OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.

 


Help: OASIS Mailing Lists Help | MarkMail Help

cti-cybox message

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]


Subject: Re: [cti-cybox] A new Forum Object


>> Riddle me this - what is the semantic difference of a POST with a recipient of "xyzforum.com/mygroup", and an email MESSAGE with a recipient of "cti-cybox@lists.oasis-open.org" ?

 

The difference in my mind is that the recipient of an email message is a well understood entity (an email address), whereas the recipient of a forum post is abstract and subject to interpretation (Is it a URL of a forum? Is it the name of a forum/newsgroup?). Also, I think that as a new user I think it would be quite confusing in trying to understand that a Message Object can also capture forum posts.

 

Regards,

Ivan

 

From: Jason Keirstead <Jason.Keirstead@ca.ibm.com>
Date: Tuesday, July 5, 2016 at 9:02 AM
To: Ivan Kirillov <ikirillov@mitre.org>
Cc: Terry MacDonald <terry.macdonald@cosive.com>, "Mates, Jeffrey CIV DC3/DCCI" <Jeffrey.Mates@dc3.mil>, Paul Patrick <ppatrick@isightpartners.com>, "cti-cybox@lists.oasis-open.org" <cti-cybox@lists.oasis-open.org>
Subject: Re: [cti-cybox] A new Forum Object

 

RE "Semantically, I view a “post” differently than a “message”, especially because the concept of recipient is not really shared between the two. Who is the “recipient” of a post? Thus, I would be very uneasy with a single representation for both posts and messages."

The "recipient" of the post is the forum group.

Riddle me this - what is the semantic difference of a POST with a recipient of "xyzforum.com/mygroup", and an email MESSAGE with a recipient of "cti-cybox@lists.oasis-open.org" ?


-
Jason Keirstead
STSM, Product Architect, Security Intelligence, IBM Security Systems
www.ibm.com/security | www.securityintelligence.com

Without data, all you are is just another person with an opinion - Unknown


nactive hide details for "Kirillov, Ivan A." ---07/05/2016 11:59:16 AM---"Kirillov, Ivan A." ---07/05/2016 11:59:16 AM---Just catching up here after being away on holiday for a few weeks. Some initial comments while I thi

From: "Kirillov, Ivan A." <ikirillov@mitre.org>
To: Jason Keirstead/CanEast/IBM@IBMCA, Terry MacDonald <terry.macdonald@cosive.com>
Cc: "Mates, Jeffrey CIV DC3/DCCI" <Jeffrey.Mates@dc3.mil>, Paul Patrick <ppatrick@isightpartners.com>, "cti-cybox@lists.oasis-open.org" <cti-cybox@lists.oasis-open.org>
Date: 07/05/2016 11:59 AM
Subject: Re: [cti-cybox] A new Forum Object
Sent by: <cti-cybox@lists.oasis-open.org>





Just catching up here after being away on holiday for a few weeks. Some initial comments while I think more on this:

· I’m OK with the concepts around the Post Object, though I do worry that this could set a precedent for the inclusion of more arbitrary Objects around various types of metadata in CybOX.
· Semantically, I view a “post” differently than a “message”, especially because the concept of recipient is not really shared between the two. Who is the “recipient” of a post? Thus, I would be very uneasy with a single representation for both posts and messages.
· More generally, I want to make sure that any abstractions we do build into CybOX Objects are sound and serve a real purpose; I think there really need to be a number of key fields that are useful across ANY Object represented by the abstraction, and that these fields don’t mangle any standard (i.e., RFC) definitions for the Object. This is my hesitation with an abstract message Object – things like the very standard “from” and “to” fields in an email would have to be mapped into their corresponding abstracted fields by a content producer, and subsequently consumers would have to understand what these fields refer to when parsing such an Object. This is a significant semantic burden, one that I’m not sure is overcome by the value of having a few common fields (message body, etc.).


Anyhow, as Trey mentioned, this is something that we should discuss on this Thursday’s working session.

