Everybody, thank you everybody very much for your patience. I'm Andrew Brand, I'm the
director of threat research at Symantec and obviously not as much of a techie as I'd hoped
I would be today. So we're going to be talking a little bit about the SSL visibility
appliance and unfortunately although I have a demo unit here behind this projector, there is
no wired internet drop in the crypto and privacy village so it is on and it is working, it's
just not hooked up to anything. We can do a little bit of a demo with it at the end if there's a
little bit of time. There are instructions here for like how to do the testing if you really
wanted to do the testing but it's not actually connected to any kind of a live internet
service so while you can connect to it and you can download these certs that I've generated by
it, you cannot really use them for anything so just don't bother. Alright so I'm going to talk
a little bit about what the former blue code, now I'll, I'm going to talk a little bit about
part of the big happy Symantec family is and the division that I work in, I'm going to talk a
little bit about how this gizmo works and what it's meant to do, also what it can't do and
because I use this in my lab with a lot of different types of devices and a lot of different types
of operating systems, I have some experience in what is able to get through there and be
decrypted, what and what the device basically causes everything to kind of choke on.
Right, um, so a lot of what I'm going to show you is going to be UI from the, uh, from the
visibility appliance itself which it's not very pretty, um, but there is also, uh, a component of
this, uh, a stack that I work with that's called security analytics and, and that's more
important for me to sort of explain from the beginning because a lot of the packets that I look
at, uh, come out of SA. So the SSL visibility appliance essentially is this man in the middle
decrypter that you would put between your WAN and your, and your LAN and you might use it for sort
of two purposes. You might use it to man in the middle internal traffic that's outbound or, uh,
external traffic that's coming into a, a service that's got like SSL or TDS on, on the host. Um,
when those packets come through the SSLV, it does it, if it can do its decryption, it will spew
them out on, uh, a separate port which you can then capture, uh, with a spanner attached to it.
That port and then, uh, that stuff gets ingested into security analytics and what that does is
records everything, indexes all the metadata out of those packets and then re-indexes that index.
So the searching is really fast and you get something that's essentially a SIM-like interface
but when you drill down to like the, the nittiest of the nitty-gritty, you can get down to the
packet level, you can reconstruct files, uh, from various types of, uh, uh, uh, applications
that have been, uh, uh, observed, uh, communicating over your network. So HTTP, email, uh, a bunch
of different types of, uh, uh, protocols can be basically, uh, decrypted and, and then
reconstructed into a, a, essentially you can look like you're looking over the shoulder of the
machine, uh, that was doing the browsing or making the connections. Um, so what SA can do is it,
basically it can, um, inspect tons and tons of traffic. It's
meant for high-speed sort of enterprise networks. Uh, it, sort of com- as a component of that it
uses a lot of storage. You can imagine, you just do the math on how fast the network is, what
it's typical load is, um, and, uh, the number of days of storage you want to, uh, be able to go
back, uh, retrospectively and do analysis on. And you can imagine we're talking, you know,
we're in some cases into the, uh, peta and exabyte amount of storage for, for some, uh,
applications. I run it on a virtual appliance because my network is relatively slow and with a,
with a couple of gigs of, uh, of packet data plus the metadata I'm, I'm usually able to go back
three or four months, uh, and, and reconstruct stuff, uh, pretty far back. Um, so, and I've
already talked about what SSL visibility is. It's, um, it really is just a, uh, it's, it's basically,
custom silicon dedicated to do the math that's involved in, uh, SSL decryption. All right. So
these are the sort of the two, um, uh, ways that we would use SSLV. Most of the time that I'm
using it in my lab, um, I am using it in the sort of outbound inspection, uh, sort of variety
which is where I've got the thing, uh, watching traffic. It's, it's, it's inside the, it's
inside the LAN but it's just inside the sort of the perimeter before everything else is
working. Uh, I can just basically tell my server, uh, I can just tell my server that, and
if I'm just going to try to do something else and everything that goes outbound is going through
this thing and when it can be inspected it is inspected and when it causes problems, uh, you
can, you can basically you can tell it to do one of two things. You can either have it reject
that connection and basically kill it in which case, uh, the application will throw errors if
its obviously not able to, uh, complete its communication or you can just tell the box, if
you identify this, this protocol or this particular service or this domain name or these IP ranges,
is uh you can say um just ignore uh for the purposes of doing inspection these these things
that you have set up and then it will ignore that and everything will go through but you
won't get the decrypted SSL either. Alright so when when you first connect into the SSL via
the first thing that that you see is that it has its own self-signed cert um obviously
because you you know all of these appliances are are using SSL and that's pretty normal. Um
the cert looks like that it actually has a common name of SSL uh NGUI um and it's
generated the first time you use the app. So this is the dashboard of the SSLV um it has a
that's the prettiest picture that you're ever gonna see in the UI and um all it does it shows
you a sort of representation visually of the rack and the ports that are on the front of it
and yeah it's the one device that I have in my stack where the ports are on the front
everything else is on the back so it's kind of a pain.
