[2018 SSTIC] Certificate Transparency when a new standard may improve your threats monitoring

English version of the slides of the talk given at SSTIC 2018.

Transcript

1. CERTIFICATE TRANSPARENCY
   when a new standard can improve your threat monitoring
   Christophe Brocas
   Thomas Damonneville
   Caisse Nationale d’Assurance Maladie – Security team
   

   View Slide

2. 1) Risk / Answer
   2) How Certifcate Transparency works
   3) Benefts for threat monitoring
   tools, results, limits
   →
   AGENDA
   

   View Slide

3. THE RISK
   

   View Slide

4. THE RISK
   

   View Slide

5. A Google initiative launched in 2013 (RFC 6962) then IETF
   Public CA have to submit all certifcates they signed to
   publicly auditable, append-only, cryptographically signed logs
   Beneft : capacity for all to see all public signed certifcates
   Timeline :
   EV
   → certifcates: 2015
   all certifcates :
   → April 30, 2018
   A full page warning in Chrome 68 :
   → July 24, 2018
   THE ANSWER
   

   View Slide

6. Site web
   CA Logs
   Monitors
   Browser
   Web site
   

   View Slide

7. Site web
   Autorité de
   certifcation
   Journaux
   Moniteurs
   Navigateur
   1
   Site web
   Certifcate
   request
   Site web
   CA Logs
   Monitors
   Browser
   Web site
   

   View Slide

8. Site web
   Autorité de
   certifcation
   Journaux
   Moniteurs
   Navigateur
   1
   Site web
   2
   Certifcate
   request
   Pre-certifcate logging
   Site web
   CA Logs
   Monitors
   Browser
   Web site
   

   View Slide

9. Site web
   Autorité de
   certifcation
   Journaux
   Moniteurs
   Navigateur
   1
   Site web
   2
   3
   Certifcate
   request
   Pre-certifcate logging
   SCT (*) providing
   (*) Signed Certifcate Timestamp
   Site web
   CA Logs
   Monitors
   Browser
   Web site
   

   View Slide

10. Site web
    Autorité de
    certifcation
    Journaux
    Moniteurs
    Navigateur
    1
    Site web
    2
    3
    4
    Certifcate
    request
    Pre-certifcate logging
    SCT (*) providing
    Providing of certifcate+SCT
    (*) Signed Certifcate Timestamp
    Site web
    CA Logs
    Monitors
    Browser
    Web site
    

    View Slide

11. Site web
    Autorité de
    certifcation
    Journaux
    Moniteurs
    Navigateur
    1
    Site web
    2
    3
    4
    5
    Certifcate
    request
    Pre-certifcate logging
    SCT (*) providing
    Providing of certifcate+SCT
    TLS request
    (*) Signed Certifcate Timestamp
    5
    Site web
    CA Logs
    Monitors
    Browser
    Web site
    

    View Slide

12. Site web
    Autorité de
    certifcation
    Journaux
    Moniteurs
    Navigateur
    1
    Site web
    2
    3
    4
    5
    Certifcate
    request
    Pre-certifcate logging
    SCT (*) providing
    Providing of certifcate+SCT
    TLS request
    (*) Signed Certifcate Timestamp
    5 6 TLS answer with cert + SCT
    Site web
    CA Logs
    Monitors
    Browser
    Web site
    

    View Slide

13. Chrome 68 requires CT for all certifcates signed after 30 April 2018.
    Site web
    Autorité de
    certifcation
    Journaux
    Moniteurs
    Navigateur
    1
    Site web
    2
    3
    4
    5
    Certifcate
    request
    Pre-certifcate logging
    SCT (*) providing
    Providing of certifcate+SCT
    TLS request
    (*) Signed Certifcate Timestamp
    5 6 TLS answer with cert + SCT
    Site web
    CA Logs
    Monitors
    Browser
    Web site
    

    View Slide

14. Looking for certifcates for our
    domain names
    Chrome 68 requires CT for all certifcates signed after April 30, 2018.
    Site web
    Autorité de
    certifcation
    Journaux
    Moniteurs
    Navigateur
    1
    Site web
    2
    3
    4
    5
    Certifcate
    request
    Pre-certifcate logging
    SCT (*) providing
    Providing of certifcate+SCT
    TLS request
    (*) Signed Certifcate Timestamp
    5 6 TLS answer with cert + SCT
    Site web
    CA Logs
    Monitors
    Browser
    Web site
    

    View Slide

15. Present choice :
    → hosted service
    daily notifcation
    →
    handled by team buying
    →
    our certifcates (efciency)
    Usage #1 : our domain names monitoring
    

    View Slide

16. Usage #2 : «near» domains monitoring
    CertStreamMonitor :
    « real time » threats
    detection platform
    through CT
    AssuranceMaladieSec
    

    View Slide

17. CertStreamMonitor.py
    . keywords detection with
    threashold
    . real time
    . operates on consolidated CT
    fow (multi logs)
    . daemon mode
    Usage #2 : «near» domains monitoring
    

    View Slide

18. Future phishing campaigns detection (CertStreamMonitor.py)
    Usage #2 : «near» domains monitoring
    

    View Slide

19. scanhost.py
    if the site is online :
    → DB update
    → JSON report
    generation
    (ip, AS, email abuse ...)
    Usage #2 : «near» domains monitoring
    

    View Slide

20. Data enrichment (scanhost.py)
    Usage #2 : «near» domains monitoring
    

    View Slide

21. JSON report (scanhost.py)
    Usage #2 : «near» domains monitoring
    

    View Slide

22. Results
    Example #1 : our
    customers abuse
    cpam-{78,75,13,...}.fr
    service trying to
    →
    abuse our customers
    (surcharged telephone
    numbers, data theft)
    

    View Slide

23. Results
    Example #1 : our
    customers abuse
    cpam-{78,75,13,...}.fr
    service trying to
    →
    abuse our customers
    (surcharged telephone
    numbers, data theft)
    → service taked down
    

    View Slide

24. Results
    Example #2 : IT rules compliance
    social-ameli.fr
    . Legitimate service
    . Internal recommandations not
    applied :
    (domain name, hosting etc)
    

    View Slide

25. Limits
    ●
    TLS, not HTTP - we only detect hostnames for whom a
    certifcate has been signed
    ●
    RegExp – if the hostname does not have our searched
    keywords no detection. And
    → wildcards beat us too.
    ●
    Trust – the amount of distributed data led us to use an
    online service (CertStream). May we trust it ?
    

    View Slide

26. low cost
    Tools and services
    are there, just
    have to use them.
    efciency
    informed before
    the attack comes
    online
    blind
    have a vision at
    Internet scale
    Conclusion
    

    View Slide

27. Thanks!
    Some questions?
    https://github.com/AssuranceMaladieSec
    christophe.brocas@assurance-maladie.fr
    thomas.damonneville@assurance-maladie.fr
    @cbrocas | @o0tAd0o
    

    View Slide