TaoSecurity Blog

I spent a chunk of the day troubleshooting a network security monitoring (NSM) problem. I thought I would share the problem and my investigation in the hopes that it might help others. The specifics are probably less important than the general approach. It began with ja3 . You may know ja3 as a set of Zeek scripts developed by the Salesforce engineering team to profile client and server TLS parameters. I was reviewing Zeek logs captured by my Corelight appliance and by one of my lab sensors running Security Onion. I had coverage of the same endpoint in both sensors. I noticed that the SO Zeek logs did not have ja3 hashes in the ssl.log entries. Both sensors did have ja3s hashes. My first thought was that SO was misconfigured somehow to not record ja3 hashes. I quickly dismissed that, because it made no sense. Besides, verifying that intution required me to start troubleshooting near the top of the software stack. I decided to start at the bottom, or close to the bottom. I ha...

I am really fired up to join Corelight. I’ve had to keep my involvement with the team a secret since officially starting on July 20th. Why was I so excited about this company? Let me step backwards to help explain my present situation, and forecast the future. Twenty years ago this month I joined the Air Force Computer Emergency Response Team (AFCERT) at then-Kelly Air Force Base, located in hot but lovely San Antonio, Texas. I was a brand new captain who thought he knew about computers and hacking based on experiences from my teenage years and more recent information operations and traditional intelligence work within the Air Intelligence Agency. I was desperate to join any part of the then-five-year-old Information Warfare Center (AFIWC) because I sensed it was the most exciting unit on “Security Hill.” I had misjudged my presumed level of “hacking” knowledge, but I was not mistaken about the exciting life of an AFCERT intrusion detector! I quickly learned the tenets of network...

You may have seen in my LinkedIn profile that I'm advising a security startup called Critical Stack . If you use Security Onion or run the Bro network security monitoring platform (NSM), you're ready to try the Critical Stack Intel Client . Bro is not strictly an intrusion detection system that generates alerts, like Snort. Rather, Bro generates a range of NSM data, including session data, transaction data, extracted content data, statistical data, and even alerts -- if you want them. Bro includes an intelligence framework that facilitates integrating various sources into Bro. These sources can include more than just IP addresses. This Bro blog post explains some of the options, which include: Intel::ADDR Intel::URL Intel::SOFTWARE Intel::EMAIL Intel::DOMAIN Intel::USER_NAME Intel::FILE_HASH Intel::FILE_NAME Intel::CERT_HASH This Critical Stack Intel Client makes it easy to subscribe to over 30 threat feeds for the Bro intelligence framework. The screen c...

I remember using an older version of Bro to log SSL certificates extracted from the wire. The version shipped with Security Onion is new and that functionality doesn't appear to be enabled by default. I asked Seth Hall about this capability, and he told me how to get Bro to log all SSL certs that it sees. Edit /opt/bro/share/bro/site/local.bro to contain the changes as shown below. diff -u /opt/bro/share/bro/site/local.bro.orig /opt/bro/share/bro/site/local.bro --- /opt/bro/share/bro/site/local.bro.orig 2013-02-23 01:54:53.291457193 +0000 +++ /opt/bro/share/bro/site/local.bro 2013-02-23 01:55:16.151996423 +0000 @@ -56,6 +56,10 @@ # This script enables SSL/TLS certificate validation. @load protocols/ssl/validate-certs +# Log certs per Seth +@load protocols/ssl/extract-certs-pem +redef SSL::extract_certs_pem = ALL_HOSTS; + # If you have libGeoIP support built in, do some geographic detections and # logging for SSH traffic. @load protocols/ssh/geo-data Restart Bro. ...

I've written about Bro before, and I noticed the following mailing list post titled Poll: Bro deployments : Hello Sites Using Bro, We'd like to ask for your help. We're in the process of preparing a major funding proposal for improving Bro, focused on: improving the end-user experience (things like comprehensive documentation, polishing rough edges, fixing bugs); and improving performance. This looks like a potentially excellent opportunity. However, a major element of winning the funding is convincingly demonstrating to the funders that Bro is already well-established across a large & diverse user community. To develop that framing, we'd like to ask as many of you folks as possible to fill out the small questionaire below. Please send the replies to Robin personally, not to the list (just replying to this mail should do the right thing). Assuming sufficient feedback, we'll post an anonymized summary to the list. (Of course we already know about many of you, bu...