Um and it will tell you basically how you're using it um in this case I'm using it in
something called active F line uh active inline FTN mode uh and that is where uh all sessions
are basically being intercepted when they can be decrypted it is doing so and when they
cannot it it essentially lets them go through on uh without trying to decrypt them uh just to
allow things to work. Um sorry that that's so tiny but this is just a picture of the user
interface of the SSL session log and what's important about this is that it will tell you uh
we'll bother simple what cipher suite the device is uh is trying to decrypt um if that type of uh
cypher suite is supported by the device not all of them are but many of them are um and then
whether or not it was able to successfully decrypt it when it uh is not able to decrypt it and
the device allows the connection to go through anyways so it still works uh that is called a
So
And it's kind of an interesting thing. One of the ways that the device works is that you
have, you know, clearly you have one Ethernet is for in and one is for out. And then there is a
second pair of ports. It is literally, it is a physical loop back where you have to have the
tiniest cable in the world and it's just a loop between them. And the reason for that is the
device will programmatically decide when something is supposed to go through and it will
literally shunt it through this other thing which is just a loop to get it around all of the
silicon inside. So to use it you basically generate a cert. And the cert is generated,
essentially the device acts as like a certificate authority. So it will generate a cert for you.
You can add all of the, you know, custom information that you would want into the
certificate. This is not a, you know, a valid cert that you would be able to then put up on
your, your, you know, HTTPS server. So it is, it is literally, its only purpose is to do the
re-signing. So the, the secret key remains within the device and then you can export the sort of
the public side of the cert which you can then add into the certificate store of any of your
devices. And when, when that cert is in the cert store the re-signing happens essentially
transparently and automatically. There's a huge number of protocols that it supports. It's just
the, some screenshots of some of the UI drop downs that show you all the different options that
you can have when you generate your cert.
Right. And then, you know, here's the, the exported cert. It shows like you can create one,
like this one that says I call this my DEFCON certificate and it will export it as a PEM or a CRT
or CER or DER and then you can, you know, import it into a variety of different devices.
Alright. And then here's just the, the, the re-signing authorities are basically like, you
know, you can decide under certain circumstances when such and such cipher suite is being
used. Use this certificate authority or else use this other one. And it's a way of basically,
you know, you can use it for a bunch of different reasons but it's a, primarily a way of
maintaining the same security level of the traffic on your internal network so you're not
basically using a weakened cipher or something that's easy to crack inside the building because
that would be, you know, talk about crunchy outside and soft and chewy on the inside. It's
just, it would just make things worse for a lot of, a lot of things. Right. And then once
you have your, um, once you have your CERT set up and they've been installed on your devices
then you have to create rule sets where you basically say under these circumstances you're
gonna do the, the decrypting, right? And so you go to this rules, policies menu, go to rule
sets and you kind of add in your rule. And, and in this case the rule sets that I've created
are, you know, basically, uh, look at everything and then if you see these domain names,
exclude them. If you see these IP addresses which happen to be internal devices, exclude them. If
you see these IP addresses that belong to, you know, Netflix's, uh, uh, you know, content
management system, exclude them because Netflix for some reason doesn't like to have all of
their stuff decrypted. Um, and then, you know, and so on and so forth and then the very last
step is do the decryption. Right. Um, so one of the cool features that is in the sort of newer
version of this product is that, um, it, it pulls down and, and, uh, ties in with, uh, the
categories that, that BlueCode has created for its, uh, its web categorization service that sort of
underlies a lot of their other products that, um, most people know that BlueCode proxy is, is the
big enterprise product that a lot of people have and they have these categories where
administrators can set up policies where they don't want employees to visit porn sites on the
job. I mean, shocking, right? But like you might not want to block that. And so in this case you
can actually use those same categories and you can say, uh, I want to decrypt everything except stuff
that's tied to banking and financial, for example. And there, thereby you can exclude the stuff
that would basically make you, you know, would force you to violate, um, uh, you know, PCI DSS
standards, for example, and you would accidentally be, you know, leaking tons of data across your
network decrypted that you wouldn't want to, to be leaked. Um, so, yeah, anyway, that's, and I, and
the team I work for is the team that creates that and maintains that reputation service. They're,
it's called the Global Information Network. Um, once you've done all that then you, you just
kind of, you know, pop it in and there's a little UI that says, you know, plug this into port 1 and
2, plug this into port 5 and 6 and then everything else, the tap is coming out of the other
ports. Right. More, more little choosers that show you different combinations of things you can do.
