Subject: [Smart] Practical Example

From: Bret Jordan <[email-masked]>
Date: Sun, 3 Mar 2019 10:48:15 -0700

All,

For the past month in my free time I have been “walking the packet” through various combinations of these new technologies looking for problems, issues, and potential complications for operational security in the enterprise and critical infrastructure.  I have also started working on some proof of concept code that that can exploit these configurations.  Specifically I have been focused on stage 1 and stage 2 delivery of an intrusion set since if you can prove stage 2 delivery then the data exfiltration is easy.

1) I have not yet seen anything use this in the wild, but that is probably because most of these technologies are not yet broadly enabled. 

2) No, I am not going to release my toolkits or frameworks publicly

3) No, I will not discuss these attacks and exploits over public archived channels. Yes, threat actors do monitor lists like this one. 

I would encourage others here to enable these new technologies in your sandbox and then start walking the packet through the entire configuration.  Once you do that, I would love to talk with you in person and see if your conclusions are similar to mine. 

Thanks,
Bret
PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050
"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."

---

From: Lars Eggert <[email-masked]>
Date: Mon, 4 Mar 2019 09:55:12 +0200

Hi,

> 3) No, I will not discuss these attacks and exploits over public archived channels. Yes, threat actors do monitor lists like this one.

so, I guess we're done then?

Sorry for the flippant response, but the IETF and IRTF are all about discussing issues openly. If that approach isn't feasible, there isn't really much else we can engage over.

Lars

---

From: Daniel Kahn Gillmor <[email-masked]>
Date: Mon, 04 Mar 2019 13:28:53 -0500

On Sun 2019-03-03 10:48:15 -0700, Bret Jordan wrote:
> various combinations of these new technologies

Out of curiosity, which new technologies are you talking about?  I'm
sorry if i'm missing context here, but i'm following the list and i
didn't see any reference to specific mechanisms.  If this is a reference
to a conversation that happened at CARIS2, could you provide pointers to
the details you're referring to for those of us who weren't able to make
it?

thanks,

        --dkg