5 ms·
Neat project. On HN a lot of people are against TLS interception. How is a defender suppose to detect this traffic? TLS aside snort or yara rules can be imple
by badrabbit 8y ago
Neat project.
On HN a lot of people are against TLS interception. How is a defender suppose to detect this traffic? TLS aside snort or yara rules can be implemented.
For personal devices of course TLS should not be interceptable. But I've personally gone 180 and support TLS decryption for enterprise networks.
- Ne0nd0g 8y agoTools like JA3 https://github.com/salesforce/ja3 https://github.com/salesforce/ja3 can fingerprint TLS traffic to provide one way to perform some type of evaluation. Defender can detect on a lot of other things like an applications behavior.
- xfs 8y agoThat can be trivially defeated by operating on top of Chrome's net stack though.
- blablabla123 8y ago> How is a defender suppose to detect this traffic? Probably by taking a decentralized approach, that's probably more secure, performant and better to maintain anyways. Also on the server side one could do TLS using Haproxy or nginx, this way it would even be possible to use existing tools - just on localhost though. Or, one can do TLS re-encryption with Haproxy/nginx (or Squid for the other direction), and do checking on the host at the same time.
- architect64 8y agoFor enterprise networks, you can still analyze the pattern of packets to match fingerprints of C2 traffic. There are solutions such as Cisco's Encrypted Traffic Analytics, that do just this: https://www.cisco.com/c/dam/en/us/td/docs/solutions/CVD/Campus/CVD-Encrypted-Traffic-Analytics-Deployment-Guide-2018AUG.pdf https://www.cisco.com/c/dam/en/us/td/docs/solutions/CVD/Camp...
- kerng 8y agoMost modern implants dont directly talk to a C2, they relay over other protocols like pastebin, twitter, or blog storage pictures, or databases to obscure traffic.