Trisul Network Analytics
Developer Zone

User Tools

Site Tools

You are here: Home » app » TLS Fingerprinting using Trisul
Trace: • Configuring ERSPAN packet capture for Network Security Monitoring
app:tlsfingerprint

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
app:tlsfingerprint [2017/11/29 00:04] – [Programatically resolving TLS Prints] veeraapp:tlsfingerprint [2018/03/04 13:27] (current) – veera
Line 1: Line 1:
 +~~Title: TLS Fingerprinting using Trisul ~~ 
 +
 ====== TLS Fingerprinter ====== ====== TLS Fingerprinter ======
  
Line 10: Line 12:
 ===== What is TLS Fingerprinting ===== ===== What is TLS Fingerprinting =====
  
-This technique builds upon the patterns found in the client preferences that are advertised in the "Client Hello" message that is sent as the very first message in the TLS Handshake process. This message is un-encrypted, therefore it allows for NSM tools like Trisul to look at it.  Each SSL/TLS Client such as browsers use a particular version of a particular implementation of SSL/TLS. Some major implementations are OpenSSL, GnuTLS, Windows, Java SSE, NSS, embedded libraries like WolfSSL etc. +This technique builds upon the patterns found in the preferences that are advertised in the "Client Hello" message that is sent by the client as the very first message in the TLS Handshake process. This message is unencrypted, so it allows for NSM tools like Trisul to look at it.  Every SSL/TLS Client uses a particular version of a particular implementation of SSL/TLS library. Some major implementations are OpenSSL, GnuTLS, Windows, Java SSE, NSS, WolfSSL etc. 
  
 The 3 major fields in the Client Hello that can identify a client are  The 3 major fields in the Client Hello that can identify a client are 
Line 20: Line 22:
 So if you take all the three together there is a high likelyhood that you can minimize collisions and identify a particular client on a particular operating system.If you printed out the values of all these three fields and then computed a MD5 hash over the string, we can get a 'fingerprint'.  We can call this a //JA3 hash// as proposed by the researchers John Althouse and team.   So if you take all the three together there is a high likelyhood that you can minimize collisions and identify a particular client on a particular operating system.If you printed out the values of all these three fields and then computed a MD5 hash over the string, we can get a 'fingerprint'.  We can call this a //JA3 hash// as proposed by the researchers John Althouse and team.  
  
-At first, this approach may seem a bit flaky but it is not easy for an application to change its //print// dynamically without some major code rewrite. We currently have about 300 hashes largely due to Lee Brotherston's original work. We at Trisul also added in some 50 hashes. +At first, this approach may seem a bit flaky but it is not easy for an application to change its //print// dynamically without some major code rewrite. We currently have about 300 hashes largely due to Lee Brotherston's effort. We at Trisul also added in some 50-60 new prints. 
  
-Links +<note>  
 +Further reading
   * [[https://github.com/synackpse|Lee Brotherstons work]] on TLS Fingerprinting   * [[https://github.com/synackpse|Lee Brotherstons work]] on TLS Fingerprinting
 +  * [[https://blog.squarelemon.com/tls-fingerprinting/|Square Lemon blog TLS Fingerprinting]]
   * [[https://github.com/salesforce/ja3|JA3 Hash]]     * [[https://github.com/salesforce/ja3|JA3 Hash]]  
 +</note>
 ==== Fingerprints database ==== ==== Fingerprints database ====
  
Line 39: Line 43:
  
  
-===== Analysis of TLS Fingerprints =====+==== Analysis of TLS Fingerprints ==== 
 +  
 +There are two actionable things you can do with these prints
    
-What are you going to do with these prints. There are a few options  
- 
   * **Malware prints**  - These are hard to come by  but if you can get a few prints from malware clients. You can flag them quickly. These will likely evade IDS because they use TLS to connect to presumably well known C&C servers with valid certificates etc.   * **Malware prints**  - These are hard to come by  but if you can get a few prints from malware clients. You can flag them quickly. These will likely evade IDS because they use TLS to connect to presumably well known C&C servers with valid certificates etc.
   * **Anomaly detection** : If you can track known prints,then you can build a large Database over a period of time. After that you can send unseen prints into a "Triage state" where a human can look into it.    * **Anomaly detection** : If you can track known prints,then you can build a large Database over a period of time. After that you can send unseen prints into a "Triage state" where a human can look into it. 
- 
-In both analysis paths,we think TLS Prints is a valuable piece of intel, especially given we are moving to pervasive TLS.  
- 
-Lets look at what you can do with TrisulNSM and the new TLS Prints App. 
  
  
Line 95: Line 95:
 When you reveal adjacent vertices in [[https://www.trisul.org/docs/ug/edges/index.html|Trisul EDGE]] you will see vertices of all types. One of vertex types is **User-Agent** others are TLS Cert, Country, ASN etc.  We are lucky that we found a single User Agent around the same time interval as Semrush - which happens to be a SEO Bot. So there .. this **TLS Print can be pegged to SEMRUSH Bot**.  You can then go to the Key Dashboard and set the label to //resolve the previously unknown TLS Print// When you reveal adjacent vertices in [[https://www.trisul.org/docs/ug/edges/index.html|Trisul EDGE]] you will see vertices of all types. One of vertex types is **User-Agent** others are TLS Cert, Country, ASN etc.  We are lucky that we found a single User Agent around the same time interval as Semrush - which happens to be a SEO Bot. So there .. this **TLS Print can be pegged to SEMRUSH Bot**.  You can then go to the Key Dashboard and set the label to //resolve the previously unknown TLS Print//
  
-=== Programatically resolving TLS Prints ===+===== Programatically resolving TLS Prints ===== 
 + 
 +This App dumps all fingerprints along with the parameters used to compute them into a log file. This allows us to programatically resolve unknown fingerprints. We released a TRP Ruby script to [[app:auto_fingerprint|programatically resolve TLS Prints using Web Server Access Logs]].
  
-This App dumps all fingerprints along with the parameters used to compute them and the TCP Flow details in a log file.  In another article we will outline how we can programatically deduce the Client Fingerprint. 
  
  
app/tlsfingerprint.1511894085.txt.gz · Last modified: 2017/11/29 00:04 by veera