User Agents

TOP SECRETHCOMINTHREL TO USA, FVEY User-agentsThe overall classification ef this briefing to TOP SECRETHCOMINTHREL T0 USA, FVEY 52 I 5'1 Derived From July 2010 1?52 Dated 200?0108 Deelassify en: 20320108- TOP SECRETHCOMINTHREL TO USA, FVEY

TOP SECRETHCOMINTHREL TO USA, FVEY Agenda WHY: Learn why we care about user agents (UAs) HOW: Learn how to read a user-agent HOW TO: (get it?) Learn how to use user-agents in our tools TOP SECRETHCOMINTHREL TO USA, FVEY

TOP SECRETHCOMINTHREL TO USA, FVEY TOP SECRETHCOMINTHREL TO USA, FVEY

TOP SECRETHCOMINTHREL TO USA, FVEY What is a User-Agent? A user?agent is a string which lets websites know your: . type of web-browser or application . Operating System . Security settings or permissions . Versions of relevant programs (media, java, etc.) . Etc. (Language settings, ad-ware) TOP SECRETHCOMINTHREL TO USA, FVEY

TOP SECRETHCOMINTHREL TO USA, FVEY Why would I want to give a website that? - Compatibility - Specific Website Features - Security permissions TOP SECRETHCOMINTHREL TO USA, FVEY

TOP SECRETHCOMINTHREL TO USA, FVEY User-Agents Can Link a target?s ?selected? activity to their unselected web-browsing Create a tentative link between targets that have the same user-agent Identify CNE opportunities TOP SECRETHCOMINTHREL TO USA, FVEY

TOP SECRETHCOMINTHREL TO USA, FVEY TOP SECRETHCOMINTHREL TO USA, FVEY

TOP SECRETHCOMINTHREL TO USA, FVEY User-Agents Also Can vary from very unique to extremely common Change with software updates Only identify the web-browser . 2 web-browsers 2 user-agents Can?t be TOP SECRETHCOMINTHREL TO USA. FVEY

TOP SECRETHCOMINTHREL TO USA, FVEY Who started this nonsense? A History Lesson TOP SECRETHCOMINTHREL TO USA, FVEY

TOP SECRETHCOMINTHREL TO USA, FVEY The Great Browser Wars the 20"h Century! Before Now but After What is Below TOP SECRETHCOMINTHREL TO USA, FVEY

TOP SECRETHCOMINTHREL TO USA, FVEY Remember Frames? Netscape?s new fancy web-browser support them! The original ?web-browser? Mosaic did not And so began browser ?sniffing? TOP SECRETHCOMINTHREL TO USA, FVEY

TOP SECRETHCOMINTHREL TO USA, FVEY Worthless Trivia! Mosaic was the first web-browser to embed images with text It supported FTP, Usenet, and Gopher! Its web-browser competitors at the time were Erwise and TOP SECRETHCOMINTHREL TO USA, FVEY

TOP SECRETHCOMINTHREL TO USA, FVEY The Great Internet Explorer Hoax Ever wonder why so many user agents start with ?Mozilla? but aren?t Firefox? TOP SECRETHCOMINTHREL TO USA, FVEY

TOP SECRETHCOMINTHREL TO USA, FVEY Internet Explorer fools us all When Internet Explorer was released it did frames too! But since its user-agent didn?t say so, no websites would send their super cool frames version to the IE users TOP SECRETHCOMINTHREL TO USA, FVEY

TOP SECRETHCOMINTHREL TO USA, FVEY What to do? TOP SECRETHCOMINTHREL TO USA, FVEY

TOP SECRETHCOMINTHREL TO USA, FVEY LIE, fours! TOP SECRETHCOMINTHREL TO USA, FVEY

TOP SECRETHCOMINTHREL TO USA, FVEY Internet Explorer starts to spoof Internet Explorer changed its user agent starting their user agent with Mozilla/1.22 Mozilla/1.22 (compatible; MSIE 2.0; Windows 95) TOP SECRETHCOMINTHREL TO USA, FVEY

TOP SECRETHCOMINTHREL TO USA, FVEY And it continues to this very TOP SECRETHCOMINTHREL TO USA, FVEY

TOP SECRETHCOMINTHREL TO USA, FVEY The TOP SECRETHCOMINTHREL TO USA, FVEY

TOP SECRETHCOMINTHREL TO USA, FVEY Three asic ieces of the UA TOP SECRETHCOMINTHREL TO USA, FVEY

TOP SECRETHCOMINTHREL TO USA, FVEY Mozilla/1.22 (compatible; MSIE 2.0; Windows 95) Part 1: The Netscape Historical Token -Appears in primarily Mozilla Firefox, Google Chrome, and MSIE browsers -Modern Version: Mozilla 4.0 or Mozilla 5.0 -Does not indicate a target uses ?Mozilla Firefox? TOP SECRETHCOMINTHREL TO USA, FVEY