Um, so one of the things that it can do is also if, if the, because it's an inline box it's a, it's a
bump in the wire, uh, you would imagine that if there were a physical failure like a power outage
you, your network might go down if this box wasn't turned on. So there's this concept of, uh, fail to
network and that, that's one of the other reasons why there's that little loop back physical wire in
there is that it will, it will actually physically click over, you'll hear a loud click when the
power goes out and then that just means that it, it acts as a bump in the wire with nothing in
between it so your network continues running even though the power's out.
Right. Here's, um, some of the rules and the failure modes, uh, that it can experience and what
you can choose to do with it. Basically you can either choose to reject which means kill the
connection or you can tell it to cut through which means let it go and it's not decrypting
anything. Right. Um, and we've already talked about this. You saw that graphic. So I'm not gonna
repeat all that. Um, it does not get used in a couple of different circumstances. So, um, last
time, uh, it was, there's been some misunderstanding about like the purpose of this device and it is
not something, while it is suitable for enterprise networks where you may have a, a couple to
10,000 machines on a network, um, at the highest end, uh, it, it, in sort of like anything
bigger than that, you're gonna run into real problems where the CPU load is just gonna be too
high for the device and it's gonna start dropping sessions. So this is not a box that you can plug
in on your country's WAN card. It's not a box that you can plug in on your country's WAN card.
It's like a, uh, WAN connection to the rest of the internet and basically decrypt everything
that everyone is doing. The other thing that you can't do is you can't decrypt stuff and have it
not be really obvious. Everything that gets decrypted if it doesn't have your CACERT in your
CERT store, is basically going to cause errors to pop up in whatever application you use. If
you're using the browser, you'll see those messages that pop up that say, uh, there's
something hinky about this H, H, HTTPS connection, uh, do you, are these, are these here? How
you sure you want to connect to it. So if you don't have that CACert installed it's going to
throw a lot of those errors and there are going to be devices and applications that don't
connect at all. Right. And that's basically what I was saying is that none of this stuff is
going to work if you don't have the CACert on it. When you do not, when you do install CACerts
on a laptop there isn't necessarily a warning message to let you know that stuff is going to
be decryptable. And in some cases we've seen well they're kind of shoddy crimeware applications
that have tried to convince people to install CACerts on to their device so that the
criminal's malware can actually decrypt the SSL for the criminal. And other than that I haven't
seen a whole lot of criminal use of this type of thing. So I think it's going to be a
good thing. But when you do install the CERT in other devices like in Android you get these
persistent uh alerts that never go away the entire time the CERT is installed. So the only way to
get these messages that say things like network may be monitored by an uh you know an unknown
third party uh you're going to see that message until you actually delete those CERTs completely
out of the store. Alright. So what's better in the past year? Um I gave a talk similar to this
last year. And the talk that I gave was about how um how few applications for mobile devices
specifically were actually using something called certificate pinning. Where they they
essentially have a CACert built into the app and if that CERT does not match identically to what
it's getting you know in terms of the handshake from the server the connection simply doesn't go
through. And uh a year ago there were a few apps that um essentially were you know very, very,
very secure and would never allow that to go through but a lot of other stuff did. Some of the
apps that worked last year were um that that securely connected and had pin CERTs were things
like um like the Twitter app, like signal the uh uh SMS replacement app and you know other
kinds of security tools that you can imagine would would want to have pin CERTs. Um I believe
also Facebook uh supported pinning and and a few games that do uh uh over HTTPS uh some command
and control for the game. Um there's been a lot of improvements over the past year so I I kind
of uh and I gave a different talk last year uh about a game that I use that is a uh location
based game called Ingress and how um it is it has been and is continuing to be heavily abused
by people who do man in the middle, SSL interception to decrypt all of the command and
control stuff and messaging that's in the game and that's being used to essentially louse
up that game and cheat. And um I'm I'm sad to say that that that app has not improved although
um the other game that that same company uh Niantic makes, Pokemon Go, in a release that
happened sometime in the last fall uh they did start pinning their CERTs. So while it is still
possible to man in the middle uh Ingress you cannot man in the middle Pokemon Go to the best
of my knowledge unless you do some some hacking of the app itself. Um right and I mean I think
I mentioned that like basically when it's when a certificate is pinned that it's not going to
work. I mean it's really not going to work and and and a lot of times um the application
developers when they when they create these apps that have pins in them uh they're they're
doing it so that they can ensure privacy of the connection but they're not necessarily building
in the the error uh responses to understand and explain to the end user why the thing isn't
connecting. It will just say like tweets cannot be received at this time. So it's it's a
so in some cases you'll get these messages where it says it just couldn't connect and in
others it will say it looks like there's SSL interception going on I'm definitely not going to
connect but a lot of times the the error messages are pretty confusing. Um so let me show you
some of the other stuff that's popped out uh just in doing a little bit of looking at devices.
