New issue
Advanced search Search tips

Issue 817076 link

Starred by 1 user

Issue metadata

Status: Assigned
Owner:
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 2
Type: Feature



Sign in to add a comment

Add URL Connection logging ETW provider

Reported by jness123...@gmail.com, Feb 27 2018

Issue description

UserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.167 Safari/537.36

Steps to reproduce the problem:
Feature request:  

Add a Chrome ETW provider to emit each UI-entered URLs before they get passed down to lower network layers.  Windows offers this already for applications that use the built-in WinINet and WebIO libraries but it would be great to get visibility into Chrome as well since it uses its own networking libraries.

What is the expected behavior?
We would like visibility into every URL fetched by Chrome.  In an enterprise environment with a web proxy, it is difficult from an individual instrumented endpoint to discover which URLs are fetched.  Logging network connections works ok to get the remote IP address but when a proxy is set the destination IP address is always the proxy, not the real destination address.  We build an endpoint detection, response, and forensics product (veramine.com) that attempts to detect and log attacker activity on each host.  We can learn a lot about attack behavior from network connection logging but it is difficult to correlate to individual processes in a proxy environment so we would like to have an ETW provider to gain visibility.

The WinInet and WebIO ETW providers may provide good examples of the kind of visibility we would like.  Here are those GUIDs:

GUID MICROSOFT_WINDOWS_WINET = { 0x43d1a55c, 0x76d6, 0x4f7e, { 0x99, 0x5c, 0x64, 0xc7, 0x11, 0xe5, 0xca, 0xfe } };
GUID MICROSOFT_WINDOWS_WEBIO = { 0x50b3e73c, 0x9370, 0x461d,{ 0xbb, 0x9f, 0x26, 0xf3, 0x2d, 0x68, 0x88, 0x7d } };

What went wrong?
This is a feature request to provide additional visibility into Chrome behavior.

Did this work before? No 

Chrome version: 64.0.3282.167  Channel: stable
OS Version: Windows 7
Flash Version: 

Bruce Dawson from the Chrome for Windows team suggested that we open this feature request.  We would be very grateful for this kind of support from Chrome to provide enterprise customers better visibility into endpoint behavior.
 
Here's an example of the visibility we are providing for WinInet and WebIO applications.  Would love to do the same for enterprise customers using Chrome.
urlconnections.png
352 KB View Download
Cc: georgesak@chromium.org brucedaw...@chromium.org
Adding a couple of people who have ETW knowledge in Chrome. Context:

https://twitter.com/jness/status/968599895950045185
Cc: kkaluri@chromium.org
Labels: -Type-Bug Type-Feature
Status: Untriaged (was: Unconfirmed)
As per coment #0, this feature request, hence adding appropriate labels 

Comment 4 by alito@chromium.org, Mar 8 2018

Labels: Enterprise-Triaged
Owner: blumberg@chromium.org
Owner: georgesak@chromium.org
Status: Assigned (was: Untriaged)
This bug has an owner, thus, it's been triaged. Changing status to "assigned".

Sign in to add a comment