5 ms·

Easily Identify Malicious Servers on the Internet with JARM

48 points by aburan28 6y ago

yabones 6y ago
This appears to be complementary to their other TLS fingerprinting project, JA3. Where JARM quickly scans servers for TLS configuration, JA3 sniffs network traffic to fingerprint client/server TLS handshakes. I wonder what research is happening at Salesforce to create these byproducts.
dzhiurgis 6y ago
> Moving from reactive to proactive cybersecurity blocklists. Well that might explain why once a year Salesforce randomly stops working with some server and of course support being so useless we just move server. 1 month later we get message “ah yeah that was us”. But that was pleasant read. Wonder if anyone ever tried to scan entire ipv6
- amarshall 6y ago
  > Wonder if anyone ever tried to scan entire ipv6 ZMap can scan IPv4 on a 10Gb uplink in ~ 5 minutes. Some napkin math, then: (2^128 / 2^32) × 5 minute ≈ 7.5×10^23 years. So my guess would be: probably not.
  - balgan 6y ago
    Deffo not as large parts of it isnt even used. Current techniques involve building lists of active ranges and focusing the scan on those.
    - sitkack 6y ago
      Isn't the routing table flat? Shouldn't there just be a big list of all global active IPs?
mixologic 6y ago
seems like its only a matter of time then that malicious servers wrap their TLS libs in a one time randomizer that gives them the appearance of not matching other C&C hosts.
- easterncalculus 6y ago
  It's a cat and mouse game. At the same time, though, it means that botnet operators (provided that they don't roll their own crypto) have to engage in that much more effort to keep their C2 infrastructure secret. That's a win for security teams, and it's definitely more effort on the attacker's part than it is on the defender's.
theideaofcoffee 6y ago
I'm wary of relying on the response from unknown hosts on a messy, adversarial network like the internet, even if I'm hoping to catalog some as malicious. There really is no reason why I should expect well- and consistently-ordered responses against which I can fingerprint. Adjusting the underlying libraries to generate a randomized list of acceptable ciphers, or to randomize any other data that program is using to build this fingerprint is trivial. Putting aside the adversarial case, I can imagine even well intentioned networks with, say, anycasted addresses munging this up as well. I can give you one IP address but six, 11, 91 or however many different responses if I so choose. Which response is the 'correct' one? Are you going to ban entire blocks of addresses because one happened to match a known C&C host?

48 points by aburan28 6y ago

This appears to be complementary to their other TLS fingerprinting project, JA3. Where JARM quickly scans servers for TLS configuration, JA3 sniffs network traffic to fingerprint client/server TLS handshakes. I wonder what research is happening at Salesforce to create these byproducts.

dzhiurgis 6y ago

> Moving from reactive to proactive cybersecurity blocklists. Well that might explain why once a year Salesforce randomly stops working with some server and of course support being so useless we just move server. 1 month later we get message “ah yeah that was us”. But that was pleasant read. Wonder if anyone ever tried to scan entire ipv6

amarshall 6y ago
> Wonder if anyone ever tried to scan entire ipv6 ZMap can scan IPv4 on a 10Gb uplink in ~ 5 minutes. Some napkin math, then: (2^128 / 2^32) × 5 minute ≈ 7.5×10^23 years. So my guess would be: probably not.
- balgan 6y ago
  Deffo not as large parts of it isnt even used. Current techniques involve building lists of active ranges and focusing the scan on those.
  - sitkack 6y ago
    Isn't the routing table flat? Shouldn't there just be a big list of all global active IPs?

mixologic 6y ago

seems like its only a matter of time then that malicious servers wrap their TLS libs in a one time randomizer that gives them the appearance of not matching other C&C hosts.

easterncalculus 6y ago
It's a cat and mouse game. At the same time, though, it means that botnet operators (provided that they don't roll their own crypto) have to engage in that much more effort to keep their C2 infrastructure secret. That's a win for security teams, and it's definitely more effort on the attacker's part than it is on the defender's.

theideaofcoffee 6y ago

I'm wary of relying on the response from unknown hosts on a messy, adversarial network like the internet, even if I'm hoping to catalog some as malicious. There really is no reason why I should expect well- and consistently-ordered responses against which I can fingerprint. Adjusting the underlying libraries to generate a randomized list of acceptable ciphers, or to randomize any other data that program is using to build this fingerprint is trivial. Putting aside the adversarial case, I can imagine even well intentioned networks with, say, anycasted addresses munging this up as well. I can give you one IP address but six, 11, 91 or however many different responses if I so choose. Which response is the 'correct' one? Are you going to ban entire blocks of addresses because one happened to match a known C&C host?