So um so what I haven't explained is sort of in in my day job uh I I run this lab it's full of
IOT devices, it's full of Android phones that are running malware.
Uh at any given time. Uh I also have bare metal machines, virtual machines and some
sandboxes that are running malware and the purpose of doing all of this decryption and and
recording of network traffic is so that we in the gym team can observe the command and control
traffic of malware, know where it's talking to, how it communicates and write rules for various
tools to either be able to uh uh notice when those kinds of connections are happening or to be
able to block them by I by address or or sometimes uh you know block them by address or or sometimes
uh to narrow it down to like the URI path uh that a that a command and control connection would
be happening on. So um so I do have a demo um that was ready to go on my other laptop and
hopefully I if if the person who loaned me their laptop doesn't mind I might connect it to my demo
network and see if I can do that at the end. Um because I there's there is some malware that
uses TLS to do its command and control. Uh one of the the primary ones that I'm seeing right now
is a a bot that's that emerged in the last few months called TLS. Uh it's a bot that's been
called TrickBot which is starting to kind of gain traction as a uh a main rat that people are
are distributing through a lot of different methods but mainly through spam and through uh uh
exploit kits. And it's a it's an interesting one because it's it's also one of the more
sophisticated and modular pieces of malware that I've seen. It it it basically is a a core engine
uh for the malicious activity uh and it brings down modules from different command and control
servers so that it can uh you know it can uh you know it can uh you know it can uh it can
uh it can run those modules as DLLs and kind of hook into different features on whatever machine
it happens to have infected. So a couple of the weird things that have popped up recently.
So um like uh looking in these logs uh I will sometimes just kind of skim through them and
there's there's actually a filter thing that will trigger like just show you all the errors that
appear in the SSL session logs and so I like to look through those and just see sort of what
broke recently and I I wanted to call a few of these out so I have a few of these that I think
So just last week I was looking at a couple of these things and I had a machine, I had a
phone that was attached to one of my nodes in my network that is being, you know, routes
through this. And the phone was doing some just normal activity but this error popped up and
it's the one that's highlighted here and it was a big log line so I split it in half but
basically at the very end, near the end you can see it says expired. So the cert in this case
when this communication happened, it allowed the communication to go through, it did not, it
was not able to decrypt it and it did report that the cert was expired so I went back in and I
looked at, you could see that the origin IP of this was 54.208.221.85 so I went into security
analytics and I pulled out the undecrypted flow that contained that session with the SSL
stuff and then I used a tool called network miner to just like dump out, you know, the
SERT and take a look at that. So when I did that I found that there was this SERT for something
called parse.com and parse is one of many different kinds of sort of mobile, it's
instrumentation that developers will install, third party instrumentation package that they use
to kind of keep track of how their app is behaving and it receives telemetry over HTTPS as
well and their SERT expired. It's hard to see but it says like it expired on June 29th so
they were still running on an expired SERT and I wasn't able to decrypt it because of that.
One of the other things that I have, like I mentioned, a lot of IOT devices and we have a
couple of Samsung smart TVs, different models, connected to that network. In general the
Samsung is an interesting device because it, how many people, just a show of hands, how many
people have a Samsung smart TV? So just a few but you know more than half of them have a
Samsung smart TV. More than a couple. Interesting device. It has its own sort of version of
the, of an operating system. It has its own antivirus built into it as well. You can tell the
thing to scan for files within the, the operating system, file system. And it, it has Ethernet
ports and can connect over a wired or wireless connection and obviously you would then, you
know, connect it to the network and it has, you know, all your apps for, you know, Netflix or
Hulu or Amazon, whatever your video streaming service of choice is. So it's, you know, it's a
great device. So when you want to watch HBO Go you just go into the TV and you pivot over to the
streaming service that you want and it launches an app within the TV and those apps are all
downloaded through a cloud service that Samsung operates. The TV also does things, like it
scans the whole network, oh, every, four times every second for Samsung, like, mobile devices
that can connect to the TV. It generates a ton of noise and actually it's, I, I would say it's one
of the reasons why when you buy a smart TV it's always good to connect it to a power strip and
when you turn it off, turn it off on the power strip so that it's not just sitting there.
