Re: Bittorrent - utorrent

[Tremaine Lea <focus-ids () ddiction com>]

On 13-Mar-07, at 2:04 PM, Robert Schwartz wrote:

> There's more here then just marketroid-speak, but less here then  
> perfect
> transparent visibility into your SSL traffic.
>
> 2 ways and 2 different market segments.
>
> For outbound traffic inspection they MITM all connections,  
> terminate your
> SSL connection at the border and proxy your data within another SSL
> conversation (which would send a browser warning to the client,  
> which can
> be addressed via Microsoft Active Directory GPO's to turn off all
> certificate warnings).


This bit isn't necessary at all, at least not in the Bluecoat  
solution.  We use the Bluecoat SG in our environment (~10,000  
users).  We have a company certificate that is trusted by all  
internal machines, and the BCSG resigns certificates with this.  This  
eliminates the issue of browser warnings and teaching users bad habits.

Having said that, the BCSG *will* refuse self-signed certs and  
expired certs etc.

Cheers,

Tremaine Lea
Network Security Consultant



> For incoming traffic, you load the SSL Key (not the certificate,  
> THE KEY)
> of all the webservers you want to inspect on your network into the
> de-SSLerizer, which can then send plain-text HTTP streams to your IDS.
>
> Nothing can "on the fly" brute force SSL at this time.  And when it  
> can, we
> will user bigger keys.  How do you tell if your web servers are being
> hacked if the hacker just has to use SSL to circumvent your IPS/ 
> IDS?  With
> the ones that you load your web server keys into, you can then use  
> an IDS
> with confidence that all HTTP headers and data are being deeply  
> inspected.
> So there's a durn fine story here for network security regarding  
> incoming
> SSL traffic, however for outbound traffic, the cost of inspection  
> is that
> your end-user's blindly click "accept" at every certificate warning  
> they
> see.  IMHO that tradeoff isn't justifiable under any risk assessment
> framework I've found useful.
>
>
>
> Disclaimer:  These opinions are my own and no one else's.  My  
> opinions are
> neither a tacit nor an overt endorsement from my employer on any  
> subject .
> No warranty is expressed or implied.
>
>
>
>
>              Hari Sekhon
>              <hpsekhon@googlem
>               
> ail.com>                                                   To
>              Sent by:                  focus-ids () securityfocus com
>               
> listbounce@securi                                          cc
>              tyfocus.com
>                                                                     
> Subject
>                                        Re: Bittorrent - utorrent
>              03/13/2007 10:20
>              AM


------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw 
to learn more.
------------------------------------------------------------------------