Black Hat Europe资料eu-15-Rigo-A-Peek-Under-The-Blue-Coat.pdfVIP

A peek under the Blue Coat ProxySG internals Raphaël Rigo / AGI / TX5IT Black Hat Europe - 2015-11-12 A peek under the Blue Coat Outline 1 Introduction 2 Storage: filesystems and registry 3 Binaries 4 Kernel and OS mechanisms 5 Understanding internals 6 Security mechanisms 7 Conclusion Black Hat Europe - 2015-11-12 2 A peek under the Blue Coat Outline 1 Introduction 2 Storage: filesystems and registry 3 Binaries 4 Kernel and OS mechanisms 5 Understanding internals 6 Security mechanisms 7 Conclusion Black Hat Europe - 2015-11-12 3 A peek under the Blue Coat What? Why? Blue Coat ProxySG? enterprise (Web) proxy one of the most deployed in big companies lots of complex features: URL categorization (WebSense and others) video streaming / instant messaging specific handling MAPI and SMB proxy / cache / prefetcher etc. runs proprietary SGOS Why research ProxySG? widely used in Airbus Group interesting target for malicious actors: log bypass, Internet exposed, MITM, etc. no known previous research: unknown security level security bulletins: mostly OpenSSL and Web administration interface bugs Black Hat Europe - 2015-11-12 4 A peek under the Blue Coat Research Study objectives: assess the global security level write recommendations for secure deployment be prepared for forensics in case of a compromised ProxySG Why publish? first public info but surely not first research foster research better security Today’s presentation: raw te