Attacks/Breaches

2/5/2018
05:30 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Abusing X.509 Digital Certificates for Covert Data Exchange

Newly discovered hack would allow attackers to send data between two systems during TLS negotiation, researchers say.

Researchers at Fidelis Cybersecurity have identified a new technique that attackers can potentially employ for covertly exchanging data using X.509 digital certificates.

The method builds on previous research involving the abuse of text fields in digital certificates to move data across a network. It takes advantage of the way digital certificates are exchanged during the initial TLS handshake, or the mutual authentication process that happens when two systems attempt to establish or resume a secure session with each other.

"Most other research involving using X.509 certificates for data transfer involves the use of text fields in the certificate such as 'Subject' or some of the other common fields such as 'notbefore' and 'notafter'," says Jason Reaves Jason Reaves, threat research principal engineer at Fidelis. Researchers have previously shown how attackers might use these text fields to covertly send and receive data between systems.

"[Our] method is embedding data inside of a certificate extension," Reaves says. "This means you can send data between two systems purely from the TLS negotiation."

The approach could be used to bypass security systems that do not check certificate extensions for abnormal content, Reaves says.

Digital certificate extensions were added in version 3 of the X.509 protocol and primarily give CAs a way to describe a certificate or to specify how it can be used. But embedding malicious data in these extensions could make it easier for attackers to perform command and control activities once they are already inside the network, Reaves says.

"It enables command and control without having to use a full TLS session," he says. Attackers can take advantage of the technique to send small, unnoticeable amounts of data to an external server without having to use other protocols such as HTTP or HTTPS, he says.

PoC

As a proof-of-concept, Fidelis researchers showed how an attacker might use the X.509 covert channel to transfer the Mimikatz post-exploit attack tool over TLS-negotiation traffic to an already compromised system. Unless an organization is specifically checking for abnormal content in digital certificates, such covert data transfers and communication can be hard to spot. "Without looking for this abnormal content in certificates you are then limited to direct IP-based detection or heuristic-based abnormal TLS sessions," Reaves says.

However, pulling off covert data transfers via certificate extensions is not particularly easy. Attackers would need to be more technically savvy than usual to deploy an attack using the method Fidelis has identified, Reaves says.

Most languages that have built-in TLS packages, such as GOLANG, also have built-in checks for validating parts of the session negotiation and the certificate itself. In such instances, an attacker would need to find a way to bypass the built-in checks in order to covertly send or receive data. "In my experience, this requires more lower-level knowledge about languages and protocols than most malware authors today seem to have," he says.

Organizations with the know-how also can also tweak security controls to look specifically for certificate extensions that have been tampered with, Fidelis said in its report. "However, the widespread use of certificates means that many organizations are potentially open to this new data transfer method," Fidelis said in its report.

Related Content:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Valentine's Emails Laced with Gandcrab Ransomware
Kelly Sheridan, Staff Editor, Dark Reading,  2/14/2019
High Stress Levels Impacting CISOs Physically, Mentally
Jai Vijayan, Freelance writer,  2/14/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-7399
PUBLISHED: 2019-02-17
Amazon Fire OS before 5.3.6.4 allows a man-in-the-middle attack against HTTP requests for "Terms of Use" and Privacy pages.
CVE-2019-8392
PUBLISHED: 2019-02-17
An issue was discovered on D-Link DIR-823G devices with firmware 1.02B03. There is incorrect access control allowing remote attackers to enable Guest Wi-Fi via the SetWLanRadioSettings HNAP API to the web service provided by /bin/goahead.
CVE-2019-8394
PUBLISHED: 2019-02-17
Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization.
CVE-2019-8395
PUBLISHED: 2019-02-17
An Insecure Direct Object Reference (IDOR) vulnerability exists in Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10007 via an attachment to a request.
CVE-2019-8389
PUBLISHED: 2019-02-17
A file-read vulnerability was identified in the Wi-Fi transfer feature of Musicloud 1.6. By default, the application runs a transfer service on port 8080, accessible by everyone on the same Wi-Fi network. An attacker can send the POST parameters downfiles and cur-folder (with a crafted ../ payload) ...