1 00:00:00,000 --> 00:00:04,300 Everybody, thank you everybody very much for your patience. I'm Andrew Brand, I'm the 2 00:00:04,300 --> 00:00:10,080 director of threat research at Symantec and obviously not as much of a techie as I'd hoped 3 00:00:10,080 --> 00:00:13,960 I would be today. So we're going to be talking a little bit about the SSL visibility 4 00:00:13,960 --> 00:00:21,580 appliance and unfortunately although I have a demo unit here behind this projector, there is 5 00:00:21,580 --> 00:00:28,760 no wired internet drop in the crypto and privacy village so it is on and it is working, it's 6 00:00:28,760 --> 00:00:33,760 just not hooked up to anything. We can do a little bit of a demo with it at the end if there's a 7 00:00:33,760 --> 00:00:38,820 little bit of time. There are instructions here for like how to do the testing if you really 8 00:00:38,820 --> 00:00:42,720 wanted to do the testing but it's not actually connected to any kind of a live internet 9 00:00:42,720 --> 00:00:48,980 service so while you can connect to it and you can download these certs that I've generated by 10 00:00:48,980 --> 00:00:55,040 it, you cannot really use them for anything so just don't bother. Alright so I'm going to talk 11 00:00:55,040 --> 00:00:58,680 a little bit about what the former blue code, now I'll, I'm going to talk a little bit about 12 00:00:58,760 --> 00:01:03,660 part of the big happy Symantec family is and the division that I work in, I'm going to talk a 13 00:01:03,660 --> 00:01:10,700 little bit about how this gizmo works and what it's meant to do, also what it can't do and 14 00:01:10,700 --> 00:01:17,780 because I use this in my lab with a lot of different types of devices and a lot of different types 15 00:01:17,780 --> 00:01:24,520 of operating systems, I have some experience in what is able to get through there and be 16 00:01:24,520 --> 00:01:28,520 decrypted, what and what the device basically causes everything to kind of choke on. 17 00:01:29,620 --> 00:01:36,740 Right, um, so a lot of what I'm going to show you is going to be UI from the, uh, from the 18 00:01:36,740 --> 00:01:43,680 visibility appliance itself which it's not very pretty, um, but there is also, uh, a component of 19 00:01:43,680 --> 00:01:48,300 this, uh, a stack that I work with that's called security analytics and, and that's more 20 00:01:48,300 --> 00:01:52,140 important for me to sort of explain from the beginning because a lot of the packets that I look 21 00:01:52,140 --> 00:01:58,020 at, uh, come out of SA. So the SSL visibility appliance essentially is this man in the middle 22 00:01:58,020 --> 00:02:03,980 decrypter that you would put between your WAN and your, and your LAN and you might use it for sort 23 00:02:03,980 --> 00:02:08,900 of two purposes. You might use it to man in the middle internal traffic that's outbound or, uh, 24 00:02:09,080 --> 00:02:16,500 external traffic that's coming into a, a service that's got like SSL or TDS on, on the host. Um, 25 00:02:16,640 --> 00:02:23,180 when those packets come through the SSLV, it does it, if it can do its decryption, it will spew 26 00:02:23,180 --> 00:02:28,000 them out on, uh, a separate port which you can then capture, uh, with a spanner attached to it. 27 00:02:28,020 --> 00:02:33,920 That port and then, uh, that stuff gets ingested into security analytics and what that does is 28 00:02:33,920 --> 00:02:39,360 records everything, indexes all the metadata out of those packets and then re-indexes that index. 29 00:02:39,560 --> 00:02:44,100 So the searching is really fast and you get something that's essentially a SIM-like interface 30 00:02:44,540 --> 00:02:49,100 but when you drill down to like the, the nittiest of the nitty-gritty, you can get down to the 31 00:02:49,100 --> 00:02:54,460 packet level, you can reconstruct files, uh, from various types of, uh, uh, uh, applications 32 00:02:54,460 --> 00:03:01,660 that have been, uh, uh, observed, uh, communicating over your network. So HTTP, email, uh, a bunch 33 00:03:01,660 --> 00:03:06,920 of different types of, uh, uh, protocols can be basically, uh, decrypted and, and then 34 00:03:06,920 --> 00:03:11,900 reconstructed into a, a, essentially you can look like you're looking over the shoulder of the 35 00:03:11,900 --> 00:03:20,260 machine, uh, that was doing the browsing or making the connections. Um, so what SA can do is it, 36 00:03:20,280 --> 00:03:24,360 basically it can, um, inspect tons and tons of traffic. It's 37 00:03:24,460 --> 00:03:29,860 meant for high-speed sort of enterprise networks. Uh, it, sort of com- as a component of that it 38 00:03:29,860 --> 00:03:35,140 uses a lot of storage. You can imagine, you just do the math on how fast the network is, what 39 00:03:35,140 --> 00:03:41,220 it's typical load is, um, and, uh, the number of days of storage you want to, uh, be able to go 40 00:03:41,220 --> 00:03:45,220 back, uh, retrospectively and do analysis on. And you can imagine we're talking, you know, 41 00:03:45,220 --> 00:03:50,800 we're in some cases into the, uh, peta and exabyte amount of storage for, for some, uh, 42 00:03:50,920 --> 00:03:56,500 applications. I run it on a virtual appliance because my network is relatively slow and with a, 43 00:03:56,520 --> 00:04:02,200 with a couple of gigs of, uh, of packet data plus the metadata I'm, I'm usually able to go back 44 00:04:02,200 --> 00:04:08,300 three or four months, uh, and, and reconstruct stuff, uh, pretty far back. Um, so, and I've 45 00:04:08,300 --> 00:04:15,200 already talked about what SSL visibility is. It's, um, it really is just a, uh, it's, it's basically, 46 00:04:15,220 --> 00:04:22,280 custom silicon dedicated to do the math that's involved in, uh, SSL decryption. All right. So 47 00:04:22,280 --> 00:04:28,740 these are the sort of the two, um, uh, ways that we would use SSLV. Most of the time that I'm 48 00:04:28,740 --> 00:04:34,980 using it in my lab, um, I am using it in the sort of outbound inspection, uh, sort of variety 49 00:04:34,980 --> 00:04:40,500 which is where I've got the thing, uh, watching traffic. It's, it's, it's inside the, it's 50 00:04:40,500 --> 00:04:45,200 inside the LAN but it's just inside the sort of the perimeter before everything else is 51 00:04:45,200 --> 00:04:45,500 working. Uh, I can just basically tell my server, uh, I can just tell my server that, and 52 00:04:45,500 --> 00:04:48,480 if I'm just going to try to do something else and everything that goes outbound is going through 53 00:04:48,480 --> 00:04:54,740 this thing and when it can be inspected it is inspected and when it causes problems, uh, you 54 00:04:54,740 --> 00:04:58,820 can, you can basically you can tell it to do one of two things. You can either have it reject 55 00:04:58,820 --> 00:05:04,060 that connection and basically kill it in which case, uh, the application will throw errors if 56 00:05:04,060 --> 00:05:09,740 its obviously not able to, uh, complete its communication or you can just tell the box, if 57 00:05:09,740 --> 00:05:14,900 you identify this, this protocol or this particular service or this domain name or these IP ranges, 58 00:05:14,900 --> 00:05:22,000 is uh you can say um just ignore uh for the purposes of doing inspection these these things 59 00:05:22,000 --> 00:05:25,700 that you have set up and then it will ignore that and everything will go through but you 60 00:05:25,700 --> 00:05:32,280 won't get the decrypted SSL either. Alright so when when you first connect into the SSL via 61 00:05:32,280 --> 00:05:37,560 the first thing that that you see is that it has its own self-signed cert um obviously 62 00:05:37,560 --> 00:05:42,700 because you you know all of these appliances are are using SSL and that's pretty normal. Um 