7 ms·

Intercepting Zoom's encrypted data with BPF

265 points by aaron-santos 6y ago

jackinloadup 6y ago
This is very cool. I've always wanted to do something like this. I hope to use snuffy in the future. Thanks for the great walk through!
- yconfiscator 6y ago
  Glad you liked it!
jeroenhd 6y ago
I was surprised to see hooking code like this being written in Rust. I've come to expect C sample code for purposes like these, so it's nice to see that there are actually alternatives when it comes to intercepting function calls and extracting data from a process.
- dharmab 6y ago
  Other options include bpftrace[1] or C, Python or Lua via BCC[2] 1: https://github.com/iovisor/bpftrace https://github.com/iovisor/bpftrace 2: https://github.com/iovisor/bcc https://github.com/iovisor/bcc
  - BobbyJo 6y ago
    Lua is the most common language I had never heard about before dealing with BPF. It gets embedded in a surprising array of technologies.
    - phs 6y ago
      That's most of what lua's purpose is: to be a reasonably pleasant and featureful language that is dead easy to embed in larger systems that want some kind of scripting or macros.
  - yconfiscator 6y ago
    I think what makes redbpf stands out is that the other libraries allow you to write the user-space code in Python or Lua etc, but then the kernel code must still be written in C and gets compiled with clang. In redbpf we let you write the kernel code in Rust as well, and then we have our own LLVM based toolchain to compile that to BPF bytecode. bpftrace is similar to redbpf in approach, in that it lets you use a DSL instead of C.
- mhh__ 6y ago
  When you get past the layers of old and dead documentation around it, the eBPF subsystem is fairly easy to target as long as you can call C, topologically at least.
- luizfelberti 6y ago
  The people from Cilium (the k8s service mesh) launched this website[0] recently that lists a few tools from the landscape, and I also had the same pleasant surprise to find these things out this week I thought we were still tied to `bcc` and that python frontend thingy, but I'm glad the ecosystem has evolved significantly while I was not paying attention! It's kinda like finding a $20 in your back pocket that you didn't know was there when you put your pants on... [0] https://ebpf.io/ https://ebpf.io/
justicezyx 6y ago
I am not sure how much of this technique can be used elsewhere for legitimate purposes. In this example, except for an administrator spying on other users on a shared machine, which is kind of already an admitted risk by users on a shared machine anyway.
- gravitas 6y ago
  > I am not sure how much of this technique can be used elsewhere for legitimate purposes ...as a Linux systems engineer, you are many times faced with debugging a black box problem wrapped in SSL on both ends which you need to peek into to understand what's going wrong; there is nothing suspect about this technique in this environment, it's what you're paid to do (solve problems). It's basically like having the ability to elevate your NIC port to promiscuous mode to debug an issue (tcpdump, e.g.) - it's a tool with no opinion, the human operating it is the one to be worried about.
- phs 6y ago
  Looks like nextgen ad blocking to me. If you can instrument TLS connections on the client, you can identify ad content and substitute blank video frames or just 404s.
  - yconfiscator 6y ago
    Writing a toy ad blocker is actually on my todo list :) There's just so many things you can so. The original goal of the post was to tamper with zoom's attention tracking for example (which was a field in one of their protobuf payloads).
  - userbinator 6y ago
    Proxomitron had that capability years ago - MITM proxy to filter pages and block ads, among other things. I still use it, it's very useful and continues to run fine on the newest Windows.
- rndgermandude 6y ago
  It's useful to a security researcher or privacy advocate looking into what an application like zoom is actually sending around. It may be also helpful when reverse engineering "proprietary" protocols, e.g. to create compatible clients. It may be even easier to just "mitm" the traffic like this in applications you develop yourself to find out what going on deeply buried in some third party library. Easier than modifying the code or attaching a normal debugger. There are plenty of legitimate uses.
setheron 6y ago
Something like this needs to be included in tcpdump or Wirshark. (tcpdump would be fitting; since it was the genesis for cBPF) I remember patching Netty https://github.com/netty/netty/pull/8653 https://github.com/netty/netty/pull/8653 just to get the master key in order to decrypt sessions. Having the ability to decrypt TLS sessions like this is way simpler. tl;dr; would love to see something like this for tshark / tcpdump
- shawnz 6y ago
  Wireshark does support TLS decryption if you provide a "key log file": https://wiki.wireshark.org/TLS#TLS_Decryption https://wiki.wireshark.org/TLS#TLS_Decryption Perhaps OP's technique could be used to generate such a file. EDIT: I see you have already investigated such methods after looking at your github link.
sillysaurusx 6y ago
But how do we find the offsets? What values do we give to ssl_read_offset and ssl_write_offset? [ REDACTED ] I had a nice little section on how to find the offsets here. When I first wrote it I was convinced that publishing two addresses couldn't possibly get me sued for reverse engineering. Some of the people who read the draft of this post changed my mind about it though, and it is 2020 after all so it is not a good time to be optimistic. So, how would you find these offsets? Anyone know? It's probably the most interesting part of the post. There's a "hypothetical" paragraph afterwards, but if anyone wants to actually do this with Zoom and post the results, you'd probably earn lots of cred. In particular, the exact arguments to the objdump command would help.
- jdright 6y ago
  It is sad they felt the need to do this. This step is not hard, but censuring it because of hypothetical legal issues speaks a lot about the state of affairs on computing. I miss the good old times where knowledge were freely published without fear.
  - deleted 6y ago
    [deleted]
  - saagarjha 6y ago
    Do note that this is generally not something that would be a legal issue.
  - libpcap 6y ago
    Publish it on 2600 Magazine?
- matheusmoreira 6y ago
  > Some of the people who read the draft of this post changed my mind about it though Details? Reverse engineering isn't even illegal.
  - yconfiscator 6y ago
arn7av 6y ago
I have done exactly the same thing for Desktop/Android apps using Frida (modified from https://github.com/google/ssl_logger https://github.com/google/ssl_logger). There are modules out there that dump SSLKEYLOG too (that can be used in Wireshark)
- benmmurphy 6y ago
  With IOS I’ve used the keylog strategy and it is very effective. IOS uses boringssl and the library calls a function to log the secret but this function never does anything normally. However, you can either trampoline this function to log the secret or modify the ssl context to add your own logger function. This is all public knowledge and you can find Frida scripts that will dump the TLS secrets.
  - heyoni 6y ago
    And this can be used to defeat certificate pinning?
    - heyoni 6y ago
      I just realized you would just be sniffing the data unencrypted rather than setting up any proxy or root cert, so this question doesn't make sense.
procombo 6y ago
Awesome post Alessandro! Well written and in tutorial format. Much respect! I know what I'll be playing around with this weekend. I will be looking forward to more blog posts of yours in the future.
- yconfiscator 6y ago
  Thank you! Mind I only tested on latest ubuntu and fedora so feel free to DM me on twitter if you run into issues.

