Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

2/5/2018
05:30 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Abusing X.509 Digital Certificates for Covert Data Exchange

Newly discovered hack would allow attackers to send data between two systems during TLS negotiation, researchers say.

Researchers at Fidelis Cybersecurity have identified a new technique that attackers can potentially employ for covertly exchanging data using X.509 digital certificates.

The method builds on previous research involving the abuse of text fields in digital certificates to move data across a network. It takes advantage of the way digital certificates are exchanged during the initial TLS handshake, or the mutual authentication process that happens when two systems attempt to establish or resume a secure session with each other.

"Most other research involving using X.509 certificates for data transfer involves the use of text fields in the certificate such as 'Subject' or some of the other common fields such as 'notbefore' and 'notafter'," says Jason Reaves Jason Reaves, threat research principal engineer at Fidelis. Researchers have previously shown how attackers might use these text fields to covertly send and receive data between systems.

"[Our] method is embedding data inside of a certificate extension," Reaves says. "This means you can send data between two systems purely from the TLS negotiation."

The approach could be used to bypass security systems that do not check certificate extensions for abnormal content, Reaves says.

Digital certificate extensions were added in version 3 of the X.509 protocol and primarily give CAs a way to describe a certificate or to specify how it can be used. But embedding malicious data in these extensions could make it easier for attackers to perform command and control activities once they are already inside the network, Reaves says.

"It enables command and control without having to use a full TLS session," he says. Attackers can take advantage of the technique to send small, unnoticeable amounts of data to an external server without having to use other protocols such as HTTP or HTTPS, he says.

PoC

As a proof-of-concept, Fidelis researchers showed how an attacker might use the X.509 covert channel to transfer the Mimikatz post-exploit attack tool over TLS-negotiation traffic to an already compromised system. Unless an organization is specifically checking for abnormal content in digital certificates, such covert data transfers and communication can be hard to spot. "Without looking for this abnormal content in certificates you are then limited to direct IP-based detection or heuristic-based abnormal TLS sessions," Reaves says.

However, pulling off covert data transfers via certificate extensions is not particularly easy. Attackers would need to be more technically savvy than usual to deploy an attack using the method Fidelis has identified, Reaves says.

Most languages that have built-in TLS packages, such as GOLANG, also have built-in checks for validating parts of the session negotiation and the certificate itself. In such instances, an attacker would need to find a way to bypass the built-in checks in order to covertly send or receive data. "In my experience, this requires more lower-level knowledge about languages and protocols than most malware authors today seem to have," he says.

Organizations with the know-how also can also tweak security controls to look specifically for certificate extensions that have been tampered with, Fidelis said in its report. "However, the widespread use of certificates means that many organizations are potentially open to this new data transfer method," Fidelis said in its report.

Related Content:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
7 Tips for Infosec Pros Considering A Lateral Career Move
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2020
For Mismanaged SOCs, The Price Is Not Right
Kelly Sheridan, Staff Editor, Dark Reading,  1/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
IT 2020: A Look Ahead
Are you ready for the critical changes that will occur in 2020? We've compiled editor insights from the best of our network (Dark Reading, Data Center Knowledge, InformationWeek, ITPro Today and Network Computing) to deliver to you a look at the trends, technologies, and threats that are emerging in the coming year. Download it today!
Flash Poll
How Enterprises are Attacking the Cybersecurity Problem
How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-3154
PUBLISHED: 2020-01-27
CRLF injection vulnerability in Zend\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the header of an email.
CVE-2019-17190
PUBLISHED: 2020-01-27
A Local Privilege Escalation issue was discovered in Avast Secure Browser 76.0.1659.101. The vulnerability is due to an insecure ACL set by the AvastBrowserUpdate.exe (which is running as NT AUTHORITY\SYSTEM) when AvastSecureBrowser.exe checks for new updates. When the update check is triggered, the...
CVE-2014-8161
PUBLISHED: 2020-01-27
PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to obtain sensitive column values by triggering constraint violation and then reading the error message.
CVE-2014-9481
PUBLISHED: 2020-01-27
The Scribunto extension for MediaWiki allows remote attackers to obtain the rollback token and possibly other sensitive information via a crafted module, related to unstripping special page HTML.
CVE-2015-0241
PUBLISHED: 2020-01-27
The to_char function in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via a (1) large number of digits when processing a numeric ...