63 00:05:42,700 --> 00:05:49,380 the cert looks like that it actually has a common name of SSL uh NGUI um and it's 64 00:05:49,380 --> 00:05:56,020 generated the first time you use the app. So this is the dashboard of the SSLV um it has a 65 00:05:56,020 --> 00:06:01,060 that's the prettiest picture that you're ever gonna see in the UI and um all it does it shows 66 00:06:01,060 --> 00:06:06,360 you a sort of representation visually of the rack and the ports that are on the front of it 67 00:06:06,360 --> 00:06:10,260 and yeah it's the one device that I have in my stack where the ports are on the front 68 00:06:10,260 --> 00:06:12,240 everything else is on the back so it's kind of a pain. 69 00:06:12,700 --> 00:06:19,000 Um and it will tell you basically how you're using it um in this case I'm using it in 70 00:06:19,000 --> 00:06:25,820 something called active F line uh active inline FTN mode uh and that is where uh all sessions 71 00:06:25,820 --> 00:06:30,740 are basically being intercepted when they can be decrypted it is doing so and when they 72 00:06:30,740 --> 00:06:35,860 cannot it it essentially lets them go through on uh without trying to decrypt them uh just to 73 00:06:35,860 --> 00:06:42,560 allow things to work. Um sorry that that's so tiny but this is just a picture of the user 74 00:06:42,560 --> 00:06:48,800 interface of the SSL session log and what's important about this is that it will tell you uh 75 00:06:48,800 --> 00:06:54,860 we'll bother simple what cipher suite the device is uh is trying to decrypt um if that type of uh 76 00:06:54,860 --> 00:07:00,220 cypher suite is supported by the device not all of them are but many of them are um and then 77 00:07:00,220 --> 00:07:06,320 whether or not it was able to successfully decrypt it when it uh is not able to decrypt it and 78 00:07:06,320 --> 00:07:11,480 the device allows the connection to go through anyways so it still works uh that is called a 79 00:07:11,480 --> 00:07:11,800 So 80 00:07:13,580 --> 00:07:18,180 And it's kind of an interesting thing. One of the ways that the device works is that you 81 00:07:18,180 --> 00:07:22,780 have, you know, clearly you have one Ethernet is for in and one is for out. And then there is a 82 00:07:22,780 --> 00:07:26,860 second pair of ports. It is literally, it is a physical loop back where you have to have the 83 00:07:26,860 --> 00:07:31,720 tiniest cable in the world and it's just a loop between them. And the reason for that is the 84 00:07:31,720 --> 00:07:35,660 device will programmatically decide when something is supposed to go through and it will 85 00:07:35,660 --> 00:07:40,340 literally shunt it through this other thing which is just a loop to get it around all of the 86 00:07:40,340 --> 00:07:48,020 silicon inside. So to use it you basically generate a cert. And the cert is generated, 87 00:07:48,200 --> 00:07:54,080 essentially the device acts as like a certificate authority. So it will generate a cert for you. 88 00:07:54,120 --> 00:07:58,000 You can add all of the, you know, custom information that you would want into the 89 00:07:58,000 --> 00:08:03,520 certificate. This is not a, you know, a valid cert that you would be able to then put up on 90 00:08:03,520 --> 00:08:10,320 your, your, you know, HTTPS server. So it is, it is literally, its only purpose is to do the 91 00:08:10,320 --> 00:08:18,400 re-signing. So the, the secret key remains within the device and then you can export the sort of 92 00:08:18,400 --> 00:08:22,540 the public side of the cert which you can then add into the certificate store of any of your 93 00:08:22,540 --> 00:08:27,820 devices. And when, when that cert is in the cert store the re-signing happens essentially 94 00:08:27,820 --> 00:08:33,840 transparently and automatically. There's a huge number of protocols that it supports. It's just 95 00:08:33,840 --> 00:08:38,240 the, some screenshots of some of the UI drop downs that show you all the different options that 96 00:08:38,240 --> 00:08:39,600 you can have when you generate your cert. 97 00:08:40,940 --> 00:08:45,700 Right. And then, you know, here's the, the exported cert. It shows like you can create one, 98 00:08:45,860 --> 00:08:52,700 like this one that says I call this my DEFCON certificate and it will export it as a PEM or a CRT 99 00:08:52,700 --> 00:08:57,720 or CER or DER and then you can, you know, import it into a variety of different devices. 100 00:08:59,020 --> 00:09:05,480 Alright. And then here's just the, the, the re-signing authorities are basically like, you 101 00:09:05,480 --> 00:09:10,200 know, you can decide under certain circumstances when such and such cipher suite is being 102 00:09:10,320 --> 00:09:14,960 used. Use this certificate authority or else use this other one. And it's a way of basically, 103 00:09:15,140 --> 00:09:19,340 you know, you can use it for a bunch of different reasons but it's a, primarily a way of 104 00:09:19,340 --> 00:09:24,360 maintaining the same security level of the traffic on your internal network so you're not 105 00:09:24,360 --> 00:09:29,580 basically using a weakened cipher or something that's easy to crack inside the building because 106 00:09:29,580 --> 00:09:34,700 that would be, you know, talk about crunchy outside and soft and chewy on the inside. It's 107 00:09:34,700 --> 00:09:40,140 just, it would just make things worse for a lot of, a lot of things. Right. And then once 108 00:09:40,320 --> 00:09:44,740 you have your, um, once you have your CERT set up and they've been installed on your devices 109 00:09:44,740 --> 00:09:49,340 then you have to create rule sets where you basically say under these circumstances you're 110 00:09:49,340 --> 00:09:53,800 gonna do the, the decrypting, right? And so you go to this rules, policies menu, go to rule 111 00:09:53,800 --> 00:09:59,520 sets and you kind of add in your rule. And, and in this case the rule sets that I've created 112 00:09:59,520 --> 00:10:04,900 are, you know, basically, uh, look at everything and then if you see these domain names, 113 00:10:05,420 --> 00:10:09,920 exclude them. If you see these IP addresses which happen to be internal devices, exclude them. If 114 00:10:09,920 --> 00:10:15,400 you see these IP addresses that belong to, you know, Netflix's, uh, uh, you know, content 115 00:10:15,400 --> 00:10:20,080 management system, exclude them because Netflix for some reason doesn't like to have all of 116 00:10:20,080 --> 00:10:24,580 their stuff decrypted. Um, and then, you know, and so on and so forth and then the very last 117 00:10:24,580 --> 00:10:33,640 step is do the decryption. Right. Um, so one of the cool features that is in the sort of newer 118 00:10:33,640 --> 00:10:39,900 version of this product is that, um, it, it pulls down and, and, uh, ties in with, uh, the 119 00:10:39,920 --> 00:10:46,440 categories that, that BlueCode has created for its, uh, its web categorization service that sort of 120 00:10:46,440 --> 00:10:51,760 underlies a lot of their other products that, um, most people know that BlueCode proxy is, is the 121 00:10:51,760 --> 00:10:54,820 big enterprise product that a lot of people have and they have these categories where 122 00:10:54,820 --> 00:10:59,680 administrators can set up policies where they don't want employees to visit porn sites on the 123 00:10:59,680 --> 00:11:03,940 job. I mean, shocking, right? But like you might not want to block that. And so in this case you 124 00:11:03,940 --> 00:11:09,400 can actually use those same categories and you can say, uh, I want to decrypt everything except stuff 125 00:11:09,400 --> 00:11:15,260 that's tied to banking and financial, for example. And there, thereby you can exclude the stuff 126 00:11:15,260 --> 00:11:20,840 that would