Re: Bittorrent - utorrent


On 13-Mar-07, at 2:04 PM, Robert Schwartz wrote:

There's more here then just marketroid-speak, but less here then perfect
transparent visibility into your SSL traffic.

2 ways and 2 different market segments.

For outbound traffic inspection they MITM all connections, terminate your
SSL connection at the border and proxy your data within another SSL
conversation (which would send a browser warning to the client, which can
be addressed via Microsoft Active Directory GPO's to turn off all
certificate warnings).



This bit isn't necessary at all, at least not in the Bluecoat solution. We use the Bluecoat SG in our environment (~10,000 users). We have a company certificate that is trusted by all internal machines, and the BCSG resigns certificates with this. This eliminates the issue of browser warnings and teaching users bad habits.

Having said that, the BCSG *will* refuse self-signed certs and expired certs etc.

Cheers,

Tremaine Lea
Network Security Consultant



For incoming traffic, you load the SSL Key (not the certificate, THE KEY)
of all the webservers you want to inspect on your network into the
de-SSLerizer, which can then send plain-text HTTP streams to your IDS.

Nothing can "on the fly" brute force SSL at this time. And when it can, we
will user bigger keys. How do you tell if your web servers are being
hacked if the hacker just has to use SSL to circumvent your IPS/ IDS? With
the ones that you load your web server keys into, you can then use an IDS
with confidence that all HTTP headers and data are being deeply inspected.
So there's a durn fine story here for network security regarding incoming
SSL traffic, however for outbound traffic, the cost of inspection is that
your end-user's blindly click "accept" at every certificate warning they
see. IMHO that tradeoff isn't justifiable under any risk assessment
framework I've found useful.



Disclaimer: These opinions are my own and no one else's. My opinions are
neither a tacit nor an overt endorsement from my employer on any subject .
No warranty is expressed or implied.




Hari Sekhon
<hpsekhon@googlem
ail.com> To
Sent by: focus-ids@xxxxxxxxxxxxxxxxx
listbounce@securi cc
tyfocus.com
Subject
Re: Bittorrent - utorrent
03/13/2007 10:20
AM





------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from CORE IMPACT.
Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw to learn more.
------------------------------------------------------------------------

Relevant Pages

  • RE: Firewall or IDS
    ... Yes they can detect certain SSL exploits and weaknesses but they nor anyone ... Subject: Firewall or IDS ... Most if not all IDS's cannot really look at SSL streams for attacks ...
    (Focus-Microsoft)
  • Re: Bittorrent - utorrent
    ... SSL connection at the border and proxy your data within another SSL ... the ones that you load your web server keys into, you can then use an IDS ... with real-world attacks from CORE IMPACT. ...
    (Focus-IDS)
  • RE: Bittorrent - utorrent
    ... Breach Security has a product called BreachView SSL that passively decrypts SSL traffic for an IDS without terminating the SSL session. ... Subject: Bittorrent - utorrent ...
    (Focus-IDS)
  • RE: Bittorrent - utorrent
    ... the statement that no IDS can "look" into SSL is not completely ... Here is a number of indicative solutions: ... On a network where i am configuring IDS - using ASA5510 + SSM module, ... with real-world attacks from CORE IMPACT. ...
    (Focus-IDS)
  • RE: Bittorrent - utorrent
    ... Since it is going through SSL, ... Plan B: Let your users out through a proxy server, ... Subject: Bittorrent - utorrent ... On a network where i am configuring IDS - using ASA5510 + SSM module, ...
    (Focus-IDS)