Because I've seen my TV stay active for three, four hours after you turn it off and it
continues scanning looking for, like, hey, does anyone want to connect and, like, share
videos on the screen? Um, so it's pretty obnoxious. And, and in addition to all of that
noise, uh, the TV itself has authentication with, uh, a Samsung account that you can, you know,
set up, uh, to do technical support and also to save your preferences. There's a browser built
into the TV so if you want to browse the internet, um, you can save your bookmarks in your
Samsung account and then when you log into your Samsung account on a different TV or a
different device, basically you can get all that stuff back. Um, so what we've got here is logs
from, uh, the SSLV showing that, um, the TV was going to a bunch of different websites
including, uh, SamsungCloudSolution.net and, uh, the, uh, the, uh, the, uh, the, uh, the, uh,
and SamsungACR.com. Uh, all of these Samsung apps that are in the TV themselves, uh, with the
exception of its Wi-Fi connection check, uh, they, all of them basically fail on this because
they're using a pinned cert. That's good because the one that, that's connecting to, um,
SamsungACR.com, uh, is, is connecting to something called log ingestion dot SamsungACR.com.
Um, the, the bad news is that, um, all of the, uh, the, uh, the, uh, the, uh, the, uh, the,
all of those domains have invalid issuers. So, so there's a cert that was issued to these
different TV connection domains that isn't valid. And when I pulled them out, I looked at
them and, yeah, they're all self-signed certs. So apparently Samsung operates its own internal
certificate authority and they generate these certs for their devices which then get flashed
into the firmware for the TVs and the, the, the mobile phones and everything else. And the
other thing that I was playing with was, um, uh, my son's Nintendo 3DS. Uh, I do occasionally
confiscate for, like, research purposes and play a little bit of Pokemon XY. But, um, besides
that, um, the, the device is actually really interesting because it can do, uh, peer-to-peer
networking over Wi-Fi and, uh, you know, so you can play basically, uh, uh, collaborative
games together with your buddies. Um, it also has its own built-in browser and you can, and it
will, it, it kind of, uh, tries as best it can to generate a mobile version of things like
Gmail. So you can read your Gmail and stuff through the browser on the 3DS. I wouldn't
recommend it. It's not the best way to read, uh, your email. Um, and when you go to the
browser and you have, uh, SSL interception on it, you can see here it pops up a warning message
that asks you to basically bypass the, the, um, security features in the SSL. Are you sure you
want to do this? It's essentially the same as what you would get in Chrome. Um, so in the
browser of the 3DS you can manually bypass the, the, um, security features in the SSL.
This error message and, and, I don't know, show of hands, how many people think 10-year-olds
understand what the context of this kind of a dialogue box is? Exactly. So everybody, when,
your child is a, a straight-A student in my book. That one guy in the back who raised his
hand. So, um, so most kids are gonna just hit allow because they don't understand what's
gonna happen and, um, I believe a lot of adults do that too when they see this kind of a
message. So you can bypass and you can decrypt the SSL from the browser. Um, and, and, and, um,
what you can't do without doing some serious modifications to the 3DS is you cannot decrypt any
of the other HTTPS communications that the device does. So among those things, uh, there is a
Nintendo account where you can create your Mii, uh, which is the little cartoony character that
represents you in all the games. Uh, and you can share your Mii through your Nintendo account
with your buddies so that when they play, uh, co-op with you, the, your Mii shows up on their
device, their Mii shows up on your device. Um, so none of that, uh, Mii, Mii Gallery stuff works,
uh, if you have Interception turned on. It just can't connect. Uh, the other thing that fails is,
um, uh, there is a online store where you can buy the games and, uh, essentially download them to
the device to the SD card or, or into the device's memory. Um, this store app is also pinned so
that when you have Interception turned on you're not gonna be able to buy a game and take it to the
device and download it. Um, and then the third thing that's kind of an issue is that, um, all of
the domains that are being used for Nintendo, um, are also invalid issuers. So here I've got some
of the screens, uh, on this one at the very bottom, uh, it's the C.shop.NintendoWiFi.net, uh,
has an invalid issuer. And then on these two screens there's, uh, something called, uh,
NASC.NintendoWiFi.net and Account.Nintendo.net and all of them are issued by Nintendo. So, uh,
are, are invalid issuers and again it's, um, it comes down to Nintendo themselves just like