basically make you, you know, would force you to violate, um, uh, you know, PCI DSS 127 00:11:20,840 --> 00:11:25,880 standards, for example, and you would accidentally be, you know, leaking tons of data across your 128 00:11:25,880 --> 00:11:32,680 network decrypted that you wouldn't want to, to be leaked. Um, so, yeah, anyway, that's, and I, and 129 00:11:32,680 --> 00:11:38,580 the team I work for is the team that creates that and maintains that reputation service. They're, 130 00:11:38,580 --> 00:11:43,800 it's called the Global Information Network. Um, once you've done all that then you, you just 131 00:11:43,800 --> 00:11:49,000 kind of, you know, pop it in and there's a little UI that says, you know, plug this into port 1 and 132 00:11:49,000 --> 00:11:53,120 2, plug this into port 5 and 6 and then everything else, the tap is coming out of the other 133 00:11:53,120 --> 00:12:00,700 ports. Right. More, more little choosers that show you different combinations of things you can do. 134 00:12:00,900 --> 00:12:07,200 Um, so one of the things that it can do is also if, if the, because it's an inline box it's a, it's a 135 00:12:07,200 --> 00:12:12,380 bump in the wire, uh, you would imagine that if there were a physical failure like a power outage 136 00:12:12,380 --> 00:12:18,600 you, your network might go down if this box wasn't turned on. So there's this concept of, uh, fail to 137 00:12:18,600 --> 00:12:23,040 network and that, that's one of the other reasons why there's that little loop back physical wire in 138 00:12:23,040 --> 00:12:28,020 there is that it will, it will actually physically click over, you'll hear a loud click when the 139 00:12:28,020 --> 00:12:33,060 power goes out and then that just means that it, it acts as a bump in the wire with nothing in 140 00:12:33,060 --> 00:12:35,880 between it so your network continues running even though the power's out. 141 00:12:37,440 --> 00:12:42,780 Right. Here's, um, some of the rules and the failure modes, uh, that it can experience and what 142 00:12:42,780 --> 00:12:47,120 you can choose to do with it. Basically you can either choose to reject which means kill the 143 00:12:47,120 --> 00:12:51,360 connection or you can tell it to cut through which means let it go and it's not decrypting 144 00:12:51,360 --> 00:12:57,980 anything. Right. Um, and we've already talked about this. You saw that graphic. So I'm not gonna 145 00:12:57,980 --> 00:13:05,060 repeat all that. Um, it does not get used in a couple of different circumstances. So, um, last 146 00:13:07,200 --> 00:13:12,680 time, uh, it was, there's been some misunderstanding about like the purpose of this device and it is 147 00:13:12,680 --> 00:13:17,920 not something, while it is suitable for enterprise networks where you may have a, a couple to 148 00:13:17,920 --> 00:13:24,780 10,000 machines on a network, um, at the highest end, uh, it, it, in sort of like anything 149 00:13:24,780 --> 00:13:29,480 bigger than that, you're gonna run into real problems where the CPU load is just gonna be too 150 00:13:29,480 --> 00:13:34,500 high for the device and it's gonna start dropping sessions. So this is not a box that you can plug 151 00:13:34,500 --> 00:13:37,180 in on your country's WAN card. It's not a box that you can plug in on your country's WAN card. 152 00:13:37,200 --> 00:13:40,960 It's like a, uh, WAN connection to the rest of the internet and basically decrypt everything 153 00:13:40,960 --> 00:13:46,840 that everyone is doing. The other thing that you can't do is you can't decrypt stuff and have it 154 00:13:46,840 --> 00:13:52,940 not be really obvious. Everything that gets decrypted if it doesn't have your CACERT in your 155 00:13:52,940 --> 00:13:58,420 CERT store, is basically going to cause errors to pop up in whatever application you use. If 156 00:13:58,420 --> 00:14:03,480 you're using the browser, you'll see those messages that pop up that say, uh, there's 157 00:14:03,480 --> 00:14:07,180 something hinky about this H, H, HTTPS connection, uh, do you, are these, are these here? How 158 00:14:07,180 --> 00:14:12,360 you sure you want to connect to it. So if you don't have that CACert installed it's going to 159 00:14:12,360 --> 00:14:17,140 throw a lot of those errors and there are going to be devices and applications that don't 160 00:14:17,140 --> 00:14:26,160 connect at all. Right. And that's basically what I was saying is that none of this stuff is 161 00:14:26,160 --> 00:14:34,540 going to work if you don't have the CACert on it. When you do not, when you do install CACerts 162 00:14:34,540 --> 00:14:40,340 on a laptop there isn't necessarily a warning message to let you know that stuff is going to 163 00:14:40,340 --> 00:14:47,720 be decryptable. And in some cases we've seen well they're kind of shoddy crimeware applications 164 00:14:48,130 --> 00:14:53,520 that have tried to convince people to install CACerts on to their device so that the 165 00:14:53,520 --> 00:15:01,640 criminal's malware can actually decrypt the SSL for the criminal. And other than that I haven't 166 00:15:01,640 --> 00:15:04,520 seen a whole lot of criminal use of this type of thing. So I think it's going to be a 167 00:15:04,520 --> 00:15:09,160 good thing. But when you do install the CERT in other devices like in Android you get these 168 00:15:09,160 --> 00:15:14,960 persistent uh alerts that never go away the entire time the CERT is installed. So the only way to 169 00:15:14,960 --> 00:15:19,960 get these messages that say things like network may be monitored by an uh you know an unknown 170 00:15:19,960 --> 00:15:25,260 third party uh you're going to see that message until you actually delete those CERTs completely 171 00:15:25,260 --> 00:15:32,960 out of the store. Alright. So what's better in the past year? Um I gave a talk similar to this 172 00:15:32,960 --> 00:15:40,160 last year. And the talk that I gave was about how um how few applications for mobile devices 173 00:15:40,160 --> 00:15:44,980 specifically were actually using something called certificate pinning. Where they they 174 00:15:44,980 --> 00:15:51,840 essentially have a CACert built into the app and if that CERT does not match identically to what 175 00:15:51,840 --> 00:15:56,900 it's getting you know in terms of the handshake from the server the connection simply doesn't go 176 00:15:56,900 --> 00:16:02,940 through. And uh a year ago there were a few apps that um essentially were you know very, very, 177 00:16:02,960 --> 00:16:08,280 very secure and would never allow that to go through but a lot of other stuff did. Some of the 178 00:16:08,280 --> 00:16:13,300 apps that worked last year were um that that securely connected and had pin CERTs were things 179 00:16:13,300 --> 00:16:19,420 like um like the Twitter app, like signal the uh uh SMS replacement app and you know other 180 00:16:19,420 --> 00:16:23,900 kinds of security tools that you can imagine would would want to have pin CERTs. Um I believe 181 00:16:23,900 --> 00:16:31,840 also Facebook uh supported pinning and and a few games that do uh uh over HTTPS uh some command 182 00:16:31,840 --> 00:16:37,120 and control for the game. Um there's been a lot of improvements over the past year so I I kind 183 00:16:37,120 --> 00:16:43,520 of uh and I gave a different talk last year uh about a game that I use that is a uh location 184 00:16:43,520 --> 00:16:51,180 based game called Ingress and how um it is it has been and is continuing to be heavily abused 185 00:16:51,180 --> 00:16:56,080 by people who do man in the middle, SSL interception to decrypt all of the command and 186 00:16:56,080 --> 00:17:01,680 control stuff and messaging that's in the game and that's being used to essentially louse 187 00:17:01,840 --> 00:17:08,020 up that game and cheat. And um I'm I'm sad to say that that that app has not improved although 188 00:17:08,020 --> 00:17:14,420 um the other game that that same company uh Niantic makes, Pokemon Go, in a release that 189 00:17:14,420 --> 00:17:20,540 happened sometime in the last fall uh they did start pinning their CERTs. So while it is still 190 00:17:20,540 --> 00:17:25,260 possible to man in the middle uh Ingress you cannot man in the middle Pokemon Go to the best 191 00:17:25,260 --> 00:17:31,820 of my knowledge unless you do some some hacking of the app itself. Um right and I mean I think 192 00:17:31,840 --> 00:17:35,260 I mentioned that like basically when it's when a certificate is pinned that it's not going to 193 00:17:35,260 --> 00:17:40,180 work. I mean it's really not going to work and and and a lot of times um the application 194 00:17:40,180 --> 00:17:45,160 developers when they when they create these apps that have pins in them uh they're they're 195 00:17:45,160 --> 00:17:50,040 doing it so that they can ensure privacy of the connection but they're not necessarily building 196 00:17:50,040 --> 00:17:57,240 in the the error uh responses to understand and explain to the end user why the thing isn't 197 00:17:57,240 --> 00:18:01,820 connecting. It will just say like tweets cannot be received at this time. So it's it's a 198 00:18:01,820 --> 00:18:05,760 so in some cases you'll get these messages where it says it just couldn't connect and in 199 00:18:05,760 --> 00:18:10,240 others it will say it looks like there's SSL interception going on I'm definitely not going to 200 00:18:10,240 --> 00:18:16,420 connect but a lot of times the the error messages are pretty confusing. Um so let me show you 201 00:18:16,420 --> 00:18:21,160 some of the other stuff that's popped out uh just in doing a little bit of looking at devices. 202 00:18:21,260 --> 00:18:28,120 So um so what I haven't explained is sort of in in my day job uh I I run this lab it's full of 203 00:18:28,120 --> 00:18:31,520 IOT devices, it's full of Android phones that are running malware. 204 00:18:31,820 --> 00:18:36,700 Uh at any given time. Uh I also have bare metal machines, virtual machines and some 205 00:18:36,700 --> 00:18:41,200 sandboxes that are running malware and the purpose of doing all of this decryption and and 206 00:18:41,200 --> 00:18:46,640 recording of network traffic is so that we in the gym team can observe the command and control 207 00:18:46,640 --> 00:18:52,460 traffic of malware, know where it's talking to, how it communicates and write rules for various 208 00:18:52,460 --> 00:18:58,260 tools to either be able to uh uh notice when those kinds of connections are happening or to be 209 00:18:58,260 --> 00:19:01,800 able to block them by I by address or or sometimes uh you know block them by address or or sometimes 210 00:19:01,800 --> 00:19:06,480 uh to narrow it down to like the URI path uh that a that a command and control connection would 211 00:19:06,480 --> 00:19:12,820 be happening on. So um so I do have a demo um that was ready to go on my other laptop and 212 00:19:12,820 --> 00:19:17,480 hopefully I if if the person who loaned me their laptop doesn't mind I might connect it to my demo 213 00:19:17,480 --> 00:19:22,700 network and see if I can do that at the end. Um because I there's there is some malware that 214 00:19:22,700 --> 00:19:28,800 uses TLS to do its command and control. Uh one of the the primary ones that I'm seeing right now 215 00:19:28,800 --> 00:19:31,780 is a a bot that's that emerged in the last few months called TLS. Uh it's a bot that's been 216 00:19:31,800 --> 00:19:36,940 called TrickBot which is starting to kind of gain traction as a uh a main rat that people are 217 00:19:36,940 --> 00:19:42,440 are distributing through a lot of different methods but mainly through spam and through uh uh 218 00:19:43,720 --> 00:19:49,760 exploit kits. And it's a it's an interesting one because it's it's also one of the more 219 00:19:49,760 --> 00:19:55,460 sophisticated and modular pieces of malware that I've seen. It it it basically is a a core engine 220 00:19:55,460 --> 00:20:00,780 uh for the malicious activity uh and it brings down modules from different command and control 221 00:20:00,780 --> 00:20:01,780 servers so that it can uh you know it can uh you know it can uh you know it can uh it can 222 00:20:01,780 --> 00:20:07,180 uh it can run those modules as DLLs and kind of hook into different features on whatever machine 223 00:20:07,180 --> 00:20:13,140 it happens to have infected. So a couple of the weird things that have popped up recently. 224 00:20:13,420 --> 00:20:20,040 So um like uh looking in these logs uh I will sometimes just kind of skim through them and 225 00:20:20,040 --> 00:20:24,120 there's there's actually a filter thing that will trigger like just show you all the errors that 226 00:20:24,120 --> 00:20:28,360 appear in the SSL session logs and so I like to look through those and just see sort of what 227 00:20:28,360 --> 00:20:31,760 broke recently and I I wanted to call a few of these out so I have a few of these that I think 228 00:20:31,780 --> 00:20:36,560 So just last week I was looking at a couple of these things and I had a machine, I had a 229 00:20:36,560 --> 00:20:42,560 phone that was attached to one of my nodes in my network that is being, you know, routes 230 00:20:42,560 --> 00:20:49,880 through this. And the phone was doing some just normal activity but this error popped up and 231 00:20:49,880 --> 00:20:53,820 it's the one that's highlighted here and it was a big log line so I split it in half but 232 00:20:53,820 --> 00:21:00,340 basically at the very end, near the end you can see it says expired. So the cert in this case 233 00:21:01,780 --> 00:21:07,700 when this communication happened, it allowed the communication to go through, it did not, it 234 00:21:07,700 --> 00:21:13,500 was not able to decrypt it and it did report that the cert was expired so I went back in and I 235 00:21:13,500 --> 00:21:21,300 looked at, you could see that the origin IP of this was 54.208.221.85 so I went into security 236 00:21:21,300 --> 00:21:28,000 analytics and I pulled out the undecrypted flow that contained that session with the SSL 237 00:21:28,000 --> 00:21:31,760 stuff and then I used a tool called network miner to just like dump out, you know, the 238 00:21:32,440 --> 00:21:37,620 SERT and take a look at that. So when I did that I found that there was this SERT for something 239 00:21:37,620 --> 00:21:45,260 called parse.com and parse is one of many different kinds of sort of mobile, it's 240 00:21:45,260 --> 00:21:50,540 instrumentation that developers will install, third party instrumentation package that they use 241 00:21:50,540 --> 00:21:56,640 to kind of keep track of how their app is behaving and it receives telemetry over HTTPS as 242 00:21:56,640 --> 00:22:01,300 well and their SERT expired. It's hard to see but it says like it expired on June 29th so 243 00:22:01,780 --> 00:22:07,700 they were still running on an expired SERT and I wasn't able to decrypt it because of that. 244 00:22:09,220 --> 00:22:14,360 One of the other things that I have, like I mentioned, a lot of IOT devices and we have a 245 00:22:14,360 --> 00:22:21,040 couple of Samsung smart TVs, different models, connected to that network. In general the 246 00:22:21,680 --> 00:22:27,700 Samsung is an interesting device because it, how many people, just a show of hands, how many 247 00:22:27,700 --> 00:22:31,760 people have a Samsung smart TV? So just a few but you know more than half of them have a 248 00:22:31,780 --> 00:22:36,940 Samsung smart TV. More than a couple. Interesting device. It has its own sort