practice Practice Research Studio Based Research Methodology Deleuze and

NAFAE: Research Practice Practice Research Studio Based Research Methodology Deleuze and Painting: Re-Thinking the Formal Simon J Harris 15 th July 2016 Scopic Regimes. The initial aim of my research developed out of an interest in what

339 views • 32 slides
LRIC Update EFO Research in 2017/18 New Research Barn for Poultry Tim Nelson CEO Livestock

LRIC Update EFO Research in 2017/18 New Research Barn for Poultry Tim Nelson CEO Livestock

& LRIC Update EFO Research in 2017/18 New Research Barn for Poultry Tim Nelson CEO Livestock Research Innovation Corporation 28 rd March 2018 Quick look back 2013-18 Created research plans Development of the new research barns

610 views • 21 slides
Chapter 10: Research and Development and Patents 3 stages of research: basic research,

Chapter 10: Research and Development and Patents 3 stages of research: basic research,

Chapter 10: Research and Development and Patents 3 stages of research: basic research, applied research, development. 2 kinds of innovation: Product innovations: create new goods. Process innovations: reduce the cost of

406 views • 17 slides
Principles of Research Data Management and Open Research S. Venkataraman, PhD Research Data

Principles of Research Data Management and Open Research S. Venkataraman, PhD Research Data

Principles of Research Data Management and Open Research S. Venkataraman, PhD Research Data Specialist Digital Curation Centre s.venkataraman@ed.ac.uk 5th December 2019, CODATA/RDA School of Research Data Science, CeNAT, San Jos, Costa

1.05k views • 88 slides
PROPOSING WRITING A WINNING RESEARCH GRANT PROPOSAL SSA, RMI 2 FRGS B DEC 2012 Research

PROPOSING WRITING A WINNING RESEARCH GRANT PROPOSAL SSA, RMI 2 FRGS B DEC 2012 Research

PROPOSING WRITING A WINNING RESEARCH GRANT PROPOSAL SSA, RMI 2 FRGS B DEC 2012 Research Value Chain Fundamental Mainly Domain based Research Research Applied Technology Innovation Research Mainly Interdisciplinary Research based on

644 views • 29 slides

More recommend