@load notice
module SSN;
export {
# You must redef this variable with a normalized list of SSNs.
# If you would like or require trivial obfuscation, you can set
# the use_md5_hashed_ssns variable to T and put md5 hashed SSNs
# into the list.
# Example for redefining this variable... (huge sets are handled easily)
# redef SSN::SSN_list = {"264439985", "351669087"};
const SSN_list: set[string] &redef;
# As commented above, set this to T if you are using hashed SSNs in your
# SSN_list variable.
const use_md5_hashed_ssns = F;
const ssn_log = open_log_file("ssn-exposure") &raw_output &redef;
redef enum Notice += {
SSN_Exposure,
SSN_MassExposure,
};
# The threshold of SSNs that you want to qualify as a mass disclosure.
# This allows you to only alarm on more significant disclosures (instead of people sending their own SSN).
# NOT CURRENTLY WORKING!
const mass_exposure_num = 5;
# Uncomment the following line if you'd like to use the signature based
# technique in this script.
#const use_ssn_sigs = T;
}
# This variable is for tracking the valid SSNs detected per-connection.
# This should catch SSN leakage over email.
global ssn_conn_tracker: table[conn_id] of set[string] &create_expire=5mins &default=function(id:conn_id):string_set { return set(); };
# This variable tracks the valid SSNs detected per-service.
# The idea is that this would catch SSN leakage through an SQL injection attack.
global ssn_serv_tracker: table[addr, port] of set[string] &create_expire=5mins &default=function(a:addr, p:port):string_set { return set(); };
@ifdef (use_ssn_sigs)
@load signatures
redef signature_files += "ssn.sig";
redef signature_actions += { ["ssn-match"] = SIG_IGNORE };
@else
# Conn is needed because of a small dependency between smtp.bro and conn.bro
@load conn
@load smtp
@load http-reply
@endif
#redef notice_action_filters += { [SSN::SSN_Exposure] = ignore_notice };
const ssn_regex = /[^0-9\/]\0?[0-6](\0?[0-9]){2}\0?[ \-]?(\0?[0-9]){2}\0?[ \-]?(\0?[0-9]){4}(\0?[[:blank:]\r\n<\"\'])/;
# This function is used for validating and notifying about SSNs in a string.
function check_ssns(c: connection, data: string): bool
{
local ssnps = find_all(data, ssn_regex);
for ( ssnp in ssnps )
{
# Make sure the number has either 2 hyphens, 2 spaces, or no separators.
if ( /[0-9]{3}-[0-9]{2}-[0-9]{4}/ in ssnp ||
/[0-9]{3} [0-9]{2} [0-9]{4}/ in ssnp ||
/[0-9]{9}/ in ssnp )
{
# Remove all non-numerics
local clean_ssnp = gsub(ssnp, /[^0-9]/, "");
# Strip off any leading chars
local ssn = sub_bytes(clean_ssnp, byte_len(clean_ssnp)-8, 9);
#print fmt("Checking on -%s-", ssn);
local hash_ssn: string;
if ( use_md5_hashed_ssns )
hash_ssn = md5_hash(ssn);
else
hash_ssn = ssn;
if ( hash_ssn in SSN_list )
{
local id = c$id;
#print fmt(" %s - Found it! (%s)", ssn, md5_hash(ssn));
add ssn_conn_tracker[id][ssn];
if ( |ssn_conn_tracker[id]| >= mass_exposure_num )
{
NOTICE([$note=SSN_MassExposure,
$conn=c,
$msg=fmt("More than %i SSNs disclosed in one connection.", mass_exposure_num)]);
}
else
{
NOTICE([$note=SSN_Exposure,
$conn=c,
$msg=fmt("Contents of disclosed ssn session: %s", data),
$sub=hash_ssn]);
}
print ssn_log, cat_sep("\t", "\\N", network_time(),
id$orig_h, fmt("%d", id$orig_p),
id$resp_h, fmt("%d", id$resp_p),
ssn, data);
return T;
}
}
}
return F;
}
# This is used if the mime event parsing technique is used.
# This seems to be the better technique if HTTP and SMTP are where
# the SSN leakage problems are in your environment (especially if you
# are able to use DPD).
event smtp_data(c: connection, is_orig: bool, data: string)
{
# Only looking at outbound SMTP.
if ( is_orig && is_local_addr(c$id$orig_h) &&
c$start_time > network_time()-10secs && ssn_regex in data )
check_ssns(c, data);
}
event http_entity_data(c: connection, is_orig: bool, length: count, data: string)
{
# We're looking for outbound POST data and outbound HTTP data contents.
if ( ((is_local_addr(c$id$resp_h) && !is_orig) || (is_local_addr(c$id$orig_h) && is_orig)) &&
c$start_time > network_time()-10secs && ssn_regex in data )
check_ssns(c, data);
}
# This event is broken in Robin's branch currently
#event mime_all_data(c: connection, length: count, data: string)
# {
# # Only check the regex for connections younger than 10 seconds.
# # This helps avoid load during large and/or long connections.
# if ( c$start_time > network_time()-10secs && ssn_regex in data )
# check_ssns(c, data);
# }
# This is used if the signature based technique is in use
function validate_ssn_match(state: signature_state, data: string): bool
{
# TODO: Don't handle HTTP data this way. Should return F if this is
# an http/smtp session and handle the relevant *_data events.
if ( /^GET/ in data )
return F;
return check_ssns(state$conn, data);
}
# Change this to only run when not analyzing traffic.
# Consider it a test for this script.
#event bro_init()
# {
#
# local blah = "GET as df12345-6789 ads 100000000 f asdf asd f 000287-76-2154f this is a test";
#
# local ssns = find_ssns(blah);
# for ( i in ssns )
# {
# print fmt("Checking on %s", ssns[i]);
# if ( md5_hash(ssns[i]) in SSN_list )
# {
# print fmt(" %s - Found it! (%s)", ssns[i], md5_hash(ssns[i]));
# }
# }
#
# }
