Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

2/5/2018
05:30 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Abusing X.509 Digital Certificates for Covert Data Exchange

Newly discovered hack would allow attackers to send data between two systems during TLS negotiation, researchers say.

Researchers at Fidelis Cybersecurity have identified a new technique that attackers can potentially employ for covertly exchanging data using X.509 digital certificates.

The method builds on previous research involving the abuse of text fields in digital certificates to move data across a network. It takes advantage of the way digital certificates are exchanged during the initial TLS handshake, or the mutual authentication process that happens when two systems attempt to establish or resume a secure session with each other.

"Most other research involving using X.509 certificates for data transfer involves the use of text fields in the certificate such as 'Subject' or some of the other common fields such as 'notbefore' and 'notafter'," says Jason Reaves Jason Reaves, threat research principal engineer at Fidelis. Researchers have previously shown how attackers might use these text fields to covertly send and receive data between systems.

"[Our] method is embedding data inside of a certificate extension," Reaves says. "This means you can send data between two systems purely from the TLS negotiation."

The approach could be used to bypass security systems that do not check certificate extensions for abnormal content, Reaves says.

Digital certificate extensions were added in version 3 of the X.509 protocol and primarily give CAs a way to describe a certificate or to specify how it can be used. But embedding malicious data in these extensions could make it easier for attackers to perform command and control activities once they are already inside the network, Reaves says.

"It enables command and control without having to use a full TLS session," he says. Attackers can take advantage of the technique to send small, unnoticeable amounts of data to an external server without having to use other protocols such as HTTP or HTTPS, he says.

PoC

As a proof-of-concept, Fidelis researchers showed how an attacker might use the X.509 covert channel to transfer the Mimikatz post-exploit attack tool over TLS-negotiation traffic to an already compromised system. Unless an organization is specifically checking for abnormal content in digital certificates, such covert data transfers and communication can be hard to spot. "Without looking for this abnormal content in certificates you are then limited to direct IP-based detection or heuristic-based abnormal TLS sessions," Reaves says.

However, pulling off covert data transfers via certificate extensions is not particularly easy. Attackers would need to be more technically savvy than usual to deploy an attack using the method Fidelis has identified, Reaves says.

Most languages that have built-in TLS packages, such as GOLANG, also have built-in checks for validating parts of the session negotiation and the certificate itself. In such instances, an attacker would need to find a way to bypass the built-in checks in order to covertly send or receive data. "In my experience, this requires more lower-level knowledge about languages and protocols than most malware authors today seem to have," he says.

Organizations with the know-how also can also tweak security controls to look specifically for certificate extensions that have been tampered with, Fidelis said in its report. "However, the widespread use of certificates means that many organizations are potentially open to this new data transfer method," Fidelis said in its report.

Related Content:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
7 Truths About BEC Scams
Ericka Chickowski, Contributing Writer,  6/13/2019
DNS Firewalls Could Prevent Billions in Losses to Cybercrime
Curtis Franklin Jr., Senior Editor at Dark Reading,  6/13/2019
Can Your Patching Strategy Keep Up with the Demands of Open Source?
Tim Mackey, Principal Security Strategist, CyRC, at Synopsys,  6/18/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-1874
PUBLISHED: 2019-06-20
A vulnerability in the web-based management interface of Cisco Prime Service Catalog Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protection mechanisms on the web-ba...
CVE-2019-1875
PUBLISHED: 2019-06-20
A vulnerability in the web-based management interface of Cisco Prime Service Catalog could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface. The vulnerability is due to insufficient validation of user-supplied input by t...
CVE-2019-1876
PUBLISHED: 2019-06-20
A vulnerability in the HTTPS proxy feature of Cisco Wide Area Application Services (WAAS) Software could allow an unauthenticated, remote attacker to use the Central Manager as an HTTPS proxy. The vulnerability is due to insufficient authentication of proxy connection requests. An attacker could exp...
CVE-2019-1878
PUBLISHED: 2019-06-20
A vulnerability in the Cisco Discovery Protocol (CDP) implementation for the Cisco TelePresence Codec (TC) and Collaboration Endpoint (CE) Software could allow an unauthenticated, adjacent attacker to inject arbitrary shell commands that are executed by the device. The vulnerability is due to insuff...
CVE-2019-1879
PUBLISHED: 2019-06-20
A vulnerability in the CLI of Cisco Integrated Management Controller (IMC) could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient validation of user-supplied input at the CLI. An attacker could exploi...