Regards,
Ivan

From: <cti-cybox@lists.oasis-open.org> on behalf of Jason Keirstead <Jason.Keirstead@ca.ibm.com>
Date:
Monday, June 27, 2016 at 6:26 AM
To:
Terry MacDonald <terry.macdonald@cosive.com>
Cc:
"Mates, Jeffrey CIV DC3/DCCI" <Jeffrey.Mates@dc3.mil>, Paul Patrick <ppatrick@isightpartners.com>, "cti-cybox@lists.oasis-open.org" <cti-cybox@lists.oasis-open.org>
Subject:
Re: [cti-cybox] A new Forum Object

Are you saying that instead of using a base "message" object of which "post" is an extension, the suggestion will now have a "post" object with extensions for things like IRC ? How is IRC more like a web forum post than a web forum post is like an email or SMS?

As Jeff implies - aren't these all just messages with differing levels of visibility? I still don't like this object. It has far too much overlap with email.

-
Jason Keirstead
STSM, Product Architect, Security Intelligence, IBM Security Systems
www.ibm.com/security | www.securityintelligence.com

Without data, all you are is just another person with an opinion - Unknown


active hide details for Terry MacDonald ---06/27/2016 09:05:46 AM---WhicTerry MacDonald ---06/27/2016 09:05:46 AM---Which is why I've now created a 'Post' Object that has a base 'Post' object and that allows other ty

From:
Terry MacDonald <terry.macdonald@cosive.com>
To:
"Mates, Jeffrey CIV DC3/DCCI" <Jeffrey.Mates@dc3.mil>
Cc:
Paul Patrick <ppatrick@isightpartners.com>, "cti-cybox@lists.oasis-open.org" <cti-cybox@lists.oasis-open.org>
Date:
06/27/2016 09:05 AM
Subject:
Re: [cti-cybox] A new Forum Object
Sent by:
<cti-cybox@lists.oasis-open.org>






Which is why I've now created a 'Post' Object that has a base 'Post' object and that allows other types of posts to be derived from it. I've posted it into the CybOX playground for comments and review:


https://docs.google.com/document/d/1P6k0uqbAYDRpYG5jjgYAKBDEc_iSG0-SGFaXgaPkqyg/edit?ts=56c3b210#heading=h.ki1ufj1ku8s0

Cheers

Terry MacDonald
| Chief Product Officer



M:
+61-407-203-026
E:
terry.macdonald@cosive.com
W:
www.cosive.com




On Mon, Jun 27, 2016 at 9:32 PM, Mates, Jeffrey CIV DC3/DCCI <
Jeffrey.Mates@dc3.mil> wrote:

I know I'm jumping in late here, but I really do not like the idea of forum post not using the generic Message TLO with one or more extensions. Consider for example the following semi-forum post objects:

A tweet (fully public to group; persistent)
A twitter direct message (private to individual; persistent)
A facebook post (semi-private to group; persistent)
A facebook group chat where a participant joins the conversation halfway through (private to group; persistent)
An IRC message (semi-private to group or individual; persistent)
A snapchat story (private to group; ephemeral)
A reddit post (public to group; persistent)
A whisper conversation (public to geographically similar temporary group; ephemeral)


Given that message already contains a way to store a title, body and sender as part of the pure TLO with an extension for attachments I don't see why we need to split the two. I apologize for not sending this sooner, but until recently I haven't had much time to go through the STIX / CybOX discussion.

Jeffrey Mates, Civ DC3/DCCI
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Computer Scientist
Defense Cyber Crime Institute

jeffrey.mates@dc3.mil
410-694-4335

-----Original Message-----
From:
cti-cybox@lists.oasis-open.org [mailto:cti-cybox@lists.oasis-open.org] On Behalf Of Paul Patrick
Sent: Friday, June 24, 2016 10:52 AM
To:
cti-cybox@lists.oasis-open.org
Subject: [Non-DoD Source] Re: [cti-cybox] A new Forum Object

After working with some of my analysts that work in the works of Hacktivism, I believe there are a few missing fields that we should add:



· create_date – a timestamp as to when the post was created

· modify_date – a timestamp as to when the post was last modified


· attachments – a number of times correlation between posts that are to attributed to a common actor can’t be done based on the persona used in the forum. It is often necessary to be able to capture their persona image as a base64 encoded value. This same thing could also be used for capturing the payloads from forums such as Pastebin, althrough that might best be handled with a source relationship to a File object

· post-title – in many forums, there thread of conversation has a title/name that is different than the title of the post itself, so it is often necessary to be able to represent those as different properties.