TOP SECRETHCOMINTHREL TO USA, FVEY Mozilla/1.2 (compatible; MSIE 2.0; Windows 95) MSIE 2. Part 2: The Web Browser Identifier -Appears in generally all user-agents -Not always in the same place, but usually self explanatory -Opera X.X Opera -Firefox X.X Firefox -Safari X.X: Safari -Chrome X.X Safari X.X Google Chrome TOP SECRETHCOMINTHREL TO USA, FVEY

TOP SECRETHCOMINTHREL TO USA, FVEY Mozilla/1.22 (compatible; MSIE 2.0; Windows 95) Winws 5 Part 3: The Operating System Token -Appears in basically all HTTP user-agent strings Examples: -Windows NT 6.1 Windows Version 7 -Windows NT 6.0 Windows Vista *Windows NT 5.2 Windows XP 64bit 'Windows NT 5.1 Windows XP -Windows NT 4.0 actually equals Windows NT 4.0 TOP SECRETHCOMINTHREL TO USA, FVEY

TOP SECRETHCOMINTHREL TO USA, FVEY ther operating systems UAs I Mobile . MAC OS I Linux . Linux i686 . Free BSD TOP SECRETHCOMINTHREL TO USA, FVEY

TOP SECRETHCOMINTHREL TO USA, FVEY Game Consoles . Opera/9.30 (Nintendo Wii; 2047-7; en) . Mozilla/5.0 (Playstation 3; 2.00) . PSP (PlayStation Portable); 2.00 TOP SECRETHCOMINTHREL TO USA, FVEY

TOP SECRETHCOMINTHREL TO USA, FVEY Mobile User Agents Usually self?explanatory .lphone . lpad . Blackberry . Android Mobile user agents also usually give you the phone model (Read: IMEI correlation opportunities) TOP SECRETHCOMINTHREL TO USA, FVEY

TOP SECRETHCOMINTHREL TO USA, FVEY Ever wonder what that was? Gecko: a rendering engine used by Firefox and others AppleWebkit: Apple?s version of rendering engine used in Safari and Chrome most commonly Presto the ?core? of the Opera platform suite TOP SECRETHCOMINTHREL TO USA, FVEY

TOP SECRETHCOMINTHREL TO USA, FVEY Ever Wonder Contd. .NET CLR is the .NET Framework version 8V1 is an artifact created by MSIE 6.0 to make its security better Win64 can indicate that the system is running a 64 bit processor TOP SECRETHCOMINTHREL TO USA, FVEY

TOP SECRETHCOMINTHREL TO USA, FVEY Ever ne more Many web browsers will also have an strength" marker USA (128 bit International (40 bit No (Wool) Most Browsers nowadays come with a Since the USG no longer requires changes for international usage. TOP SECRETHCOMINTHREL TO USA, FVEY

TOP SECRETHCOMINTHREL TO USA, F?v?E?r? Your target?s user?agents can shorten and lengthen! . Each website may require different information . Longer user-agents may have various rendering engine, java versions, and language settings . If you see a shortened or longer version of a UA close to your targets logins. Check it out! TOP SECRETHCOMINTHREL TO USA. FVEY

TOP SECRETHCOMINTHREL TO USA, FVEY Th Hw TOP SECRETHCOMINTHREL TO USA. FVEY

TOP SECRETHCOMINTHREL TO USA, FVEY uerying in Xkeyscore Navigatinn Menu ii a illa 5. [ll 3 El a l:1E [:23 II LEI ISIS: ate a I: EII Remember: a also earn Since Xkeysce re lo ng pperts leading wildcards you need to be specific gar-lg: with your User?Agent 3 I: rn ni lI.User-agent alone is not a strong query a El il FE E: E: EIE: I me: I ?fuIILua Country, etc. all will help make your query compliant a re a r' lliuiliil?ws; NT 5.1; Iii-e 5.99 TOP SECRETHCOMINTHREL TO USA, FVEY

TOP SEC L. To Fx-rEfr Uniqueness When to use a User-Agent A. GED Mozillm'nlil {ooInn-otili-Ie; MSIE lu'li'incl-i-l-ile NT 5.1; 5?51} {ooInu-?tili-le; MSIE 5.11; Windows NT 5.1; Mozill?inm MEIE Ill]; NT 5.1; 551} {ooInu-rltili-le; MSIE Bill; Windows NT 5.1; Finerg Mozill?fal? {ooInu-?tili-le; MSIE ?ll; Wlirlowe NT 5.1; {coInu-?tiliule; MSIE NT 5.1; Magma!? {ooInn-?tili-le; men; Wlirlowe NT 5.1; 5' GWUF Sort ?ee-ending SortDeeoentling ISolorEll.r MEIE Fl]; Windows NT 5?1] {ooInu-?tili-le; MSIE Til; Wlirlowe HT 5. {ooInu-?tili-le; MEIE Fill; ?Mnrlowe NT Mo?lla?? {toInn-?tilrle; MEIE WIHIIJIWE Hismglam Gil? {ooInu-?tili-le; MEIE Fill; ?Mnrlows NT . Hieiogrern Pivot Date PH eutoFii oniumn Width Results of an lP-based search for a target Histogram Grid LOW Number Of users and Page 1 Elf; .. . traffic volume as well as only 2 User?agents Mozillei?l? ioomba?ble; li-lElE El]; Windows SW) Mozillel?l? inompatible; l'i-lElE Windows NT 51}: Verdict: Probably reliable TOP TO FVEY

