ET INFO Default PolarSSL/mbedTLS Certificate Subject Observed in Certificate

7.0.3 5.0SID: 2063691Rev: 1Enabled1 views

Fileemerging-info.rules

CreatedJuly 24, 2025

UpdatedJuly 24, 2025

Classificationmisc-activity

alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Default PolarSSL/mbedTLS Certificate Subject Observed in Certificate"; flow:established,to_client; tls.cert_subject; bsize:28; content:"C=NL,O=PolarSSL,CN=localhost"; fast_pattern; reference:url,forums.mbed.com/t/mbedtls-ssl-handshake-issue-2/4763; reference:url,blog.sekoia.io/polaredge-unveiling-an-uncovered-iot-botnet/; classtype:misc-activity; sid:2063691; rev:1; metadata:affected_product IoT, attack_target IoT, created_at 2025_07_24, deployment Perimeter, performance_impact Significant, confidence High, signature_severity Informational, tag mbedTLS, tag PolarSSL, updated_at 2025_07_24;)

References

url	forums.mbed.com/t/mbedtls-ssl-handshake-issue-2/4763
url	blog.sekoia.io/polaredge-unveiling-an-uncovered-iot-botnet/

Metadata

affected productIoT

attack targetIoT

created at2025_07_24

deploymentPerimeter

performance impactSignificant

confidenceHigh

signature severityInformational

tagPolarSSL

updated at2025_07_24

Comments (0)

Please sign in to leave a comment.

No comments yet. Be the first to comment!