Samsung are operating their own certificate authority and they're basically self-signing certs
and throwing them into these devices. Um, I, you have to wonder about these large electronic
manufacturers. I mean, I think that they probably have 50 bucks a year to throw at buying some
certs. Um, I would hope that this would change in the future. I think right now it's probably
being done for convenience sake but it would be nice to see some trust levels in the SSL
communications, uh, and not just self-signed certs because this, as we all know, that's just asking
for trouble. Uh, when you try to do, um, anything over an intercepted network, uh, through
these pinned apps that are, that are built into the 3DS, you end up with a message that's very
obscure looking and looks like this. Uh, the one on the left that says an error has occurred,
please try again later. When you go and you look up that error, uh, you'll see a message that says,
error code. It, it tells you that there's, um, there's a message in that error code that
essentially is that the clock is set wrong so you need to check the time and then, and then, uh,
try to reconnect again. And that actually comes up a lot when you, when you're seeing
certificate re-signing is that the error is basically the same as if your clock was off and
the timing for the cert, uh, was, was wrong. Um, but the, but the game developers or the, the
device manufacturers don't as, anticipate or assume that
people are doing man-in-the-middle decryption on their stuff so they just basically have one
error message for the whole, that whole type of thing. The one thing that does work though is when
you do the connection test. So, so there is a, um, there's a whole Wi-Fi UI in the 3DS and you
can connect to an access point and then it, it wants to go off and make sure that it can make a,
a valid connection. If it cannot make an HTTP connection, which it tries first, it then tries
just an HTTP connection to a, to a URL that's on Nintendo's website. Um, and then, and then, and
when that works it basically comes back and says your connection is good. But it doesn't tell you
that you weren't able to connect over SSL. So, um, yeah. It's just an, you know, another
weirdness in a consumer electronics device. Um, another ish, invalid issuer problem that I found
was with, um, Whisper Systems. So Whisper Systems makes the, uh, Signal app. Um, I'm a user of it
and, you know, I, I love Mox, uh, Moxie Marlin. Um, and, and, and, and, and, and, and, and, and,
Spike. Right? I mean he's been to DEF CON a million times and spoken and he's a great guy and
this is a great app. Um, but once again it's, it's using a, a self-generated cert, uh, to do that
communication and, um, I just would prefer, I, I don't know how you feel about it, I think it
would be stronger if more of these companies, uh, used certs that had some validity that can be,
uh, validated through a, uh, certificate authority. Um, so here's the Whisper Systems cert, right?
And it says Windows did not have enough, uh, uh, information to verify the certificate and at
the bottom of the second one it says the, the issuer of the certificate could not be found. And
that's basically the same error that the Nintendo one did and the Samsung one did. So probably,
most likely it was a self, self-signed cert. If I, if I had my laptop I could open the cert and
take a look and see what it was signed with. I don't have the screenshot up here. Um, right. Oh,
so one of the other thing that, uh, came out of this is that, um, so the, the, there are these,
third-party apps, right? So, you know, Netflix and Hulu and all those guys have their own apps.
They produce them for the Tizen operating system, which is the thing that's running in the
Samsung TV. And then those apps can have their other, like, third-party instrumentation in them
so that those app developers can get feedback directly from the TV user, uh, when something's
not working, if streaming's not coming through, right? I mean, I, you can understand why, you
know, Netflix wants to know what your throughput is and if, if you're, uh, getting too many
artifacts in the video. And so there's all this internet, um, uh, instrumentation built into, uh,
the, the apps themselves. And in this case there was an invalid issuer for, uh, Netflix's app. So
there was a self-signed cert for Netflix's app. And then there was also something called
internet at dot TV. And that also was a self-signed cert. So that's, whatever that is, and
I'm not 100% sure what it is because, of course, I wasn't able to inspect the content of the
traffic, uh, other than to see the cert. It was all invalid certs.
So, um, so that's problematic. Um, now I was going to jump at this point over to my wireless
network and show you the decrypted traffic from TrickBot. What it, now, I will pause for a
moment and see if there's any questions and ask if, if, uh, is this your, this your laptop,
right? Can, yeah, no, can you, would you mind coming up here and connecting me to my
wireless? And so, questions, yes?
