A TLS/SSL Certificates Flaw Leads to Covert Data Transfer

By admin Last updated Jun 14, 2018

Cybersecurity is the top concern for anyone who operates in the digital world. Nowadays, cyber threats are more sophisticated and more common than ever. So much in fact, that even governments have difficulties protecting themselves from such attacks. A recent discovery in cybersecurity revealed that there’s a flaw in X.509 certificates that are common in TLS (Transport Layer Security) and SSL (Secure Socket Layer) cryptographic protocols, which are the foundation of HTTPS (Hypertext Transfer Protocol – Secure).

Corji: The Beloved Companion Stealing Hearts Worldwide

Facde: Unveiling the Layers Beneath the Surface

CReaders: The Essential Diagnostic Tools for Vehicle…

X.509 is the standardized format that defines public key certificates in cryptography, used for securing Internet communications. This flaw enables covert data exchange and can also be used to breach the security, by bypassing the security measures that check for certificate values. Jason Reaves, threat research principal engineer at Fidelis Security pointed out that there’s indeed a flaw in how certificates are being exchanged, which can lead to them being compromised and taken possession of for command and control (CnC) of the communication.

Contents hide

1 A proof of concept

2 A potential threat

3 A remedy

A proof of concept

In his research, Jason Reaves created a proof of concept that explains how TLS/SSL protocols alongside X.509 certificates have means to hide data from security measures in order to send or receive arbitrary data. The way it works is that certificates are being exchanged before the TLS handshake. That means, that data located in certificates is actually exchanged before the secured connection is established. With that in mind, data can be inserted in the certificate extensions and transferred from client to server or otherwise without being detected.

As Jason stated: “X.509 certificates have many fields where strings can be stored…The fields include version, serial number, Issuer Name, validity period and so on. The certificate abuse…takes advantage of this fact to hide data transfer inside one of these fields. Since the certificate exchange happens before the TLS session is established, there appears to never have been a data transfer, when in reality the data was transferred within the certificate exchange itself.”

Put simply, it’s a flaw in the certificate exchange that can be used for covert data transition, but it can also be used by hackers to breach security and to seize the control of communications. However, there are no reported attacks using this method, but it could prove as a potential threat to many companies and individuals in the online world.

A potential threat

Using X.509 certificates for covert data transfer isn’t exactly a revelation. As a matter of fact, it was proposed that adding data to ICMP (Internet Control Message Protocol) should be used as means of transfer back in 2005, while first mentions of covert channels were in government publications in 1993.

However, as data transfer itself may not sound as a big concern, the fact that malicious software can also be transferred using these means proves as a potential threat. Fidelis Security researchers also created a proof of concept, where they simulated a transfer of malicious ransomware called Mimikatz, similar to WannaCry ransomware that was detected worldwide in May 2017, via certificate extensions. Mimikatz, also known as Bad Rabbit is a Petya type malware that hit Russia and Ukraine back in 2017. The ransomware hit various Russian media outlets, airport in Odessa and metro in Kiev, where attackers demanded 0.05 Bitcoin in ransom for the stolen data.

As mentioned before, there are still no reported attacks using this method, but it does mean that many online businesses can be compromised. The fact of the matter is that many websites implement HTTP with TLS/SSL protocols. What’s more, many online businesses that implement SEO (Search Engine Optimization) strategies use HTTPS, in order to improve their rankings. Back in 2014 Google announced that TLS/SSL protocols will be included as ranking signals, in order to urge websites to implement additional security. You can read this comprehensive resource if you want more information about SSL and HTTPS, as well as their role in search ranking. It’s safe to say that it’s a good thing that the flaw was first found by researchers and that no website was compromised.

A remedy

Even though this flaw can turn into a major threat, there is, however, a way for online business and individuals to protect themselves from this covert data transfers. By simulating an attack through certificate extensions, Fidelis Security researchers have also build a framework that will help users detect covert data transfers and implement security measures to protect themselves.

The framework shows the detailed process on how to detect and block unwanted certificate extensions. For instance, if there are executables in certificate data, it’s a first sign that it’s quite likely compromised. Moreover, users should block self-signed certificates as well, in order to prevent these hidden data transfers.

