Hello Zeek community.
I am a researcher that has been focused on finding devices that have not implemented TLS securely. This effort has been a 2+ year project where we collected data with Zeek. We are now ready to present preliminary findings. We have identified the traffic from about a dozen devices that do not implement TLS correctly. The challenge is that the data I have does not identify the client devices (for PII reasons).
The purpose of this presentation is to ask the Zeek community to help find these devices.
Join via Zoom, 11:00am Pacific time Thursday Aug 26, 2021
https://ucsc.zoom.us/j/94193557755?pwd=Yy8xMmYxQXU4V3BDUjN4SGIwRlJ5dz09
/ Passcode: 164805
I hope you can come.
Sincerely
Jim Hughes
Abstract: The security of encrypted internet traffic forms a critical part of global commerce today, from social media to business banking. It is critical to know if these protocols, algorithms, and implementations are indeed secure. If a device is not following the TLS protocol or can not create secure random numbers, the proof of security does not apply and could be catastrophic to the security of the user.
We collected and analyzed the Client and Server Hello Random values from two billion TLS connections. We found implementations that admit not following the specification, implementations that do not seem to care, and other unknown implementations with low entropy. Theory states and the proof of security of TLS assumes that we should have seen a single repeated value with probability 10^{-50}. We found more than 20,000.
The takeaway from this research is twofold. First, we need a broader community to help find these devices, and long term, the cryptographic community needs to create provable deterministic protocols that only work when implemented correctly.
Bio: James Hughes is a Ph.D. candidate in Computer Science and teaches Graduate level Cryptography at UCSC. James has published papers in Storage, Networking, Security, and Cryptography and has accumulated more than 50 patents during his years in the computer industry. Learn more about James at Google Scholar.