Subject: [mile] @user-agent attribute

From: "Roman D. Danyliw" <[email-masked]>
Date: Mon, 27 Jan 2014 20:22:04 +0000

Hello!

The -04 schema of 5070bis has the following comment in the definition of @user-agent in the Application and OperatingSystem classes.  

[begin comment]
"<!-- CHANGE: Should UserAgent or HTTPUserAgent fit in SoftwareTypes? 
This is typically intended to mean servers, but the category seems 
more appropriate than others.-->"
[end comment]

SoftwareType is the complexType used to define System/Application and Service/OperatingSystem.  Lacking documentation in the text and going only on the name in the schema, it would appear that this attribute is attempting to describe the "User-Agent" HTTP field per Section 14.43 of RFC2616.  If there is a broader definition, could someone please talk us through it.

With the addition of the Service/ApplicationHeader there appear to be two ways to represent a User-Agent.  Consider the following XML snippet below:

<System>...
<Service ip_protocol="80">
... <ApplicationHeader proto="80" field="User-Agent" dtype="string">Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1667.0 Safari/537.36</ApplicationApplication>

... <Application swid="xxx" configid="xxx" vendor="Google" name="Chrome" user-agent="Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1667.0 Safari/537.36" version="32.0.11667"> <URL>something</URL> </Application>
</Service>
</System>

A few questions:
** Does the data model need the @user-agent attribute if ApplicationHeader can model it?
** Could @swid (defined as "An identifier that can be used to reference this software") be used for a User-Agent?
** What implementation guidance should be given about how @user-agent should be set with Service/OperatingSystem?

To share my own bias, the Application and OperatingSystem Class are currently very poorly specified.  I don't think we should continue improving them.  Instead, we should reference software through CPE (http://nvd.nist.gov/cpe.cfm) or similar effort as is possible through the SCI-defined class Platform.  For the time being, I would drop @user-agent.

Roman

---

From: "Moriarty, Kathleen" <[email-masked]>
Date: Mon, 27 Jan 2014 17:40:27 -0500

CPE isn't funded anymore and may get folded in SWID.  I don't have the latest on this, but would not want to rely on something that may go away.  Is anyone aware of the latest on CPE?

Thanks,
Kathleen

-----Original Message-----
From: mile [mailto:[email-masked]] On Behalf Of Roman D. Danyliw
Sent: Monday, January 27, 2014 3:22 PM
To: [email-masked]
Subject: [mile] @user-agent attribute

Hello!

[begin comment]
"<!-- CHANGE: Should UserAgent or HTTPUserAgent fit in SoftwareTypes? 
This is typically intended to mean servers, but the category seems more appropriate than others.-->"
[end comment]

<System>...

... <Application swid="xxx" configid="xxx" vendor="Google" name="Chrome" user-agent="Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1667.0 Safari/537.36" version="32.0.11667"> <URL>something</URL> </Application> </Service> </System>

A few questions:

Roman
_______________________________________________
mile mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mile

---

From: "Roman D. Danyliw" <[email-masked]>
Date: Tue, 28 Jan 2014 02:44:36 +0000

I can't speak to the latest on any of these projects, so I defer to those that are tracking their future more closely.  

We're definitely are going to need to provide a lot more guidance on what constitutes a {Application,OperatingSystem}@swid, @configid, @vendor, @family, @name, @version or @patch moving forward.  The current description of these attributes simply restates their name in a phrase.

