0

Analyzing some payload I faced up to one which contains a string like this :

VeriSign, Inc.10UVeriSign Trust Network1:08U1(c) 2006 VeriSign, Inc. - For authorized use only1E0CU VeriSign Class 3 Public Primary Certification Authority - G5150318000000Z150630235959Z0

Could anyone help me to understand what is the code that start with G?

The payload probably comes from a malicious traffic.

  • what kind of payload? what's the rest of the context? – schroeder Oct 2 '15 at 19:18
  • This is still unclear - are you saying this is from a packet capture? What contained this string? What's after the string? – schroeder Oct 2 '15 at 19:52
  • I think you will find what you are looking for here: symantec.com/page.jsp?id=roots – schroeder Oct 2 '15 at 20:04
4

You're basically looking at the raw data of a certificate signed by a Verisign root, which is not surprising if you're looking at network traces. It doesn't imply anything about the rest of the stream.

"G5" is part of the name of a certificate -

Root 3 VeriSign Class 3 Primary CA - G5

In this case that's actually the Issuer of the certificate you're actually looking at.

The two long numbers terminated with Z that follow (150318000000Z150630235959Z) are the Validity period, as per RFC 5280 ss 4.1.2.5:

The certificate validity period is the time interval during which the CA warrants that it will maintain information about the status of the certificate. The field is represented as a SEQUENCE of two dates: the date on which the certificate validity period begins (notBefore) and the date on which the certificate validity period ends (notAfter). Both notBefore and notAfter may be encoded as UTCTime or GeneralizedTime.

The Z indicates that they are using UTCTime (RFC 5280 ss 4.1.2.5.1):

The universal time type, UTCTime, is a standard ASN.1 type intended for representation of dates and time. UTCTime specifies the year through the two low-order digits and time is specified to the precision of one minute or one second. UTCTime includes either Z (for Zulu, or Greenwich Mean Time) or a time differential.

For the purposes of this profile, UTCTime values MUST be expressed in Greenwich Mean Time (Zulu) and MUST include seconds (i.e., times are YYMMDDHHMMSSZ), even where the number of seconds is zero.

  • ok, It is what I would to know, now I'm wondering if I can extract from this kind of payload any others info about the certificate like fingerprint or serial number. thanks again – CDominik Oct 3 '15 at 9:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.