265 points by aaron-santos 6y ago

This is very cool. I've always wanted to do something like this. I hope to use snuffy in the future. Thanks for the great walk through!

yconfiscator 6y ago
Glad you liked it!

jeroenhd 6y ago

I was surprised to see hooking code like this being written in Rust. I've come to expect C sample code for purposes like these, so it's nice to see that there are actually alternatives when it comes to intercepting function calls and extracting data from a process.

dharmab 6y ago
Other options include bpftrace[1] or C, Python or Lua via BCC[2] 1: https://github.com/iovisor/bpftrace https://github.com/iovisor/bpftrace 2: https://github.com/iovisor/bcc https://github.com/iovisor/bcc
- BobbyJo 6y ago
  Lua is the most common language I had never heard about before dealing with BPF. It gets embedded in a surprising array of technologies.
  - phs 6y ago
    That's most of what lua's purpose is: to be a reasonably pleasant and featureful language that is dead easy to embed in larger systems that want some kind of scripting or macros.
- yconfiscator 6y ago
  I think what makes redbpf stands out is that the other libraries allow you to write the user-space code in Python or Lua etc, but then the kernel code must still be written in C and gets compiled with clang. In redbpf we let you write the kernel code in Rust as well, and then we have our own LLVM based toolchain to compile that to BPF bytecode. bpftrace is similar to redbpf in approach, in that it lets you use a DSL instead of C.
mhh__ 6y ago
When you get past the layers of old and dead documentation around it, the eBPF subsystem is fairly easy to target as long as you can call C, topologically at least.
luizfelberti 6y ago
The people from Cilium (the k8s service mesh) launched this website[0] recently that lists a few tools from the landscape, and I also had the same pleasant surprise to find these things out this week I thought we were still tied to `bcc` and that python frontend thingy, but I'm glad the ecosystem has evolved significantly while I was not paying attention! It's kinda like finding a $20 in your back pocket that you didn't know was there when you put your pants on... [0] https://ebpf.io/ https://ebpf.io/

justicezyx 6y ago

I am not sure how much of this technique can be used elsewhere for legitimate purposes. In this example, except for an administrator spying on other users on a shared machine, which is kind of already an admitted risk by users on a shared machine anyway.

