Abusing X.509 Digital Certificates for Covert Data Exchange

Newly discovered hack would allow attackers to send data between two systems during TLS negotiation, researchers say.

Researchers at Fidelis Cybersecurity have identified a new technique that attackers can potentially employ for covertly exchanging data using X.509 digital certificates.
The method builds on previous research involving the abuse of text fields in digital certificates to move data across a network. It takes advantage of the way digital certificates are exchanged during the initial TLS handshake, or the mutual authentication process that happens when two systems attempt to establish or resume a secure session with each other.
Most other research involving using X.509 certificates for data transfer involves the use of text fields in the certificate such as Subject or some of the other common fields such as notbefore and notafter, says Jason Reaves Jason Reaves, threat research principal engineer at Fidelis. Researchers have previously shown how attackers might use these text fields to covertly send and receive data between systems.
[Our]
method
is embedding data inside of a certificate extension, Reaves says. This means you can send data between two systems purely from the TLS negotiation.
The approach could be used to bypass security systems that do not check certificate extensions for abnormal content, Reaves says.
Digital certificate extensions were added in version 3 of the X.509 protocol and primarily give CAs a way to describe a certificate or to specify how it can be used. But embedding malicious data in these extensions could make it easier for attackers to perform command and control activities once they are already inside the network, Reaves says.
It enables command and control without having to use a full TLS session, he says. Attackers can take advantage of the technique to send small, unnoticeable amounts of data to an external server without having to use other protocols such as HTTP or HTTPS, he says.
PoC
As a proof-of-concept, Fidelis researchers showed how an attacker might use the X.509 covert channel to transfer the Mimikatz post-exploit attack tool over TLS-negotiation traffic to an already compromised system. Unless an organization is specifically checking for abnormal content in digital certificates, such covert data transfers and communication can be hard to spot. Without looking for this abnormal content in certificates you are then limited to direct IP-based detection or heuristic-based abnormal TLS sessions, Reaves says.
However, pulling off covert data transfers via certificate extensions is not particularly easy. Attackers would need to be more technically savvy than usual to deploy an attack using the method Fidelis has identified, Reaves says.
Most languages that have built-in TLS packages, such as GOLANG, also have built-in checks for validating parts of the session negotiation and the certificate itself. In such instances, an attacker would need to find a way to bypass the built-in checks in order to covertly send or receive data. In my experience, this requires more lower-level knowledge about languages and protocols than most malware authors today seem to have, he says.
Organizations with the know-how also can also tweak security controls to look specifically for certificate extensions that have been tampered with, Fidelis said in its report. However, the widespread use of certificates means that many organizations are potentially open to this new data transfer method, Fidelis said in its report.
Related Content:
Dont Trust That Trust Mechanism: Vulnerabilities In Digital Certificates
Digital Certificate Security Fail
Covert Voice Commands Can Hack A Smartphone
IoT Botnets by the Numbers

Last News
▸ Veritabile Defecte de Proiectare a Securitatii in Software -> Top 10 Software Security Design Flaws ◂ Discovered: 23/12/2024 Category: security	▸ Sony, XBox Targeted by DDoS Attacks, Hacktivist Threats ◂ Discovered: 23/12/2024 Category: security	▸ There are plenty of online tools for reporting bugs. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Abusing X.509 Digital Certificates for Covert Data Exchange