Information Leakage Detection (regex)

See “A Regular Expression Search Primer for Analysts” [pdf] by Timothy Cook. Test with REGex TESTER.

It looks like the examples below have been corrupted.

When watching outbound files for sensitive information, some specific strings to grep for would be:

IP address in dotted decimal notation b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b/
Email address /^([a-z0-9_\.-]+)@([\da-z\.-]+)\.([a-z\.]{2,6})$/
Visa Credit Card Number ^4[0-9]{12}(?:[0-9]{3})?$

All Visa card numbers start with a 4. New cards have 16 digits. Old cards have 13.

MasterCard Credit Card Number ^5[1-5][0-9]{14}$

All MasterCard numbers start with the numbers 51 through 55. All have 16 digits.

American Express Credit Card Number ^3[47][0-9]{13}$American Express card numbers start with 34 or 37 and have 15 digits.
Diners Club Credit Card Number ^3(?:0[0-5]|[68][0-9])[0-9]{11}$Diners Club card numbers begin with 300 through 305, 36 or 38. All have 14 digits. There are Diners Club cards that begin with 5 and have 16 digits. These are a joint venture between Diners Club and MasterCard, and should be processed like a MasterCard.
Discover Credit Card Number ^6(?:011|5[0-9]{2})[0-9]{12}$Discover card numbers begin with 6011 or 65. All have 16 digits.
JCB Credit Card Number ^(?:2131|1800|35\d{3})\d{11}$JCB cards beginning with 2131 or 1800 have 15 digits. JCB cards beginning with 35 have 16 digits.
Social Security Number ^(?!000)([0-6]\d{2}|7([0-6]\d|7[012]))([ -]?)(?!00)\d\d\3(?!0000)\d{4}$
Archive file extension \.(?:z(?:ip|[0-9]{2})|r(?:ar|[0-9]{2})|jar|bz2|gz|tar|rpm)$
Audio file extension \.(?:mp3|wav|og(?:g|a)|flac|midi?|rm|aac|wma|mka|ape)$
Software file extension \.(?:exe|msi|dmg|bin|xpi|iso)$
Image file extension \.(?:jp(?:e?g|e|2)|gif|png|tiff?|bmp|ico)$
Video file extension \.(?:mpeg|ra?m|avi|mp(?:g|e|4)|mov|divx|asf|qt|wmv|m\dv|rv|vob|asx|ogm)$

Use Regex Coach, Expresso or kiki to assist when writing regular expressions.

Learn more at, RegexPlanet, or Lars Vogel’s Java Regex Tutorial.

See article on credit card numbers at RegexBuddy Library and General credit card information at Credit Card Numbers Are Not Random: How To Read & Understand Them Yourself.

Acknowledgment to Perl-Fu: Regexp log file processing should be inserted here.


Comments are closed.