of version of 249 00:22:36,940 --> 00:22:41,160 the, of an operating system. It has its own antivirus built into it as well. You can tell the 250 00:22:41,160 --> 00:22:48,840 thing to scan for files within the, the operating system, file system. And it, it has Ethernet 251 00:22:48,840 --> 00:22:53,340 ports and can connect over a wired or wireless connection and obviously you would then, you 252 00:22:53,340 --> 00:22:57,620 know, connect it to the network and it has, you know, all your apps for, you know, Netflix or 253 00:22:57,620 --> 00:23:01,760 Hulu or Amazon, whatever your video streaming service of choice is. So it's, you know, it's a 254 00:23:01,780 --> 00:23:05,760 great device. So when you want to watch HBO Go you just go into the TV and you pivot over to the 255 00:23:05,760 --> 00:23:11,380 streaming service that you want and it launches an app within the TV and those apps are all 256 00:23:11,380 --> 00:23:17,300 downloaded through a cloud service that Samsung operates. The TV also does things, like it 257 00:23:17,300 --> 00:23:24,920 scans the whole network, oh, every, four times every second for Samsung, like, mobile devices 258 00:23:24,920 --> 00:23:31,040 that can connect to the TV. It generates a ton of noise and actually it's, I, I would say it's one 259 00:23:31,040 --> 00:23:36,060 of the reasons why when you buy a smart TV it's always good to connect it to a power strip and 260 00:23:36,060 --> 00:23:39,920 when you turn it off, turn it off on the power strip so that it's not just sitting there. 261 00:23:40,000 --> 00:23:45,480 Because I've seen my TV stay active for three, four hours after you turn it off and it 262 00:23:45,480 --> 00:23:49,620 continues scanning looking for, like, hey, does anyone want to connect and, like, share 263 00:23:49,620 --> 00:23:54,880 videos on the screen? Um, so it's pretty obnoxious. And, and in addition to all of that 264 00:23:54,880 --> 00:24:01,020 noise, uh, the TV itself has authentication with, uh, a Samsung account that you can, you know, 265 00:24:01,040 --> 00:24:06,960 set up, uh, to do technical support and also to save your preferences. There's a browser built 266 00:24:06,960 --> 00:24:11,600 into the TV so if you want to browse the internet, um, you can save your bookmarks in your 267 00:24:11,600 --> 00:24:15,360 Samsung account and then when you log into your Samsung account on a different TV or a 268 00:24:15,360 --> 00:24:20,860 different device, basically you can get all that stuff back. Um, so what we've got here is logs 269 00:24:20,860 --> 00:24:27,060 from, uh, the SSLV showing that, um, the TV was going to a bunch of different websites 270 00:24:27,060 --> 00:24:31,020 including, uh, SamsungCloudSolution.net and, uh, the, uh, the, uh, the, uh, the, uh, the, uh, 271 00:24:31,040 --> 00:24:39,160 and SamsungACR.com. Uh, all of these Samsung apps that are in the TV themselves, uh, with the 272 00:24:39,160 --> 00:24:45,540 exception of its Wi-Fi connection check, uh, they, all of them basically fail on this because 273 00:24:45,540 --> 00:24:50,300 they're using a pinned cert. That's good because the one that, that's connecting to, um, 274 00:24:51,000 --> 00:24:57,460 SamsungACR.com, uh, is, is connecting to something called log ingestion dot SamsungACR.com. 275 00:24:57,600 --> 00:25:01,020 Um, the, the bad news is that, um, all of the, uh, the, uh, the, uh, the, uh, the, uh, the, 276 00:25:01,040 --> 00:25:06,200 all of those domains have invalid issuers. So, so there's a cert that was issued to these 277 00:25:06,200 --> 00:25:11,740 different TV connection domains that isn't valid. And when I pulled them out, I looked at 278 00:25:11,740 --> 00:25:16,640 them and, yeah, they're all self-signed certs. So apparently Samsung operates its own internal 279 00:25:16,640 --> 00:25:21,580 certificate authority and they generate these certs for their devices which then get flashed 280 00:25:21,580 --> 00:25:31,020 into the firmware for the TVs and the, the, the mobile phones and everything else. And the 281 00:25:46,560 --> 00:25:57,900 other thing that I was playing with was, um, uh, my son's Nintendo 3DS. Uh, I do occasionally 282 00:25:57,900 --> 00:26:03,800 confiscate for, like, research purposes and play a little bit of Pokemon XY. But, um, besides 283 00:26:03,800 --> 00:26:08,540 that, um, the, the device is actually really interesting because it can do, uh, peer-to-peer 284 00:26:08,540 --> 00:26:13,320 networking over Wi-Fi and, uh, you know, so you can play basically, uh, uh, collaborative 285 00:26:13,320 --> 00:26:19,840 games together with your buddies. Um, it also has its own built-in browser and you can, and it 286 00:26:19,840 --> 00:26:24,880 will, it, it kind of, uh, tries as best it can to generate a mobile version of things like 287 00:26:24,880 --> 00:26:29,540 Gmail. So you can read your Gmail and stuff through the browser on the 3DS. I wouldn't 288 00:26:29,540 --> 00:26:33,900 recommend it. It's not the best way to read, uh, your email. Um, and when you go to the 289 00:26:33,900 --> 00:26:39,480 browser and you have, uh, SSL interception on it, you can see here it pops up a warning message 290 00:26:39,480 --> 00:26:45,740 that asks you to basically bypass the, the, um, security features in the SSL. Are you sure you 291 00:26:45,740 --> 00:26:50,860 want to do this? It's essentially the same as what you would get in Chrome. Um, so in the 292 00:26:50,860 --> 00:26:54,860 browser of the 3DS you can manually bypass the, the, um, security features in the SSL. 293 00:26:54,880 --> 00:26:58,820 This error message and, and, I don't know, show of hands, how many people think 10-year-olds 294 00:26:58,820 --> 00:27:05,340 understand what the context of this kind of a dialogue box is? Exactly. So everybody, when, 295 00:27:05,400 --> 00:27:10,460 your child is a, a straight-A student in my book. That one guy in the back who raised his 296 00:27:10,460 --> 00:27:15,100 hand. So, um, so most kids are gonna just hit allow because they don't understand what's 297 00:27:15,100 --> 00:27:19,820 gonna happen and, um, I believe a lot of adults do that too when they see this kind of a 298 00:27:19,820 --> 00:27:24,860 message. So you can bypass and you can decrypt the SSL from the browser. Um, and, and, and, um, 299 00:27:24,880 --> 00:27:31,980 what you can't do without doing some serious modifications to the 3DS is you cannot decrypt any 300 00:27:31,980 --> 00:27:37,960 of the other HTTPS communications that the device does. So among those things, uh, there is a 301 00:27:37,960 --> 00:27:43,000 Nintendo account where you can create your Mii, uh, which is the little cartoony character that 302 00:27:43,000 --> 00:27:47,860 represents you in all the games. Uh, and you can share your Mii through your Nintendo account 303 00:27:47,860 --> 00:27:52,720 with your buddies so that when they play, uh, co-op with you, the, your Mii shows up on their 304 00:27:52,720 --> 00:27:59,580 device, their Mii shows up on your device. Um, so none of that, uh, Mii, Mii Gallery stuff works, 305 00:27:59,640 --> 00:28:05,060 uh, if you have Interception turned on. It just can't connect. Uh, the other thing that fails is, 306 00:28:05,280 --> 00:28:12,480 um, uh, there is a online store where you can buy the games and, uh, essentially download them to 307 00:28:12,480 --> 00:28:19,400 the device to the SD card or, or into the device's memory. Um, this store app is also pinned so 308 00:28:19,400 --> 00:28:22,700 that when you have Interception turned on you're not gonna be able to buy a game and take it to the 309 00:28:22,700 --> 00:28:28,040 device and download it. Um, and then the third thing that's kind of an issue is that, um, all of 310 00:28:28,040 --> 00:28:36,000 the