· view-count – a count of the number of times a post is views can often be used as an indicator of interest

· share-count – a count of the number of times a post is ‘shared’ can often be used as an indicators of interest but also as part of getting an understanding around influence.


· ‘likes’ – a count of the number of ‘likes’ or +1s that have been given to a particular post. I haven’t been able to come up with a better property name yet, but it’s one thing to view a post and another thing to actually take an action to indicate that a reader is in agreement. An alternative could be to use the proposed Opinion so that not only can a count be obtained but also the ability to capture the persona of the entity that expressed that opinion. This would also be used as a means to capture comments about a post rather than treating them as posts and using a sources relationship of commented-on





Paul Patrick





From: Jerome Athias <
athiasjerome@gmail.com>
Date: Friday, June 24, 2016 at 1:02 AM
To: Paul Patrick <
ppatrick@isightpartners.com>
Cc: Terry MacDonald <
terry.macdonald@cosive.com>, "cti-cybox@lists.oasis-open.org" <cti-cybox@lists.oasis-open.org>
Subject: Re: [cti-cybox] A new Forum Object



I concur that Post would be better name.

Another example would be a Pastebin post



2016-06-22 18:55 GMT+03:00 Paul Patrick <
ppatrick@isightpartners.com>:

Terry,



I’d like to suggest we not call it a ‘Forum’ object but rather some think like ‘Post’ since it’s the posting, not the forum/blog/chat channel that we’re trying to describe. That why we can equally apply it to things like forums but also to mediums like IRC Chat which are not person-to-person.



Thoughts?





Paul



From: <
cti-cybox@lists.oasis-open.org> on behalf of Jerome Athias <athiasjerome@gmail.com>
Date: Wednesday, June 22, 2016 at 1:35 AM
To: Terry MacDonald <
terry.macdonald@cosive.com>
Cc: "
cti-cybox@lists.oasis-open.org" <cti-cybox@lists.oasis-open.org>
Subject: Re: [cti-cybox] A new Forum Object
Resent-From: <Paul.Patrick@FireEye.com>



Interesting reading

http://www.networkworld.com/article/3085065/security/hack-the-hackers-eavesdrop-for-intel-on-emerging-threats.html



On Thursday, 16 June 2016, Terry MacDonald <
terry.macdonald@cosive.com> wrote:

Hi All,



For the 3rd time someone recently asked me if there was a way of encoding web forum posts within CybOX. My reply...well not really. That answer bothered me greatly, so with the help of AJ from EclecticIQ I put together a Forum Object.



The Forum Object is designed to record web forum and newsgroup posts, and is aimed primarily at helping people record what is being discussed on underground forums.



I really think it is needed for CybOX 3.0 MVP personally, and a couple of friends at very large organizations have also confirmed they would find this very useful. In fact one was surprised that it wasn't there already.


1.1 Forum Object

Type Name: forum-object

Status: Draft

MVP: Yes



The Forum Object represents a single Forum post. It is used to capture posts on newsgroups and web forums, primarily to enable the sharing of conversations held between threat actors on underground forums.


Properties

CybOX Object Properties


id, type

Property Name

Type

Description

type (inherited from cybox-object)

string

Indicates that this object is a CybOX Forum Object. The value of this field MUST be forum-object.

url (optional)

string

Specifies the url of the forum.

forum-name(required)

string

Specifies the name of the forum.

room-name(optional)

string

Specifies the room-name within the forum.

thread-title

string

Specifies the thread-title within the forum.

post-creator

string

Specifies the identity of the forum post creator.

post-details

string

Specifies the full details of the forum post.


Examples


Underground forum post



{

"type": "forum-object",

"id": "forum-object--1",

"url": "
https://www.cardz4cheap.org/cardsforsale/5332113",

"forum-name": "Cardz4cheap",

"room-name": "Cards for sale",

"thread-title": "Happy Burger Cards",

"post-creator": "DeliteD",

"post-details": "Hey Dudes, I got 1500 cards for sale real cheap."

}






Cheers



Terry MacDonald | Chief Product Officer







M:
+61-407-203-026 <tel:+61-407-203-026>

E:
terry.macdonald@cosive.com

W:
www.cosive.com <https://www.cosive.com/>










[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]