No, no, TrickBot is a piece of malware that's created by someone, we don't know who that
person is. And, uh, and TrickBot is, we are decrypting the TrickBot command and control
traffic using this technique. So the, the access point is, it's this 743EA. And, uh, here I'll
let you access it. Yeah, so, uh, so, uh, so, uh, so, uh, so, uh, so, uh, so, uh, so, uh, so, uh,
so, did everybody catch the, the question was, uh, is the, is TrickBot the tool that I'm using?
And it, and no, it is not. Yes?
Um, thanks. So, I apologize if this is, uh, uh, but why does a validly signed
search, uh, entry security over a, in, self-signed search in case of where the app
will be really unconnected to your server if you don't have a self-signing, uh, part of it?
Well, I wouldn't say that it actually, so the question is, uh,
why does it, why is a, why is a self-signed search less secure than a pinned search? Is
that, is that essentially? Well, it, uh, okay, so, um, let me step back and just reiterate.
So, I, I wouldn't say that it's more secure than, one is not more secure than the other, but I
think having some certificate validity being issued by a, a valid CA where it can be checked,
um, and that there's some trust there is better than having a self-signed search. That's not to
say that the self-signed search are inherently insecure or that there's some problem with
them. Um, but it, but this validity checking only happens when it's been done through a
cert, certificate authority. I'm sorry, hang on one second, I want to make sure that I can get
online. It says it's not connected. It's still, it's still trying to connect to it. It, it
won't, until it's connected it's not going to work.
Yeah, if you don't mind.
I'm sorry, would you please repeat your question?
Okay, so the question is, um, so if they're using a purchased cert instead of a, uh, a self-signed
cert, um, why should I trust the purchased cert more? Um, I don't know, it just, I like to, I
like to be able to make sure that it's legit. Um, it's too, I think it's too easy to kind of
clone an app and modify it. Um, I think it's too easy to kind of clone an app and modify it.
And add your own self-signed cert in there to kind of pretend to be the app. And maybe put it on
an app store. Um, having that, having that be a valid cert at least gives you the, the, um,
confidence that when it's talking back to its command and control server that it's, it's talking
back to a command and control server that has at least, um, you know, proposed to a valid
signing authority that they are the real deal. Right? So like if you're using your Chase Bank
app, I want to make sure that that cert is valid, that it's talking to Chase and that it's not
just a fake Chase Bank app that's talking to some other guy. Does that make sense? I mean it
doesn't necessarily make it inherently more secure communications, but it makes me feel better
about using it. Yes?
That, that is a valid point and I will repeat that. Um, so if the app is its self-signed by the,
and the code is signed so that you know that the, uh, the app is, is, uh, reputedly originating
with the real developer, um, that obviates the need for checking the cert. And, and, yeah,
that's actually a valid point and one that I hadn't considered. I, I don't, so my, my
focus in this talk was just very, very narrowly on the network side of things, um, and not
looking at the, the apps themselves. Um, him and then you? Do you know anything about the, um,
Google's, uh, certificate transparency? Have you heard about that? Uh, so, do I know about
Google's, uh, certificate transparency? I, I haven't heard the news about it, so, um, I, I do, I do
know that, um, uh, Google's certs and, and the way that they do SSL specifically within Chrome,
they're, they're very on the cutting edge of, um, trying to defeat tools like SSL
visibility. So they're, they were, uh, some of the earliest adopters of some of the, uh, uh,
really, uh, obscure and, and hard to decrypt, uh, protocols that were being used and so, um, I
would say that the, when it comes to the team that's doing the development and management of the
SSL visibility product. 95% of their like feature request is oh Google Chrome just added a new
like you know certificate you know or new encryption rule that they need to be able to
decrypt and like suddenly it's not working anymore. So like I think four times last year
they came out with a new version of Chrome and all of a sudden everything broke in SSLV. So
then a new version of SSLV's firmware had to be uploaded and you know reinstalled and
there's a lot of time that we spend trying to bust into Google stuff. Hi go ahead.
Wow that's so it's not a stupid question but it's not a simple answer. I mean essentially
what it's doing is you have a certificate handshake that comes in and is presented what
essentially to the client. The SSLV looks for that handshake and it's like oh Google Chrome
handshake. It then it it then takes that certificate for the handshake it pretends that
it's the client and does the handshake back to the server but then internally within the
SSLV it's it's takes the decrypted traffic, re-encrypts it with it's with that cert that
it's generated and then sends that up to the client so it's doing this kind of like half to
two halves of the whole. Yeah. The decrypted traffic is happening inside of the SSLV box itself.
It's it's pretend basically the box pretends to be the client. It presents itself as the client.
