Re: [arch-d] draft-iab-m-ten-workshop

[Hesham ElBakoury <[e-mail]>]

Thanks Arnaud.
That would be great.

Hesham

On Sat, Aug 26, 2023, 9:16 AM Arnaud Taddei <[e-mail]>
wrote:

> Ok so that is exactly not the conversation I want to have nor in this
> format.
>
>
>
> So please forget me for the next 3 weeks (SG17 in Korea) and I will try to
> understand how best to frame what should be framed.
>
>
>
> *From: *Salz, Rich <[e-mail]>
> *Date: *Saturday, 26 August 2023 at 16:21
> *To: *Hesham ElBakoury <[e-mail]>, Arnaud Taddei <
> [e-mail]>
> *Cc: *[e-mail] <[e-mail]>
> *Subject: *Re: [arch-d] draft-iab-m-ten-workshop
>
> Since this IAB report is mainly looking into encrypted data, I would
> assume that you are interested in the cases where Ransomware attack
> is leveraging encrypted data such as Encrypted Client Header (ECH) which
> can be used to hide the adversaries command and control [
> https://www.ietf.org/archive/id/draft-campling-ech-deployment-considerations-07.txt
> <https://www.google.com/url?q=https://urldefense.com/v3/__https:/www.ietf.org/archive/id/draft-campling-ech-deployment-considerations-07.txt__;!!GjvTz_vk!TCEUzvgyrwR484kRDlnSTqYySSCORBNX0MW3d1BSPYbggzqy7zcY7DxxTYSjjJNxvrHZTmc9bFTRV4V6$&source=gmail-imap&ust=1693664482000000&usg=AOvVaw2e-mo-OVLMRrZUXEKYp6F3>
> ]
>
>
>
> It would be senseless to use ECH for C&C, since they are not hosting
> multiple services.  From what I have seen, most C&C centers are taken down
> by looking at the IP address and working from there, not examining TLS
> handshakes.
>
>
>
> This electronic communication and the information and any files
> transmitted with it, or attached to it, are confidential and are intended
> solely for the use of the individual or entity to whom it is addressed and
> may contain information that is confidential, legally privileged, protected
> by privacy laws, or otherwise restricted from disclosure to anyone else. If
> you are not the intended recipient or the person responsible for delivering
> the e-mail to the intended recipient, you are hereby notified that any use,
> copying, distributing, dissemination, forwarding, printing, or copying of
> this e-mail is strictly prohibited. If you received this e-mail in error,
> please return the e-mail to the sender, delete it from your computer, and
> destroy any printed copy of it.