LEAH 0i dOl 'semesmeua, Aq pesn aq um sIue?e?Iesn sue uoneIeIJoo ICLL pue ?Iugod 8ng 83% I0 pue Iue?E-Jesn OI enp SILL 01 Jesmmq SILQEJEJ, Ino? I0 El LII 3E: ZIIJII II :51 NW 5 EIIE: HE: '3'31'1' NE I El EIWEII I15: '31 33'} NE EU I'd' HII ELLEII Fl EIIE: ME: '31 UJ 31'} NE: El :Eil? Fl ?1 Fl EIIE: '31 EE l-"Ei HE: 'Zi'JEIIE: '3'31'3' NE: EU l- :1 J3 EIIE: Kill-I '3'35'3' NE I LII-E: :1 13 5411 I I. . . :IzrezI HIELIIE: .H ELI LII 1:41;: HIE: I I Iz-zn LE. I-IIE ELI LII ELL E: fI. Fl HIE55413 Eli E: El. Fl HIE: 5an IIE: tinHIE: IIE tin?I Eur-i: I I I10 L- EILIH HIE: 5an IIE: tinLII-I Fl HIE3E: 541? IH EIE. :1 II fl. 5 LII-I HIE: 5an IIE: tin?I I I I I- 3 LII-I HIEswquOJd eIoW Jesn eJow ?wan Oi

TOP SECRETHCOMINTHREL TO USA, FVEY Common Sense Helps Never assume because a User-agent is complicated that it is unique Example: Mozilla 5.0 (Windows; Windows NT 6.1; en-US) like Gecko) Chrome/6.0.4640 Safari/534.3 This is the standard user agent for EVERYONE with an updated Chrome browser using Windows 7. TOP SECRETHCOMINTHREL TO USA, FVEY

TOP SECRETHCOMINTHREL TO USA, FVEY Xkeyscore Storage Push to Pinwale or Archive Results . . II Arcl'li?l?e fiFIiE:hE!d TOP SECRETHCOMINTHREL TO USA, FVEY

TOP SECRETHCOMINTHREL TO USA, FVEY Pinwale Fields to add to Metadata View pp r' r' User Agent HolillaI5-? (Windows; Windows NT 5-1; Generally speaking, the User Agent listed belongs to the selector in the Active User column (if populated) TOP SECRETHCOMINTHREL TO USA, FVEY

TOP SECRETHCOMINTHREL TO USA, FVEY Add a User-Agent to a compliant query Fielded Search Form Put in the He er ge nt thet inte the Mlle] ?e Id under the ?elded ee ereh m. ["Dpere tht"] IJIJI pe r' 1' m' lillilt't'l't'EEI-I tege Llee FIT. Smart Form/ Native Query Hettee, M1e1"j] between Re?eeregeet end theeregent te?ger?he?t and TOP SECRETHCOMINTHREL TO USA, FVEY

TOP SEC WHERE. L. T0 L1 wear Not sure the specific User-Agent? 1. Add the fellewihg eyntee te yeur query: 2. Apply Hetiye te the ?eld 3. Apply the eehteht_mete deeument eehe tn the ?eld. I. . EmertF'dn? ["ieteuzizdrl"l I 1: l_ Helene-r21 Ef eetectdr1 ye!? will ?t?lueirigeht I I: tweeraeent 1'3 I I?il'?l USHEIHHEL) This query ensures that eerteih ?eld exists in reeult thee remeyihg all the eehteht net releyeht te yeur query. TOP TO USA, FVEY

TOP SECRETHCOMINTHREL TO USA, FVEY User-Agent Manipulation The best for last . User-agents can completely be changed or not included by the user! In By Firefox Plugin a By Browser settings (Opera) a Outside programs (TOR Button) . These programs allow users to have a different user agent for each session! TOP SECRETHCOMINTHREL TO USA, FVEY

TOP SECRETHCOMINTHREL TO USA, FVEY uestions?? Contact Info: @nsajegev Website on the High-Side: a Lots of great stuff in open source as well! TOP SECRETHCOMINTHREL TO USA, FVEY

TOP SECRETHCOMINTHREL TO USA, F?v?E?r? Have a random SIGDEV question? Need help with a target using new tech to communicate? Need help developing an accurate collateral description of a technology? Want help developing Xkeyscore fingerprints for a weird target behavior? TOP SECRETHCOMINTHREL TO USA, FVEY