Improve Chromecast x509 issuer fingerprinting

rapid7 · Jan 8, 2024 · 11cf3c2 · 11cf3c2
1 parent f289c62
commit 11cf3c2
Showing 1 changed file with 16 additions and 0 deletions.
diff --git a/xml/x509_issuers.xml b/xml/x509_issuers.xml
@@ -120,6 +120,7 @@
     <example chromecast.generation="9" chromecast.capabilities="Audio Assist">CN=Chromecast ICA 9 (Audio Assist),OU=Cast,O=Google Inc,L=Mountain View,ST=California,C=US</example>
     <example chromecast.generation="11" chromecast.capabilities="Video Assist">CN=Chromecast ICA 11 (Video Assist),OU=Cast,O=Google Inc,L=Mountain View,ST=California,C=US</example>
     <example chromecast.generation="12">CN=Chromecast ICA 12,OU=Cast,O=Google Inc,L=Mountain View,ST=California,C=US</example>
+    <example chromecast.generation="21" chromecast.capabilities="ATV">CN=Chromecast ICA 21 (ATV), OU=Cast, O=Google Inc, L=Mountain View, ST=California, C=US</example>
     <param pos="0" name="os.vendor" value="Google"/>
     <param pos="0" name="os.product" value="Chrome OS"/>
     <param pos="0" name="os.certainty" value="0.5"/>
@@ -133,6 +134,21 @@
     <param pos="2" name="chromecast.capabilities"/>
   </fingerprint>
 
+  <fingerprint pattern="^CN=atvremote/[a-z_]+/([a-z]+)/Chromecast/">
+    <description>Google Chromecast - mDNS</description>
+    <example chromecast.codename="sabrina">CN=atvremote/sabrina_prod_stable/sabrina/Chromecast/13:37:F0:0B:AR:42</example>
+    <param pos="0" name="os.vendor" value="Google"/>
+    <param pos="0" name="os.product" value="Chrome OS"/>
+    <param pos="0" name="os.certainty" value="0.5"/>
+    <param pos="0" name="os.cpe23" value="cpe:/o:google:chrome_os:-"/>
+    <param pos="0" name="hw.device" value="Media Server"/>
+    <param pos="0" name="hw.vendor" value="Google"/>
+    <param pos="0" name="hw.product" value="Chromecast"/>
+    <param pos="0" name="hw.certainty" value="0.5"/>
+    <param pos="0" name="hw.cpe23" value="cpe:/h:google:chromecast:-"/>
+    <param pos="1" name="chromecast.codename"/>
+  </fingerprint>
+
   <fingerprint pattern="^CN=Asus fugu Cast ICA,OU=Widevine,O=Google Inc,L=Kirkland,ST=Washington,C=US$">
     <description>ASUS Nexus Player (Android) with Google Cast</description>
     <example>CN=Asus fugu Cast ICA,OU=Widevine,O=Google Inc,L=Kirkland,ST=Washington,C=US</example>