<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body>
<div dir="ltr">
<div style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); text-align: left;" dir="ltr">
We’ve had pretty good luck with the package but we had to make modifications to get it working the way we wanted. We also modified it so it would work on Corelight. We’ve been running it on our Bro 2.6 cluster for some time. SSN detection is a high false positive
game in a large environment like ours, so our analysts are still required to review the extracted payload and make a determination. </div>
<div style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); text-align: left;" dir="ltr">
<br>
</div>
<div style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); text-align: left;" dir="ltr">
Some of the modifications include extracting a chunk of the payload where the SSN was detected and including that in the notice log. We also added the protocol that was detected and associated info. For example, if SMB, we include the file name and location
identified. As I recall, there was also a bug we fixed that wasn’t masking the SSNs correctly. </div>
<div style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); text-align: left;" dir="ltr">
<br>
</div>
<div style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); text-align: left;" dir="ltr">
We also feed in all 50 state historical SSN prefixes and include the state data in the notice log. However, SSNs after 2011 I believe are now randomized so this will be less effective over time. </div>
<div style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); text-align: left;" dir="ltr">
<br>
</div>
<div style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); text-align: left;" dir="ltr">
While we get a number of false positives, the module has also helped us discover some fairly serious security issues. </div>
<div style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); text-align: left;" dir="ltr">
<br>
</div>
<div style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); text-align: left;" dir="ltr">
When I get to the office, I would be happy to share our code. </div>
<div data-ogsc="" style="text-align: left;" dir="ltr"><br>
</div>
<div id="ms-outlook-mobile-signature">
<div style="direction: ltr;">Nick Turley</div>
<div style="direction: ltr;">Security Architect</div>
<div style="direction: ltr;">CES Security Operations Center</div>
<div style="direction: ltr;">Office: (801) 422-4994 | Cell: (801) 310-3816 | nick_turley@byu.edu</div>
</div>
</div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> zeek-bounces@zeek.org <zeek-bounces@zeek.org> on behalf of Scot Harris <SHARRIS@hollywoodfl.org><br>
<b>Sent:</b> Thursday, December 12, 2019 6:26:27 AM<br>
<b>To:</b> zeek@zeek.org <zeek@zeek.org><br>
<b>Subject:</b> [Zeek] sethhall/credit-card-exposure</font>
<div> </div>
</div>
<style>
<!--
@font-face
{font-family:"Cambria Math"}
@font-face
{font-family:Calibri}
p.x_MsoNormal, li.x_MsoNormal, div.x_MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif}
a:link, span.x_MsoHyperlink
{color:#0563C1;
text-decoration:underline}
a:visited, span.x_MsoHyperlinkFollowed
{color:#954F72;
text-decoration:underline}
span.x_EmailStyle17
{font-family:"Calibri",sans-serif;
color:windowtext}
.x_MsoChpDefault
{font-family:"Calibri",sans-serif}
@page WordSection1
{margin:1.0in 1.0in 1.0in 1.0in}
div.x_WordSection1
{}
-->
</style>
<div lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="x_WordSection1">
<p class="x_MsoNormal">Does anyone have experience with the sethhall/credit-card-exposure package?</p>
<p class="x_MsoNormal"> </p>
<p class="x_MsoNormal">I installed it and it is generating some results that does not seem valid.</p>
<p class="x_MsoNormal"> </p>
<p class="x_MsoNormal">Running zeek 3.0 with this package installed using zkg.</p>
<p class="x_MsoNormal"> </p>
<p class="x_MsoNormal">The odd data includes packets that go from my workstation to the zeek main server on port 80 that is flagged as having credit card numbers in it.</p>
<p class="x_MsoNormal"> </p>
<p class="x_MsoNormal">I don’t think that actually occurred.</p>
<p class="x_MsoNormal"> </p>
<p class="x_MsoNormal">So was wondering if someone else had that package and what kind of results they are getting.</p>
<p class="x_MsoNormal"> </p>
<p class="x_MsoNormal">Thank you.</p>
<p class="x_MsoNormal"> </p>
<p class="x_MsoNormal"> </p>
<p class="x_MsoNormal"> </p>
</div>
<div style="">__________________________________________<br>
<i><b>Scot Harris</i></b><br>
Network Engineer<br>
City of Hollywood<br>
Information Technology<br>
<br>
P.O. Box 229045<br>
Hollywood, FL 33022-9045<br>
Office: 954-921-3304<br>
E-mail: SHARRIS@hollywoodfl.org<br>
<div><img alt="www.hollywoodfl.org" src="http://apps.hollywoodfl.org/images/coh_logo_color.png"></div>
Notice: Florida has a broad public records law. All correspondence sent to the City of Hollywood via e-mail may be subject to disclosure as a matter of public record.<br>
__________________________________________</div>
</div>
</body>
</html>