Researchers continue to test cybersecurity measures and show us time and again that cyber threats can come from anywhere. Even a simple flaw in a security protocol, such as TLS/SSL can be exploited to breach security and steal sensitive information. Not only that, but it can compromise an entire system. One thing is for sure, if we want to be safe online, we must continue to improve our cybersecurity and be aware of its weaknesses.

http://forupon.com/2018/03/29/chaos-threatens-tech-takeover-threat-synonym/

If you want to GET ACCESS about Chaos threatens tech takeover and the threat synonym you are absolutely right here and you can also find here the CCS football playoffs, NBC paid off producer who actually accused Chris Matthews of harassment also the Indonesians burn US flags in 4^th day of Jerusalem protests in shown in all around the world.

http://forupon.com/2018/02/20/find-approved-free-follow-blog-commenting-sites-list-20172018/

For getting information of all kind and for the latest news updates, breaking news we have the best source as the forupon.com to make you inform for each and every thing. There are also presenting the Bitcoin, Cryptocurrencies target by the hackers. Here you will get all news of Iraqi Shiite cleric urges fighters to disarm after IS defeat and will get also the best source of blog commenting.

http://forupon.com/2018/02/21/latest-social-bookmarking-sites-lists-20172018/

If you want to add some social tools to your site and want to get updated for your latest directory submissions lists, Google Scoops up the other downtown San Jose Transit Village property. People who want to get inform completely then we have the best source of treasure information right here for them.

http://forupon.com/2018/02/24/instant-approval-dofollow-guest-posting-sites-list-free-2018/

If you want to know more about guest posting and its benefits then here is the best platform which will support you about each and everything. You can also get here the Olympic medalist jelly van, Bitcoin, Block chain VS investments paying off. We have best information about shooting near red bluff is latest in long lists of firearm.

http://forupon.com/2018/02/24/best-free-spinner-sites-2018/

Now the Google policies are un beatable for us and we are giving best information platform right here as 18 effective ways to grow the business with social media sites, it is best for you to refine user experience to run digital marketing, mobile text message marketing with loyalty.

http://forupon.com/2018/03/05/latest-free-directory-submission-list-2018/

Being change in the dictionaries of directory submission in Google is favoring the new lists and unique as well if you want to enjoy the best sources for your directory submissions you are absolutely right here. You can also have raiders fans get kicked into the teeth NFL, New digital pet monitor help and support you, Stephen curry listed as questionable VSs magic.

http://forupon.com/2018/03/12/best-free-plagiarism-checker-sites-2018/

As using different tools we may got lots of spammy articles and contents but if you want to check correctly before publication then here is the best source for correcting articles you. You may also get the information about why Roku, inc. Stock jumped and Official Kill Snapping turtle those are puppy.

http://forupon.com/2018/03/19/da-bulk-da-checker-sites/

Not only the site matters the DA, PA and ranking of the site can be checked from here and we will give you the information about DA and PA having envious look with the Glowing skin, news about surveillance footage shows man attacking and news about iPhone X as millions of people of the world queue as apple proves it.

http://forupon.com/2018/03/22/writing-the-blog-post/

For having one the best source of blog posting and writing blog post you are going to evaluate all the tips right here and can also know more about the latest news and internal conversation paints triggered New York. We are giving information about internal conversation paints triggered and copyright board boosts.

http://forupon.com/2018/04/12/forum-posting-sites-list-2018/

If you want to have some backlinks and real do-follow backlinks then here we are going to describe you better sources of forums can make you feel easy about your site promotion and quality of strength. It is the best way for you to know more about all news latest and upcoming matters as news Romania, San Jose and how the warriors secured win over the sixers.

http://forupon.com/2018/03/29/how-do-we-get-trust-flow-checker-sites-free/

For checking the TF CF you are at right place along with the Elvis impersonator, Gigabit speed with the internet in San Jose, Professor Claims as the meritocracy. You will get republicans for the 5^th stop gap budget bill right here on this site.

http://forupon.com/2018/03/28/free-press-release-sites-list-2018/

If you want to get the press submissions for promoting your site backlink, Google indexes, Search Engine ranking. Here you will get news and information about any topic, any news, any breaking news then forupon.com will give you all. Here we have also readers weigh in one new visa rules and will get baby steps in America absolutely latest.

http://forupon.com/2018/03/23/create-blog-spot-earn-money/

People who actually not willing to run a site they can get a blog to start their business and with earnings they can buy a site and can make your dream true. Your blog will make some more money and will keep higher profit through the Google adsense. For latest news and updates here you will find east bay doctor sues posh Mexican resorts, US Senate in Russian hackers’ right here.

http://forupon.com/2018/03/23/how-to-search-top-dofollow-blogs/

Google actually work to perform for boosting site ranking to perform some search to give value for your all news you want to have through the site. Here you will get information about reduce stomach aching during periods and also news about new thrive app video shows you how to take back control of the life.

http://forupon.com/2018/03/23/top-quality-seo-forum-sites-list-2018/

Each and every site needs SEO and SEO forums so if you need some specific forums then here you will get complete access of SEO backlinking sites, SEO blogs and also SEO forums. Not only the news but also we are giving best information about the latest Japan approves missile defense system aimed NKorea threat news and their updates here.

A potential threat A proof of concept A remedy A TLS/SSL Certificates Covert data flaw