gravitas 6y ago
> I am not sure how much of this technique can be used elsewhere for legitimate purposes ...as a Linux systems engineer, you are many times faced with debugging a black box problem wrapped in SSL on both ends which you need to peek into to understand what's going wrong; there is nothing suspect about this technique in this environment, it's what you're paid to do (solve problems). It's basically like having the ability to elevate your NIC port to promiscuous mode to debug an issue (tcpdump, e.g.) - it's a tool with no opinion, the human operating it is the one to be worried about.
phs 6y ago
Looks like nextgen ad blocking to me. If you can instrument TLS connections on the client, you can identify ad content and substitute blank video frames or just 404s.
- yconfiscator 6y ago
  Writing a toy ad blocker is actually on my todo list :) There's just so many things you can so. The original goal of the post was to tamper with zoom's attention tracking for example (which was a field in one of their protobuf payloads).
- userbinator 6y ago
  Proxomitron had that capability years ago - MITM proxy to filter pages and block ads, among other things. I still use it, it's very useful and continues to run fine on the newest Windows.
rndgermandude 6y ago
It's useful to a security researcher or privacy advocate looking into what an application like zoom is actually sending around. It may be also helpful when reverse engineering "proprietary" protocols, e.g. to create compatible clients. It may be even easier to just "mitm" the traffic like this in applications you develop yourself to find out what going on deeply buried in some third party library. Easier than modifying the code or attaching a normal debugger. There are plenty of legitimate uses.

setheron 6y ago

Something like this needs to be included in tcpdump or Wirshark. (tcpdump would be fitting; since it was the genesis for cBPF) I remember patching Netty https://github.com/netty/netty/pull/8653 https://github.com/netty/netty/pull/8653 just to get the master key in order to decrypt sessions. Having the ability to decrypt TLS sessions like this is way simpler. tl;dr; would love to see something like this for tshark / tcpdump

shawnz 6y ago
Wireshark does support TLS decryption if you provide a "key log file": https://wiki.wireshark.org/TLS#TLS_Decryption https://wiki.wireshark.org/TLS#TLS_Decryption Perhaps OP's technique could be used to generate such a file. EDIT: I see you have already investigated such methods after looking at your github link.

sillysaurusx 6y ago

But how do we find the offsets? What values do we give to ssl_read_offset and ssl_write_offset? [ REDACTED ] I had a nice little section on how to find the offsets here. When I first wrote it I was convinced that publishing two addresses couldn't possibly get me sued for reverse engineering. Some of the people who read the draft of this post changed my mind about it though, and it is 2020 after all so it is not a good time to be optimistic. So, how would you find these offsets? Anyone know? It's probably the most interesting part of the post. There's a "hypothetical" paragraph afterwards, but if anyone wants to actually do this with Zoom and post the results, you'd probably earn lots of cred. In particular, the exact arguments to the objdump command would help.

jdright 6y ago
It is sad they felt the need to do this. This step is not hard, but censuring it because of hypothetical legal issues speaks a lot about the state of affairs on computing. I miss the good old times where knowledge were freely published without fear.
- deleted 6y ago
  [deleted]
- saagarjha 6y ago
  Do note that this is generally not something that would be a legal issue.
- libpcap 6y ago
  Publish it on 2600 Magazine?
matheusmoreira 6y ago
> Some of the people who read the draft of this post changed my mind about it though Details? Reverse engineering isn't even illegal.
- yconfiscator 6y ago

arn7av 6y ago

I have done exactly the same thing for Desktop/Android apps using Frida (modified from https://github.com/google/ssl_logger https://github.com/google/ssl_logger). There are modules out there that dump SSLKEYLOG too (that can be used in Wireshark)

benmmurphy 6y ago
With IOS I’ve used the keylog strategy and it is very effective. IOS uses boringssl and the library calls a function to log the secret but this function never does anything normally. However, you can either trampoline this function to log the secret or modify the ssl context to add your own logger function. This is all public knowledge and you can find Frida scripts that will dump the TLS secrets.
- heyoni 6y ago
  And this can be used to defeat certificate pinning?
  - heyoni 6y ago
    I just realized you would just be sniffing the data unencrypted rather than setting up any proxy or root cert, so this question doesn't make sense.

procombo 6y ago

Awesome post Alessandro! Well written and in tutorial format. Much respect! I know what I'll be playing around with this weekend. I will be looking forward to more blog posts of yours in the future.

yconfiscator 6y ago
Thank you! Mind I only tested on latest ubuntu and fedora so feel free to DM me on twitter if you run into issues.