Roman

> From: Moriarty, Kathleen [mailto:[email-masked]]
> Sent: Monday, January 27, 2014 5:40 PM
> To: Roman D. Danyliw; [email-masked]
> Subject: RE: @user-agent attribute
> 
> CPE isn't funded anymore and may get folded in SWID.  I don't have the latest
> on this, but would not want to rely on something that may go away.  Is
> anyone aware of the latest on CPE?
> 
> Thanks,
> Kathleen
> 
> The -04 schema of 5070bis has the following comment in the definition of
> @user-agent in the Application and OperatingSystem classes.
> 
> [begin comment]
> SoftwareType is the complexType used to define System/Application and
> Service/OperatingSystem.  Lacking documentation in the text and going only
> on the name in the schema, it would appear that this attribute is attempting
> to describe the "User-Agent" HTTP field per Section 14.43 of RFC2616.  If there
> is a broader definition, could someone please talk us through it.
> 
> With the addition of the Service/ApplicationHeader there appear to be two
> ways to represent a User-Agent.  Consider the following XML snippet below:
> 
> <System>...
> ... <ApplicationHeader proto="80" field="User-Agent"
> dtype="string">Mozilla/5.0 (Windows NT 6.2; Win64; x64)
> AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1667.0
> Safari/537.36</ApplicationApplication>
> 
> ... <Application swid="xxx" configid="xxx" vendor="Google" name="Chrome"
> user-agent="Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36
> (KHTML, like Gecko) Chrome/32.0.1667.0 Safari/537.36" version="32.0.11667">
> <URL>something</URL> </Application> </Service> </System>
> 
> A few questions:
> ** What implementation guidance should be given about how @user-agent
> should be set with Service/OperatingSystem?
> 
> To share my own bias, the Application and OperatingSystem Class are
> currently very poorly specified.  I don't think we should continue improving
> them.  Instead, we should reference software through CPE
> (http://nvd.nist.gov/cpe.cfm) or similar effort as is possible through the SCI-
> defined class Platform.  For the time being, I would drop @user-agent.
> 
> Roman

---

From: Jerome Athias <[email-masked]>
Date: Tue, 28 Jan 2014 09:24:43 +0300

Hi,

Devil in the details

Regarding the "User-Agent" HTTP field, in the context of Incident, it
is useful for at least:
- as a potential indicator of an "attack step", i.e.: "sqlmap, w3af,
dirbuster" is an indicator of well known "offensive" security tools
used by "scipt kiddies" or threat actors with low level of
skills/knowledge using these tools with default configuration
NB: These patterns (coming easily to a list of hundreds with robots)
can be used for white/blacklisting, automated action, using regex

- as an information (Signature as part of an Event) used as a criteria
for identification (with low level of confidence) of a user or threat
agent client software

HTTPUserAgent, a "User Agent pattern for HTTP client software" is
clearly different from a Service Banner

Regarding, the CPEs, it is actually quite commonly used, as part of
the CVEs, OVAL, or Softwares (including free softwares).
Taking into consideration the adoption factor, and the use in daily
updated repositories (NVD), I think it -currently- makes sense to use
them.
NB: a new mechanism, using the CPEs, (quite similar to OVAL) is now
integrated in the CVE definition
I see SWID tags as a "CPE extension" or more granular, with not enough
maturity in term of adoption as of today.
And ISO/IEC 19770 would also have to be evaluated.

In terms of terminology (Taxonomy/Ontology/Vocabulary/Thesaurus), I
concur that we need to be clear, precise and strict.
Defining properly an "arcology" is difficult, but needed for proper
inter-exchange and automation.
(Terms like "System", "Host" or "Platform" mean nothing and everything
for me, and are just lazy generic terms or should just be used for
very high level of abstraction)

My arcology definition tentative (bad english included):

In the Cyber space, Internet of (Every)thing, there are interactions
between Persons (individuals or group of people such as organisations)
and Systems.
These Systems are IT-Assets.
IT-Assets are a combination of Hardware and Software elements.
These elements have relationships and dependencies.

Elements of the hardware domain are physical objects: Devices.
Devices are physically constituted of Components
One Device could be a combination of multiple Devices or Device Components.
A Device Component could be a combination of Device Components.

Elements of the software domain are Softwares and Applications.
Softwares are a combination of source code (that could be compiled)
NB: The difference between Software and Application potentially comes
from the differentiation of closed-source and open-source
Softwares could be a combination of Softwares (i.e. Libraries)
(Example: an Operating System is a Software)
Applications are a combination of code and potentially Softwares
(Example: a web site is an Application)
NB: an Application could be constituted of just one Software
Softwares and Applications are classified using different terms (Type,
Category, Flavor, ...)

(Software) Services are offered by Applications (and so potentially by
one unique Software) via an interaction of IT-Assets, for example
hosted on Devices using Softwares.

Happy to discuss this and any feedback welcome.
Also happy to speak about Network Links (circuits, connections),
Endpoints, Data, Partitions, Relationships or other Nodes/Clusters.

Best regards