As being being the client's like originating you know box basically and and so it does the
handshaking and then instead of that you know normally that decrypted data would be then you
know sent into the browser itself and rendered on the screen instead it shunts that out of a
decrypted port on the box and then it will re-encrypt it with the certs that you've created
and then send that up to the client. Yeah. And then it then it then it then it then it then it
sends it to the endpoint that actually made the request in the first place. Yes.
Okay. So it's a long question and I've got like less than five minutes.
And I think we're out of time for the demo so I'll just I'll answer this question and then I
think we're gonna have to wrap it up. Um the question was if I if I got it correctly there are
a lot of different certificate authority stores in different operating systems and even in say
say like a Windows you can have there's a certificate authority store for the operating
system but if you have Java installed it has its own CA store. If you have Firefox installed it
has its own separate CA store. If you have Thunderbird installed that's a third one. If you
have Chrome it has a fourth one. And believe me if you have Windows it has a third one. And
believe me I know this because I have to install those CA certs in every one of those stores and
it's a giant PITA. So the question was is there any kind of industry move to like centralize this
and keep those certificate stores up to date and have one place where all that stuff is collected
and I think the answer is hell no. Because they don't want they don't want it that way. I think
Chrome you know the Chrome developers and Google want their own store because they don't inherently
trust the one on the operating system. Um and the same is probably true for I can't speak for
the people at Mozilla Foundations. I can't speak for the people at Mozilla Foundations. I can't speak
for the people at Mozilla Foundation. But like the reason why Thunderbird has its own store
that's separate from the operating system is that they want to make sure that their CA store is
accurate and and they're responsible for updating it when you download your updates right.
That's that store gets updated periodically with different certs. Um or or you know sometimes
they get deleted right. So like if you lose trust in Woesign you can go into those CA stores
and delete the Woesign cert and then that kind of reduces the trust that you have in Woesign.
Um it would be nice for there to be one place where you can just do all of that stuff.
And honestly like it's the biggest difficulty in my daily job of having to work with this stuff is
having to put the certs in all those stores. Especially cause I have six certs that I install in
every machine. Um so but no I don't think that that's gonna be a problem that gets solved
anytime soon. I'm sorry. I wish I could end on a happier note. I really wanted to show you guys
the TrickBot stuff but you know what I'll just pitch it as a talk for next year. Are there any
other are there any other questions? Oh yeah go ahead.
Do you have any other trusted
uh free or open source uh similar man in the middle stuff products you'd recommend to
crypto? Um so free and open source man in the middle stuff. Is it? Yeah so um I know that some
exist. I've never used them. I I know that we're not the only we're not the only commercial and
we're not the only like free product that that does this right and that there are products out
there that can do this. And there's also uh you know I think uh Symantec's antivirus and
Kaspersky's antivirus also. Um I'm not sure if I'm gonna be able to answer all of your questions.
So it can intercept SSL so that they can check the reputation on URLs that you visit when
you're when you're using your computer. Um but I I'm sorry I don't have a good answer for like
what's a good alt free alternative for this. If you find one though come and get my card and at
the end of the talk and let me know what it is cause I'd like to play with it and see what we can
do with it. Uh it's called SSL visibility and if anybody wants to come and see it's running behind
the screen here so if anyone wants to see it I'll I'll have it out in the hallway afterwards. Alright.
Alright. Yeah. I think I think we're out of time so oh is it do we have time for one more?
Okay. Yeah. Okay.
Right. Okay. So that's a really good the question is um because this thing is so critical on a
network um screwing it up could really mess up your network. So how do what do we do to kind of
mitigate that and and reduce the the attack on your network? Um I think that's a good question.
So one of the things that we do. Wow. One of the things that we do is um there there's a uh
there's an administrative interface that can be uh connected to a completely different VLAN or a
different different segment of the network um and and that basically can be in like a secured
part of the network. Uh the security analytics box as well like it will tap the the active part
of the network but it's not necessarily connected to that active part of the network and so when you
when you have an administrative interface that can be connected to that active part of the network.
If you have an administrative interface that's got a separate ethernet jack you can put it on
something else that's like a much more secured and tight tightened down segment of the network.
It doesn't even have to be connected to the internet. It can just be used for administrative
interface. Um so that that's basically how we do it. Um the the bump in the wire itself that the
SSLV represents like there's there's nothing that that is uh and I shouldn't say this like
definitively but I am 99 percent sure that there's nothing that can be interfaced with over the
that like through part of the network. So alright I'm getting the hook so thanks everybody for
coming and I appreciate your patience.