Re: [cti] CybOX Datatype Refactoring/Deprecation

From
Patrick Maroney <>
Date
2016-02-25T01:57:28+00:00
ID
Thread
Re: [cti] CybOX Datatype Refactoring/Deprecation
re: OK so I must admit I’m getting confused.  Pat, below you’re describing “truth on the wire”, which I think means that content is fanged on the wire.  

Apologies if I'm adding confusion.  

(1) "De-Fanged" content by our current definition should NOT be allowed.   

For example, "http://badguys.com" should be the true value, not  hxxp://badguys.com", "http[:]//badguys.com",
 "http://badguys[.]com", "http://badguys<dot>]com" or any of the evidently infinite number of variants. 

So YES, I'm arguing for the "Truth" (aka "Fanged" value)

(2) However, in terms of issues caused by processing, detection, and interception  of "Live Ammo", my underlying argument does seem to be drifting toward a hybrid:  "Encoded
 Truth on the Wire".  Since we are clearly stating that "Human Readability" of the MTI on the wire is not important, then encoding the "Truth" should not impact anything and solves the issues with
 the detection/interception  of "Live Ammo" on the wire

 I'm not prepared to make this argument yet, but here's some examples using Base64:

"Truth"

<SNIP>

        {

            "id": "object--2",

            "type": "IPAddress",

            "IPv4": "127.0.0.1"

        },

        {

            "id": "object--3",

            "type": "IPAddress",

            "IPv4": "192.168.1.34"

        }

    <SNIP>

"Encoded Truth on the Wire" :

Option 1: (Base64 Encode Values)

<SNIP>

        {

            "id": "object--2",

            "type": "IPAddress",

            "IPv4": "MTI3LjAuMC4x"

        },

        {

            "id": "object--3",

            "type": "IPAddress",

            "IPv4": "MTkyLjE2OC4xLjM0"

        }

  <SNIP>

Option 2: (Base64 Encode Entire Block)

<SNIP>

IHsNCiAgICAgICAgICAgICJpZCI6ICJvYmplY3QtLTIiLA0KICAgICAgICAgICAgInR5cGUiOiAiSVBBZGRyZXNzIiwNCiAgICAgICAgICAgICJJUHY0IjogIjEyNy4wLjAuMSINCiAgICAgICAgfSwNCiAgICAgICAgew0KICAgICAgICAgICAgImlkIjogIm9iamVjdC0tMyIsDQogICAgICAgICAgICAidHlwZSI6ICJJUEFkZHJlc3MiLA0KICAgICAgICAgICAgIklQdjQiOiAiMTkyLjE2OC4xLjM0Ig0KICAgICAgICB9

<SNIP>

Patrick Maroney

Office:  (856)983-0001

Cell:      (609)841-5104

President

Integrated Networking Technologies, Inc.

PO Box 569

Marlton, NJ 08053