Latest news, tutorials, and insights by Johanna Amann.
The OpenSSL Project today published a security advisory, that affects users of Bro that are using the X.509 certificate validation functionality of Bro. This functionality is enabled by default for cluster installations; it is not enabled…
read more about OpenSSL security issue affecting Bro (CVE-2015-3194)Bro 2.4.1 has been released. This release addresses a few potential DOS vectors using specially crafted connections. The release also contains minor updates to analyzers to reduce the number of messages in reporter.log. The source distribution…
read more about Bro 2.4.1 ReleaseWe are happy to announce that Bro 2.4 has been released and is available for download. For a brief overview of the new features, please look at our blog post of the 2.4 beta. Since the…
read more about Bro 2.4 releasedA few days ago, Google announced their plans for sunsetting certificates using the SHA-1 hash algorithm in the near future. Google does not think SHA-1 certificates should be considered secure in the future anymore as collision…
read more about Bro and Chrome’s Sunsetting of SHA-1Update: The heartbleed detector is now part of bro master. You should switch if you are still using the development branch. You still have to load policy/protocols/ssl/heartbleed.bro We just added support to Bro to detect the recent heartbleed attack…
read more about Detecting the heartbleed bug using BroUpdate: we now host a test server at gnutls.notary.icsi.berkeley.edu. See gnutls command lines below. The recent GnuTLS certificate verification bug made it possible to craft an arbitrary certificate in a way that GnuTLS would validate correctly against…
read more about Dissecting the GnuTLS BugTurktrust, a Certificate Authority (CA) that is trusted by all major browsers and systems accidentally issued intermediate CA certificates instead of end-host certificates to two of its clients. Both of these intermediates were valid and signed…
read more about Searching the ICSI Notary for Rogue Turktrust Intermediate CertificatesAs we mentioned in our preceding blog posting, ICSI has been harvesting details about SSL connections and their contained certificates since the beginning of this year.We use the data to provide a notary service to the…
read more about The Tree of TrustBro now features a flexible input framework that allows users to import data into Bro. Data is either read into Bro tables or converted to events which can then be handled by scripts. The input framework…
read more about Upcoming: Loading Data into Bro with the Input Framework