domains that are being used for Nintendo, um, are also invalid issuers. So here I've got some 311 00:28:36,000 --> 00:28:42,640 of the screens, uh, on this one at the very bottom, uh, it's the C.shop.NintendoWiFi.net, uh, 312 00:28:42,740 --> 00:28:46,900 has an invalid issuer. And then on these two screens there's, uh, something called, uh, 313 00:28:47,000 --> 00:28:52,680 NASC.NintendoWiFi.net and Account.Nintendo.net and all of them are issued by Nintendo. So, uh, 314 00:28:52,700 --> 00:28:58,720 are, are invalid issuers and again it's, um, it comes down to Nintendo themselves just like 315 00:28:58,720 --> 00:29:03,260 Samsung are operating their own certificate authority and they're basically self-signing certs 316 00:29:03,260 --> 00:29:08,500 and throwing them into these devices. Um, I, you have to wonder about these large electronic 317 00:29:08,500 --> 00:29:13,500 manufacturers. I mean, I think that they probably have 50 bucks a year to throw at buying some 318 00:29:13,500 --> 00:29:19,080 certs. Um, I would hope that this would change in the future. I think right now it's probably 319 00:29:19,080 --> 00:29:24,580 being done for convenience sake but it would be nice to see some trust levels in the SSL 320 00:29:24,580 --> 00:29:29,820 communications, uh, and not just self-signed certs because this, as we all know, that's just asking 321 00:29:29,820 --> 00:29:37,040 for trouble. Uh, when you try to do, um, anything over an intercepted network, uh, through 322 00:29:37,040 --> 00:29:42,020 these pinned apps that are, that are built into the 3DS, you end up with a message that's very 323 00:29:42,020 --> 00:29:46,020 obscure looking and looks like this. Uh, the one on the left that says an error has occurred, 324 00:29:46,160 --> 00:29:49,060 please try again later. When you go and you look up that error, uh, you'll see a message that says, 325 00:29:49,080 --> 00:29:53,060 error code. It, it tells you that there's, um, there's a message in that error code that 326 00:29:53,060 --> 00:29:58,440 essentially is that the clock is set wrong so you need to check the time and then, and then, uh, 327 00:29:58,440 --> 00:30:02,500 try to reconnect again. And that actually comes up a lot when you, when you're seeing 328 00:30:02,500 --> 00:30:08,360 certificate re-signing is that the error is basically the same as if your clock was off and 329 00:30:08,360 --> 00:30:15,060 the timing for the cert, uh, was, was wrong. Um, but the, but the game developers or the, the 330 00:30:15,060 --> 00:30:18,940 device manufacturers don't as, anticipate or assume that 331 00:30:19,080 --> 00:30:23,040 people are doing man-in-the-middle decryption on their stuff so they just basically have one 332 00:30:23,040 --> 00:30:28,300 error message for the whole, that whole type of thing. The one thing that does work though is when 333 00:30:28,300 --> 00:30:34,640 you do the connection test. So, so there is a, um, there's a whole Wi-Fi UI in the 3DS and you 334 00:30:34,640 --> 00:30:39,200 can connect to an access point and then it, it wants to go off and make sure that it can make a, 335 00:30:39,260 --> 00:30:45,500 a valid connection. If it cannot make an HTTP connection, which it tries first, it then tries 336 00:30:45,500 --> 00:30:49,060 just an HTTP connection to a, to a URL that's on Nintendo's website. Um, and then, and then, and 337 00:30:49,080 --> 00:30:54,320 when that works it basically comes back and says your connection is good. But it doesn't tell you 338 00:30:54,320 --> 00:31:00,320 that you weren't able to connect over SSL. So, um, yeah. It's just an, you know, another 339 00:31:00,320 --> 00:31:08,540 weirdness in a consumer electronics device. Um, another ish, invalid issuer problem that I found 340 00:31:08,540 --> 00:31:15,640 was with, um, Whisper Systems. So Whisper Systems makes the, uh, Signal app. Um, I'm a user of it 341 00:31:15,640 --> 00:31:19,060 and, you know, I, I love Mox, uh, Moxie Marlin. Um, and, and, and, and, and, and, and, and, and, 342 00:31:19,060 --> 00:31:23,620 Spike. Right? I mean he's been to DEF CON a million times and spoken and he's a great guy and 343 00:31:23,620 --> 00:31:29,880 this is a great app. Um, but once again it's, it's using a, a self-generated cert, uh, to do that 344 00:31:29,880 --> 00:31:35,480 communication and, um, I just would prefer, I, I don't know how you feel about it, I think it 345 00:31:35,480 --> 00:31:41,860 would be stronger if more of these companies, uh, used certs that had some validity that can be, 346 00:31:41,860 --> 00:31:47,520 uh, validated through a, uh, certificate authority. Um, so here's the Whisper Systems cert, right? 347 00:31:47,520 --> 00:31:52,200 And it says Windows did not have enough, uh, uh, information to verify the certificate and at 348 00:31:52,200 --> 00:31:56,920 the bottom of the second one it says the, the issuer of the certificate could not be found. And 349 00:31:56,920 --> 00:32:02,020 that's basically the same error that the Nintendo one did and the Samsung one did. So probably, 350 00:32:02,420 --> 00:32:06,340 most likely it was a self, self-signed cert. If I, if I had my laptop I could open the cert and 351 00:32:06,340 --> 00:32:12,240 take a look and see what it was signed with. I don't have the screenshot up here. Um, right. Oh, 352 00:32:12,300 --> 00:32:17,020 so one of the other thing that, uh, came out of this is that, um, so the, the, there are these, 353 00:32:17,020 --> 00:32:22,100 third-party apps, right? So, you know, Netflix and Hulu and all those guys have their own apps. 354 00:32:22,220 --> 00:32:26,200 They produce them for the Tizen operating system, which is the thing that's running in the 355 00:32:26,200 --> 00:32:32,580 Samsung TV. And then those apps can have their other, like, third-party instrumentation in them 356 00:32:32,960 --> 00:32:38,760 so that those app developers can get feedback directly from the TV user, uh, when something's 357 00:32:38,760 --> 00:32:42,620 not working, if streaming's not coming through, right? I mean, I, you can understand why, you 358 00:32:42,620 --> 00:32:46,560 know, Netflix wants to know what your throughput is and if, if you're, uh, getting too many 359 00:32:46,560 --> 00:32:51,440 artifacts in the video. And so there's all this internet, um, uh, instrumentation built into, uh, 360 00:32:51,520 --> 00:32:57,940 the, the apps themselves. And in this case there was an invalid issuer for, uh, Netflix's app. So 361 00:32:57,940 --> 00:33:01,960 there was a self-signed cert for Netflix's app. And then there was also something called 362 00:33:02,620 --> 00:33:08,440 internet at dot TV. And that also was a self-signed cert. So that's, whatever that is, and 363 00:33:08,440 --> 00:33:12,140 I'm not 100% sure what it is because, of course, I wasn't able to inspect the content of the 364 00:33:12,140 --> 00:33:15,820 traffic, uh, other than to see the cert. It was all invalid certs. 365 00:33:15,820 --> 00:33:22,640 So, um, so that's problematic. Um, now I was going to jump at this point over to my wireless 366 00:33:22,640 --> 00:33:29,440 network and show you the decrypted traffic from TrickBot. What it, now, I will pause for a 367 00:33:29,440 --> 00:33:33,880 moment and see if there's any questions and ask if, if, uh, is this your, this your laptop, 368 00:33:33,980 --> 00:33:39,540 right? Can, yeah, no, can you, would you mind coming up here and connecting me to my 369 00:33:39,540 --> 00:33:42,300 wireless? And so, questions, yes? 370 00:33:46,180 --> 00:33:50,780 No, no, TrickBot is a piece of malware that's created by someone, we don't know who that 371 00:33:50,780 --> 00:33:56,400 person is. And, uh, and TrickBot is, we are decrypting the TrickBot command and control 372 00:33:56,400 --> 00:34:06,660 traffic using this technique. So the, the access point is, it's this 743EA. And, uh, here I'll 373 00:34:06,660 --> 00:34:15,800 let you access it. Yeah, so, uh, so, uh, so, uh, so, uh, so, uh, so, uh, so, uh, so, uh, so, uh, 374 00:34:15,820 --> 00:34:19,560 so, did everybody catch the, the question was, uh, is the, is TrickBot the tool that I'm using? 