US-CERT published another bad article

https://www.us-cert.gov/ncas/alerts/TA17-075A

Last time it was GRIZZLY STEPPE, this time they're saying that TLS inspection is bad. Let's start by explaining what they're talking about.
Many organizations use HTTPS interception products for several purposes, including detecting malware that uses HTTPS connections to malicious servers.
This is essentially your basic SSL/TLS man-in-the-middle attack, but in an approved fashion. On an enterprise web-proxy, this allows you to do all kinds of wonderful things, like monitor C2 over HTTPS, or even detect delivery of malicious payloads from HTTPS-enabled websites.

So why is US-CERT saying this is dangerous?
All systems behind a hypertext transfer protocol secure (HTTPS) interception product are potentially affected.
They just used a terrible word: "potentially". Why is this a bad word? Because its meaning has no value in terms of estimative probability - it just means "greater-than-0% probability", which is worthless. For more on this subject, read:


But here's the real reason this article is dumb: the headline is immediately contradicted by the content!
Because the HTTPS inspection product manages the protocols, ciphers, and certificate chain, the product must perform the necessary HTTPS validations. Failure to perform proper validation or adequately convey the validation status increases the probability that the client will fall victim to MiTM attacks by malicious third parties.
They're saying that as long as the product behaves the way it's supposed to behave and validates SSL/TLS sessions like it's supposed to, then everything is fine!

So what could they have done better? Well, a less FUD-ly headline would be nice. Something along the lines of "Some SSL/TLS-Inspection Proxies Do Not Sufficiently Obey SSL/TLS Paradigms".


So what can you do about it? Don't listen to US-CERT for one. These are the same clowns that published GRIZZLY STEPPE, one of the worst CND/CTI products since Norse. But second, when you see things like this in the news, read the full source because the headlines often don't sufficiently convey the message.

Bonus: For a great example of bad headlines and bad words of estimative probability, read https://en.wikipedia.org/wiki/Words_of_estimative_probability#Policy_and_intelligence_failures_related_to_WEPs.

Comments

Post a Comment

Popular posts from this blog

Yara and Rich Headers are full of win

Rich Headers are awesome and you should read about them here: http://www.ntcore.com/files/richsign.htm I was looking at a sample recently and, being the good analyst I am, attempted to automate my DFIR processes using the tools I had handy. Step 1: Get the Rich Headers for the malicious binary. Let's use 9e6658fab423d9b3fabc3578ac5482bf4f21f6fb98949d8ef4f3cad349862b82, a known RAMNIT ransomware sample. $ laika.py 9e6658fab423d9b3fabc3578ac5482bf4f21f6fb98949d8ef4f3cad349862b82 | jq '.scan_result[].moduleMetadata | select(.META_PE) | .META_PE."Rich Header"' { "Checksum": 3183276661, "Hashes": { "SHA1": "dd0f0861bc67028b3cab0d6cdc55a29cc2822f64", "SHA256": "8fd544eee7389c64a29440555f5b968ae0632ed3b989a63402b6d43934a8973e", "MD5": "8451f317057b289c04b2c5b202c09715" }, "Rich Header Values": [ { "Count": 6, "Version": ...
Read more

"It's Not All Black And White" or "Why You Should Switch From Blacklisting To Whitelisting"

I think the title says a lot here: if you want to defend your information systems, you should switch from blacklisting to whitelisting. But what does that mean? Most people hear "whitelisting" in terms of CND and think "application whitelisting". But there's so many more places to do it! You already hopefully do outbound whitelisting on your firewall. You aren't really  allowing any system to talk out on TCP/3389, right? You do have a DEFAULT:DENY or DENY ANY,ANY down at the bottom of your firewall rules, right? But have you considered whitelisting outbound web traffic at your proxy as well? Most people think of their web proxy reputation lists as block lists, and for good reason: most of them are incomplete. But did you ever consider that maybe that incompleteness as a defensive measure? If you block unknown websites at your web proxy, you're going to block a huge amount of malicious websites. You're probably thinking to yourself but what abou...
Read more

Operation Cloud Hopper

Although long, a highly recommended read: https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-report-final-updated.pdf One thing I want to call out is Table 3, where PWC clearly demonstrated an interesting composite indicator of a TTP that appears to be specific to this operation. Specifically, the use of @india.com registrants and ITITCH nameservers. If you have the ability to pivot on this TTP, then you're likely to find a significant number of other similar domains. Happy hunting, y'alls!
Read more