I was asked today about using Bro to record details of SSL certificates. I wanted to show an excerpt from one of my class labs as an example. In one of the labs I use Bro to generate logs for a network trace. The idea is that by looking at the server subject and server issuer fiels, you might identify odd activity. First I generate Bro logs. analyst@twsu804:~/case03$ /usr/local/bro/bin/bro -r /home/analyst/pcap/tws2_15casepcap/case03.pcap weird notice alarm tcp udp conn http http-request http-reply http-header ssl dns You can see Bro summarize the SSL connections it sees on port 443 TCP by default. analyst@twsu804:~/case03$ grep https.start ssl.log 1230953783.860406 #1 192.168.230.4/1700 > 67.199.36.111/https start 1230953792.363305 #2 192.168.230.4/1702 > 67.199.36.111/https start 1230953999.730060 #3 192.168.230.4/1712 > 63.245.209.118/https start 1230954052.303861 #4 192.168.230.4/1735 > 194.109.206.212/https start 1230954060.752904 #5 192.168.230.4/1742 > 24.92.5...

Last week I attended the Bro Hands-On Workshop 2009 . Bro is an open source network intrusion detection and traffic characterization program with a lineage stretching to the mid-1990s. I finally met Vern Paxson in person, which was great. I've known who Vern was for about 10 years but never met him or heard him speak. I first covered Bro in The Tao of Network Security Monitoring in 2004 with help from Chris Manders. About two years ago I posted Bro Basics and Bro Basics Follow-Up here. I haven't used Bro in production but after learning more about it in the workshop I would be comfortable using some of Bro's default features. I'm not going to say anything right now about using Bro. I did integrate Bro analysis into most of the cases in my all-new TCP/IP Weapons School 2.0 class at Black Hat this year. If TechTarget clears me for writing again in 2009 I will probably write some Bro articles for Traffic Talk . Richard Bejtlich is teaching new classes in Europ...

In my post Bro Basics I outlined the steps I took to install Bro . Since Friday I've taken a few more steps to get reports working. First, I re-ran make brolite-install as root. Next, I noticed errors in mail from bro: Date: Sat, 7 Apr 2007 00:10:01 -0400 (EDT) From: analyst@cel433.taosecurity.com (Cron Daemon) To: analyst@cel433.taosecurity.com Subject: Cron <analyst@cel433> ( nice -n 19 +/usr/local/bro-1.2.1/scripts/site-report.pl ) X-Cron-Env: <BROHOME=/usr/local/bro-1.2.1> X-Cron-Env: <SHELL=/bin/sh> X-Cron-Env: <HOME=/home/analyst> X-Cron-Env: <PATH=/usr/bin:/bin> X-Cron-Env: <LOGNAME=analyst> X-Cron-Env: <USER=analyst> Can't locate Bro/Config.pm in @INC (@INC contains: +/usr/local/bro/perl/lib/perl5/site_perl /usr/local/lib/perl5/5.8.8/BSDPAN +/usr/local/lib/perl5/site_perl/5.8.8/mach /usr/local/lib/perl5/site_perl/5.8.8 +/usr/local/lib/perl5/site_perl /usr/local/lib/perl5/5.8.8/mach +/usr/local/lib/perl5/5.8.8 .) at /usr...

When I wrote The Tao of Network Security Monitoring I discussed Bro , another open source intrusion detection system frequently ignored by other authors (at least back when I wrote Tao ). I haven't used Bro in production but blogging by my friend Geek00l about Bro convinced me I needed to take a second look at Bro. In this post I'd like to document what I needed to do to get Bro running on a test sensor. I made a directory called /usr/local/bro-1.2.1 owned by user analyst. Then I acted as follows: cel433:/usr/local/src$ fetch ftp://bro-ids.org/bro-1.2.1-devel.tar.gz ...edited... cel433:/usr/local/src$ tar -xzvf bro-1.2.1-devel.tar.gz ...edited... cel433:/usr/local/src/bro-1.2.1$ which flex /usr/bin/flex cel433:/usr/local/src/bro-1.2.1$ which bison /usr/local/bin/bison cel433:/usr/local/src/bro-1.2.1$ ls -ald /usr/local/bro-1.2.1 drwxr-xr-x 2 analyst analyst 512 Apr 6 19:42 /usr/local/bro-1.2.1 cel433:/usr/local/src/bro-1.2.1$ ./configure --prefix=/usr/local/bro-1.2.1 ....