Attacks/Breaches

2/5/2018
05:30 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Abusing X.509 Digital Certificates for Covert Data Exchange

Newly discovered hack would allow attackers to send data between two systems during TLS negotiation, researchers say.

Researchers at Fidelis Cybersecurity have identified a new technique that attackers can potentially employ for covertly exchanging data using X.509 digital certificates.

The method builds on previous research involving the abuse of text fields in digital certificates to move data across a network. It takes advantage of the way digital certificates are exchanged during the initial TLS handshake, or the mutual authentication process that happens when two systems attempt to establish or resume a secure session with each other.

"Most other research involving using X.509 certificates for data transfer involves the use of text fields in the certificate such as 'Subject' or some of the other common fields such as 'notbefore' and 'notafter'," says Jason Reaves Jason Reaves, threat research principal engineer at Fidelis. Researchers have previously shown how attackers might use these text fields to covertly send and receive data between systems.

"[Our] method is embedding data inside of a certificate extension," Reaves says. "This means you can send data between two systems purely from the TLS negotiation."

The approach could be used to bypass security systems that do not check certificate extensions for abnormal content, Reaves says.

Digital certificate extensions were added in version 3 of the X.509 protocol and primarily give CAs a way to describe a certificate or to specify how it can be used. But embedding malicious data in these extensions could make it easier for attackers to perform command and control activities once they are already inside the network, Reaves says.

"It enables command and control without having to use a full TLS session," he says. Attackers can take advantage of the technique to send small, unnoticeable amounts of data to an external server without having to use other protocols such as HTTP or HTTPS, he says.

PoC

As a proof-of-concept, Fidelis researchers showed how an attacker might use the X.509 covert channel to transfer the Mimikatz post-exploit attack tool over TLS-negotiation traffic to an already compromised system. Unless an organization is specifically checking for abnormal content in digital certificates, such covert data transfers and communication can be hard to spot. "Without looking for this abnormal content in certificates you are then limited to direct IP-based detection or heuristic-based abnormal TLS sessions," Reaves says.

However, pulling off covert data transfers via certificate extensions is not particularly easy. Attackers would need to be more technically savvy than usual to deploy an attack using the method Fidelis has identified, Reaves says.

Most languages that have built-in TLS packages, such as GOLANG, also have built-in checks for validating parts of the session negotiation and the certificate itself. In such instances, an attacker would need to find a way to bypass the built-in checks in order to covertly send or receive data. "In my experience, this requires more lower-level knowledge about languages and protocols than most malware authors today seem to have," he says.

Organizations with the know-how also can also tweak security controls to look specifically for certificate extensions that have been tampered with, Fidelis said in its report. "However, the widespread use of certificates means that many organizations are potentially open to this new data transfer method," Fidelis said in its report.

Related Content:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Facebook Aims to Make Security More Social
Kelly Sheridan, Associate Editor, Dark Reading,  2/20/2018
SEC: Companies Must Disclose More Info on Cybersecurity Attacks & Risks
Kelly Jackson Higgins, Executive Editor at Dark Reading,  2/22/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
How to Cope with the IT Security Skills Shortage
Most enterprises don't have all the in-house skills they need to meet the rising threat from online attackers. Here are some tips on ways to beat the shortage.
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.