Merge pull request #605 from jvoisin/x509_chromecast

Improve Chromecast x509 issuer fingerprinting
rapid7 · Feb 5, 2024 · 577676a · 577676a
2 parents 71affe7 + b26ed09
commit 577676a
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 0 deletions.
diff --git a/identifiers/fields.txt b/identifiers/fields.txt
@@ -4,6 +4,7 @@ apache.variant
 apache.variant.version
 aptinex.model
 chromecast.capabilities
+chromecast.codename
 chromecast.generation
 cisco.imc_model
 cisco.model

diff --git a/xml/x509_issuers.xml b/xml/x509_issuers.xml
@@ -120,6 +120,7 @@
     <example chromecast.generation="9" chromecast.capabilities="Audio Assist">CN=Chromecast ICA 9 (Audio Assist),OU=Cast,O=Google Inc,L=Mountain View,ST=California,C=US</example>
     <example chromecast.generation="11" chromecast.capabilities="Video Assist">CN=Chromecast ICA 11 (Video Assist),OU=Cast,O=Google Inc,L=Mountain View,ST=California,C=US</example>
     <example chromecast.generation="12">CN=Chromecast ICA 12,OU=Cast,O=Google Inc,L=Mountain View,ST=California,C=US</example>
+    <example chromecast.generation="21" chromecast.capabilities="ATV">CN=Chromecast ICA 21 (ATV),OU=Cast,O=Google Inc,L=Mountain View,ST=California,C=US</example>
     <param pos="0" name="os.vendor" value="Google"/>
     <param pos="0" name="os.product" value="Chrome OS"/>
     <param pos="0" name="os.certainty" value="0.5"/>
@@ -133,6 +134,21 @@
     <param pos="2" name="chromecast.capabilities"/>
   </fingerprint>
 
+  <fingerprint pattern="^CN=atvremote/[a-z_]+/([a-z]+)/Chromecast/">
+    <description>Google Chromecast - mDNS</description>
+    <example chromecast.codename="sabrina">CN=atvremote/sabrina_prod_stable/sabrina/Chromecast/13:37:F0:0B:AR:42</example>
+    <param pos="0" name="os.vendor" value="Google"/>
+    <param pos="0" name="os.product" value="Chrome OS"/>
+    <param pos="0" name="os.certainty" value="0.5"/>
+    <param pos="0" name="os.cpe23" value="cpe:/o:google:chrome_os:-"/>
+    <param pos="0" name="hw.device" value="Media Server"/>
+    <param pos="0" name="hw.vendor" value="Google"/>
+    <param pos="0" name="hw.product" value="Chromecast"/>
+    <param pos="0" name="hw.certainty" value="0.5"/>
+    <param pos="0" name="hw.cpe23" value="cpe:/h:google:chromecast:-"/>
+    <param pos="1" name="chromecast.codename"/>
+  </fingerprint>
+
   <fingerprint pattern="^CN=Asus fugu Cast ICA,OU=Widevine,O=Google Inc,L=Kirkland,ST=Washington,C=US$">
     <description>ASUS Nexus Player (Android) with Google Cast</description>
     <example>CN=Asus fugu Cast ICA,OU=Widevine,O=Google Inc,L=Kirkland,ST=Washington,C=US</example>