375 00:34:19,700 --> 00:34:22,440 And it, and no, it is not. Yes? 376 00:34:23,080 --> 00:34:32,120 Um, thanks. So, I apologize if this is, uh, uh, but why does a validly signed 377 00:34:32,120 --> 00:34:38,300 search, uh, entry security over a, in, self-signed search in case of where the app 378 00:34:38,300 --> 00:34:42,640 will be really unconnected to your server if you don't have a self-signing, uh, part of it? 379 00:34:42,780 --> 00:34:45,620 Well, I wouldn't say that it actually, so the question is, uh, 380 00:34:45,620 --> 00:34:50,060 why does it, why is a, why is a self-signed search less secure than a pinned search? Is 381 00:34:50,060 --> 00:34:57,080 that, is that essentially? Well, it, uh, okay, so, um, let me step back and just reiterate. 382 00:34:57,280 --> 00:35:01,540 So, I, I wouldn't say that it's more secure than, one is not more secure than the other, but I 383 00:35:01,540 --> 00:35:06,540 think having some certificate validity being issued by a, a valid CA where it can be checked, 384 00:35:06,660 --> 00:35:11,660 um, and that there's some trust there is better than having a self-signed search. That's not to 385 00:35:11,660 --> 00:35:15,380 say that the self-signed search are inherently insecure or that there's some problem with 386 00:35:15,380 --> 00:35:20,380 them. Um, but it, but this validity checking only happens when it's been done through a 387 00:35:20,380 --> 00:35:31,540 cert, certificate authority. I'm sorry, hang on one second, I want to make sure that I can get 388 00:35:31,540 --> 00:35:42,920 online. It says it's not connected. It's still, it's still trying to connect to it. It, it 389 00:35:42,920 --> 00:35:44,520 won't, until it's connected it's not going to work. 390 00:35:49,100 --> 00:35:49,900 Yeah, if you don't mind. 391 00:35:50,460 --> 00:35:52,380 I'm sorry, would you please repeat your question? 392 00:36:24,420 --> 00:36:30,420 Okay, so the question is, um, so if they're using a purchased cert instead of a, uh, a self-signed 393 00:36:30,420 --> 00:36:37,100 cert, um, why should I trust the purchased cert more? Um, I don't know, it just, I like to, I 394 00:36:37,100 --> 00:36:43,020 like to be able to make sure that it's legit. Um, it's too, I think it's too easy to kind of 395 00:36:43,020 --> 00:36:45,360 clone an app and modify it. Um, I think it's too easy to kind of clone an app and modify it. 396 00:36:45,380 --> 00:36:52,660 And add your own self-signed cert in there to kind of pretend to be the app. And maybe put it on 397 00:36:52,660 --> 00:36:58,680 an app store. Um, having that, having that be a valid cert at least gives you the, the, um, 398 00:36:58,820 --> 00:37:03,960 confidence that when it's talking back to its command and control server that it's, it's talking 399 00:37:03,960 --> 00:37:09,660 back to a command and control server that has at least, um, you know, proposed to a valid 400 00:37:09,660 --> 00:37:14,960 signing authority that they are the real deal. Right? So like if you're using your Chase Bank 401 00:37:14,960 --> 00:37:19,980 app, I want to make sure that that cert is valid, that it's talking to Chase and that it's not 402 00:37:19,980 --> 00:37:24,680 just a fake Chase Bank app that's talking to some other guy. Does that make sense? I mean it 403 00:37:24,680 --> 00:37:28,780 doesn't necessarily make it inherently more secure communications, but it makes me feel better 404 00:37:28,780 --> 00:37:30,480 about using it. Yes? 405 00:37:51,320 --> 00:37:57,600 That, that is a valid point and I will repeat that. Um, so if the app is its self-signed by the, 406 00:37:57,680 --> 00:38:04,480 and the code is signed so that you know that the, uh, the app is, is, uh, reputedly originating 407 00:38:04,480 --> 00:38:10,080 with the real developer, um, that obviates the need for checking the cert. And, and, yeah, 408 00:38:10,160 --> 00:38:14,240 that's actually a valid point and one that I hadn't considered. I, I don't, so my, my 409 00:38:14,960 --> 00:38:20,440 focus in this talk was just very, very narrowly on the network side of things, um, and not 410 00:38:20,440 --> 00:38:28,860 looking at the, the apps themselves. Um, him and then you? Do you know anything about the, um, 411 00:38:29,800 --> 00:38:37,260 Google's, uh, certificate transparency? Have you heard about that? Uh, so, do I know about 412 00:38:37,260 --> 00:38:44,820 Google's, uh, certificate transparency? I, I haven't heard the news about it, so, um, I, I do, I do 413 00:38:44,960 --> 00:38:50,900 know that, um, uh, Google's certs and, and the way that they do SSL specifically within Chrome, 414 00:38:51,120 --> 00:38:56,320 they're, they're very on the cutting edge of, um, trying to defeat tools like SSL 415 00:38:56,320 --> 00:39:01,640 visibility. So they're, they were, uh, some of the earliest adopters of some of the, uh, uh, 416 00:39:01,660 --> 00:39:08,960 really, uh, obscure and, and hard to decrypt, uh, protocols that were being used and so, um, I 417 00:39:08,960 --> 00:39:14,480 would say that the, when it comes to the team that's doing the development and management of the 418 00:39:14,480 --> 00:39:22,100 SSL visibility product. 95% of their like feature request is oh Google Chrome just added a new 419 00:39:22,100 --> 00:39:27,380 like you know certificate you know or new encryption rule that they need to be able to 420 00:39:27,380 --> 00:39:32,120 decrypt and like suddenly it's not working anymore. So like I think four times last year 421 00:39:32,120 --> 00:39:36,500 they came out with a new version of Chrome and all of a sudden everything broke in SSLV. So 422 00:39:36,500 --> 00:39:41,840 then a new version of SSLV's firmware had to be uploaded and you know reinstalled and 423 00:39:41,840 --> 00:39:47,920 there's a lot of time that we spend trying to bust into Google stuff. Hi go ahead. 424 00:39:56,200 --> 00:40:01,600 Wow that's so it's not a stupid question but it's not a simple answer. I mean essentially 425 00:40:01,600 --> 00:40:08,020 what it's doing is you have a certificate handshake that comes in and is presented what 426 00:40:08,430 --> 00:40:11,820 essentially to the client. The SSLV looks for that handshake and it's like oh Google Chrome 427 00:40:11,820 --> 00:40:16,820 handshake. It then it it then takes that certificate for the handshake it pretends that 428 00:40:16,820 --> 00:40:21,860 it's the client and does the handshake back to the server but then internally within the 429 00:40:21,860 --> 00:40:28,760 SSLV it's it's takes the decrypted traffic, re-encrypts it with it's with that cert that 430 00:40:28,760 --> 00:40:33,320 it's generated and then sends that up to the client so it's doing this kind of like half to 431 00:40:33,320 --> 00:40:41,080 two halves of the whole. Yeah. The decrypted traffic is happening inside of the SSLV box itself. 432 00:40:41,820 --> 00:40:47,160 It's it's pretend basically the box pretends to be the client. It presents itself as the client. 433 00:40:49,560 --> 00:40:54,980 As being being the client's like originating you know box basically and and so it does the 434 00:40:54,980 --> 00:41:00,140 handshaking and then instead of that you know normally that decrypted data would be then you 435 00:41:00,140 --> 00:41:05,200 know sent into the browser itself and rendered on the screen instead it shunts that out of a 436 00:41:05,200 --> 00:41:10,240 decrypted port on the box and then it will re-encrypt it with the certs that you've created 437 00:41:10,240 --> 00:41:11,800 and then send that up to the client. Yeah. And then it then it then it then it then it then it 438 00:41:11,820 --> 00:41:16,180 sends it to the endpoint that actually made the request in the first place. Yes. 439 00:42:07,440 --> 00:42:11,800 Okay. So it's a long question and I've got like less than five minutes. 440 00:42:11,820 --> 00:42:15,760 And I think we're out of time for the demo so I'll just I'll answer this question and then I 441 00:42:15,760 --> 00:42:21,040 think we're gonna have to wrap it up. Um the question was if I if I got it correctly there are 442 00:42:21,040 --> 00:42:25,960 a lot of different certificate authority stores in different operating systems and even in say 443 00:42:25,960 --> 00:42:31,120 say like a Windows you can have there's a certificate authority store for the operating 444 00:42:31,120 --> 00:42:35,600 system but if you have Java installed it has its own CA store. If you have Firefox installed it 445 00:42:35,600 --> 00:42:39,380 has its own separate CA store. If you have Thunderbird installed that's a third one. If you 446 00:42:39,380 --> 00:42:41,800 have Chrome it has a fourth one. And believe me if you have Windows it has a third one. And 447 00:42:41,820 --> 00:42:45,500 believe me I know this because I have to install those CA certs in every one of those stores and 448 00:42:45,500 --> 00:42:51,940 it's a giant PITA. So the question was is there any kind of industry move to like centralize this 449 00:42:51,940 --> 00:42:55,580 and keep those certificate stores up to date and have one place where all that stuff is collected 450 00:42:56,020 --> 00:43:00,420 and I think the answer is hell no. Because they don't want they don't want it that way. I think 451 00:43:00,420 --> 00:43:05,360 Chrome you know the Chrome developers and Google want their own store because they don't inherently 452 00:43:05,360 --> 00:43:10,500 trust the one on the operating system. Um and the same is probably true for I can't speak for 453 00:43:10,500 --> 00:43:11,800 the people at Mozilla Foundations. I can't speak for the people at Mozilla Foundations. I can't speak 454 00:43:11,820 --> 00:43:14,780 for the people at Mozilla Foundation. But like the reason why Thunderbird has its own store 455 00:43:14,780 --> 00:43:19,100 that's separate from the operating system is that they want to make sure that their CA store is 456 00:43:19,100 --> 00:43:22,920 accurate and and they're responsible for updating it when you download your updates right. 457 00:43:23,000 --> 00:43:27,960 That's that store gets updated periodically with different certs. Um or or you know sometimes 458 00:43:27,960 --> 00:43:32,400 they get deleted right. So like if you lose trust in Woesign you can go into those CA stores 459 00:43:32,400 --> 00:43:36,760 and delete the Woesign cert and then that kind of reduces the trust that you have in Woesign. 460 00:43:36,960 --> 00:43:41,540 Um it would be nice for there to be one place where you can just do all of that stuff. 461 00:43:41,820 --> 00:43:47,060 And honestly like it's the biggest difficulty in my daily job of having to work with this stuff is 462 00:43:47,060 --> 00:43:51,280 having to put the certs in all those stores. Especially cause I have six certs that I install in 463 00:43:51,280 --> 00:43:56,640 every machine. Um so but no I don't think that that's gonna be a problem that gets solved 464 00:43:56,640 --> 00:44:02,320 anytime soon. I'm sorry. I wish I could end on a happier note. I really wanted to show you guys 465 00:44:02,320 --> 00:44:06,100 the TrickBot stuff but you know what I'll just pitch it as a talk for next year. Are there any 466 00:44:06,100 --> 00:44:09,300 other are there any other questions? Oh yeah go ahead. 467 00:44:09,460 --> 00:44:11,220 Do you have any other trusted 468 00:44:11,820 --> 00:44:16,460 uh free or open source uh similar man in the middle stuff products you'd recommend to 469 00:44:16,460 --> 00:44:24,840 crypto? Um so free and open source man in the middle stuff. Is it? Yeah so um I know that some 470 00:44:24,840 --> 00:44:30,580 exist. I've never used them. I I know that we're not the only we're not the only commercial and 471 00:44:30,580 --> 00:44:35,620 we're not the only like free product that that does this right and that there are products out 472 00:44:35,620 --> 00:44:40,400 there that can do this. And there's also uh you know I think uh Symantec's antivirus and 473 00:44:40,400 --> 00:44:41,800 Kaspersky's antivirus also. Um I'm not sure if I'm gonna be able to answer all of your questions. 474 00:44:41,820 --> 00:44:46,680 So it can intercept SSL so that they can check the reputation on URLs that you visit when 475 00:44:46,680 --> 00:44:51,360 you're when you're using your computer. Um but I I'm sorry I don't have a good answer for like 476 00:44:51,360 --> 00:44:56,700 what's a good alt free alternative for this. If you find one though come and get my card and at 477 00:44:56,700 --> 00:45:00,420 the end of the talk and let me know what it is cause I'd like to play with it and see what we can 478 00:45:00,420 --> 00:45:05,340 do with it. Uh it's called SSL visibility and if anybody wants to come and see it's running behind 479 00:45:05,340 --> 00:45:10,400 the screen here so if anyone wants to see it I'll I'll have it out in the hallway afterwards. Alright. 480 00:45:10,400 --> 00:45:14,980 Alright. Yeah. I think I think we're out of time so oh is it do we have time for one more? 481 00:45:15,800 --> 00:45:18,100 Okay. Yeah. Okay. 482 00:45:56,000 --> 00:46:02,340 Right. Okay. So that's a really good the question is um because this thing is so critical on a 483 00:46:02,340 --> 00:46:07,680 network um screwing it up could really mess up your network. So how do what do we do to kind of 484 00:46:07,680 --> 00:46:10,380 mitigate that and and reduce the the attack on your network? Um I think that's a good question. 485 00:46:11,460 --> 00:46:18,980 So one of the things that we do. Wow. One of the things that we do is um there there's a uh 486 00:46:18,980 --> 00:46:24,560 there's an administrative interface that can be uh connected to a completely different VLAN or a 487 00:46:24,560 --> 00:46:29,420 different different segment of the network um and and that basically can be in like a secured 488 00:46:29,420 --> 00:46:35,400 part of the network. Uh the security analytics box as well like it will tap the the active part 489 00:46:35,400 --> 00:46:39,360 of the network but it's not necessarily connected to that active part of the network and so when you 490 00:46:39,360 --> 00:46:40,360 when you have an administrative interface that can be connected to that active part of the network. 491 00:46:40,380 --> 00:46:42,920 If you have an administrative interface that's got a separate ethernet jack you can put it on 492 00:46:42,920 --> 00:46:47,900 something else that's like a much more secured and tight tightened down segment of the network. 493 00:46:48,000 --> 00:46:51,140 It doesn't even have to be connected to the internet. It can just be used for administrative 494 00:46:51,140 --> 00:46:57,840 interface. Um so that that's basically how we do it. Um the the bump in the wire itself that the 495 00:46:57,840 --> 00:47:04,060 SSLV represents like there's there's nothing that that is uh and I shouldn't say this like 496 00:47:04,560 --> 00:47:10,240 definitively but I am 99 percent sure that there's nothing that can be interfaced with over the 497 00:47:10,240 --> 00:47:16,020 that like through part of the network. So alright I'm getting the hook so thanks everybody for 498 00:47:16,020 --> 00:47:17,340 coming and I appreciate your patience.