6 ms·
Capturing Linux SSL/TLS plaintext without a CA certificate using eBPF
- efitz 2y ago[flagged]
- deleted 2y ago[deleted]
- Brian_K_White 2y ago2022 https://news.ycombinator.com/item?id=33826131 https://news.ycombinator.com/item?id=33826131
- walterbell 2y agoLatest release: 2024-07-09 changelog: https://github.com/gojue/ecapture/blob/master/CHANGELOG.md https://github.com/gojue/ecapture/blob/master/CHANGELOG.md
- gtirloni 2y agonice one comment thread.
- Brian_K_White 2y agoZero comment thread, since the only comment was the submitter. That was my point. I figured the reason it wasn't interesting the first time was something like "Are you telling me that a kernel, and anyone with root access to that kernel, can ultimately know everything a kernel does? Shocking!"
- freedomben 2y agoMore likely I think, the reason it got no comments was that even great stuff only has about a 20% chance (or worse) of getting traction before it falls off. I love HN, but I see a lot of great posts that never get their signal through the noise.
- gtirloni 2y agoIt doesn't look like they phrased it as being a vulnerability. It's just a useful tool.
- evanjrowley 2y agoGigamon offers a capability they call Precryption which functions the same under the hood, but also with a centralized interface: https://www.gigamon.com/campaigns/precryption.html https://www.gigamon.com/campaigns/precryption.html
- bnjms 2y agoGigamon products consistently creep me out. Pretty sure they’re mostly good to great, but they always make me think panopticon.
- p1mrx 2y ago> Note: Need ROOT permission.
- cpach 2y agoWhat is the use case for this? Learning more about how Android apps communicate with their home server?
- jcrawfordor 2y agoVery useful for reverse engineering and security auditing of internal APIs. Particularly on Android a lot of apps pin CA certs or use their own trust store, so you have to do a little RE on them to insert your own cert... Or do it this way.
- mschuster91 2y agoUnfortunately that requires root, and SDKs have gotten incredibly good at detecting root - not to mention SafetyNet Attestation. For a full bypass of that crap, you nowadays need a lot of resources including a Secure Enclave exploit - for now they're (relatively) cheap but eventually they'll be the kind of stuff traded for seven figures a pop. Eternal shame on Google for not insisting that Android would follow the "PC model" of the user being root on their own machine and DRM and whatnot can go and screw themselves. They had the chance of actually delivering something that would not require jailbreaking and cat-and-mouse games like iOS, but they blew it (and blew the MAFIAA instead).
- kelnos 2y ago> and DRM and whatnot can go and screw themselves The funny thing is that they wouldn't have even needed to take this position. DRM works well enough on (e.g.) Windows to make the various studios more or less happy, and users have "root" on Windows as usual. Ditto for macOS. Hell, DRM works just fine on my Linux desktop install, as much as I despite its existence.
- XorNot 2y agoMy favorite benefit of DRM support has been that Firefox will prompt me "do you want to allow DRM content?" when I visit a news website. Ignoring that or clicking no auto-blocks all the autoplaying videos.
- egberts1 2y agoNote to Linus: We have to be able to compile out this eBPF kernel config option, like completely.
- fragmede 2y agoI believe that's CONFIG_BPF
- egberts1 2y agoIt gets flipped on under most settings if you try to disable it, notably by nftables.
- wmf 2y agoIf eBPF is disabled you can use other debugging facilities.
- A1kmm 2y agoNote that despite the headline, the feature actually used here is kprobe and uprobe (which use eBPF to collect data using eBPF every time an event, such as passing a certain point in code, is executed - allowing for hooking of functions and extraction of data). You can turn them off with CONFIG_KPROBE_EVENTS=n and CONFIG_UPROBE_EVENTS=n. That said, there are other ways to do similar probing: - Loading kernel modules. - Using ptrace. - Using LD_PRELOAD against a dynamic binary.
- brendangregg 2y agoRight; disabling eBPF doesn't solve this. And the bigger point is that this kind of eBPF is still super-user only. Apart from the more exotic facilities, the critical facilities that would be hard to disable include LD_PRELOAD for interposers/shims (as you mentioned), and gdb for just setting breakpoints on crypto functions. And if neither of those existed, then I may have to edit openssl code and recompile my own edited version. And if that wasn't allowed (signed libraries) then maybe I'd edit the application code or binaries.
- the_clarence 2y agoWhat is the point of eBPF? It seems like it can really do anything
- jfoutz 2y agoI've not used it in anger, so take it with a grain of salt. it sorta gives you a kernel space VM. you can inspect the state of things, make decisions about that state, and react to those things. for example, you could look at uri requests coming into your web server. if it's not a known good path, reply back with a canned 400 - without ever hitting the web server. you can do this in the kernel. _edit_ I think this particular trick would only work with http. the web server still has all the glue to decrypt the incoming request - but you could probably hook into ebpf at that point.
- chatmasta 2y agoMaybe you could do this with HTTPS if you’re using Kernel TLS offloading?
- tptacek 2y agoYou can instrument userland binaries with eBPF, so as long as you have probes built for the TLS library your target is using, you're fine.
- Arnavion 2y agoYes, if the server uses kTLS, it'll be easy for such a probe to get the plaintext, because the syscalls themselves will contain the plaintext. It won't have to do TLS library-specific shenanigans to hook userspace functions or extract the key material like this submission does.
- tptacek 2y agoDeep instrumentation of running binaries, especially the kernel, and packet manipulation.
- 2y ago
- XorNot 2y agoThis is one of those things I think should be wrapped up and made more capable for the typical Linux user (so, more like a typical HN user I suppose). Because IMO, what my PC is doing and sending over the network at all times should be inspectable by me, on that computer.
- bigiain 2y agoHave you seen OpenSnitch? https://github.com/evilsocket/opensnitch https://github.com/evilsocket/opensnitch It's a Linux project that's replication what Little Snitch does on macOS - it doesn't decrypt TLS secured data but it does show and allow blocking of network connections (even if it can't see exactly what's going on inside this connections). Combining eCapture features with OpenSnitch would be awesome. It'd be great if as well as tracking all network connection, you could flag connections sending specific data (like your name, email address, or phone number) to unexpected servers.
- deleted 2y ago[deleted]
- userbinator 2y agoNot sure why it mentions or needs eBPF or anything kernel-side; this is already possible with just OpenSSL/etc. shim libraries.
- Brybry 2y agoAren't there cases where shim libraries/LD_PRELOAD won't work, like statically linked binaries? So if this works there it might be useful in, for example, analyzing encrypted video traffic for some video games.
- ranger_danger 2y agoYou don't have to modify or restart any applications, it works globally and at runtime without interrupting existing processes.
- deleted 2y ago[deleted]
- Retr0id 2y agoThey mention golang, which uses static binaries, meaning you can't LD_PRELOAD it.
- ranger_danger 2y agoSimilar tools already available in many distros: https://github.com/bpftrace/bpftrace/blob/master/tools/sslsnoop.bt https://github.com/bpftrace/bpftrace/blob/master/tools/sslsn... https://github.com/iovisor/bcc/blob/master/tools/sslsniff.py https://github.com/iovisor/bcc/blob/master/tools/sslsniff.py https://embracethered.com/blog/posts/2021/offensive-bpf-sniffing-traffic-bpftrace/ https://embracethered.com/blog/posts/2021/offensive-bpf-snif... On Ubuntu for example I can just "sudo apt install bpfcc-tools", then run "sudo sslsniff-bpfcc" and see curl TLS traffic right away.
- _3u10 2y agoNot sure if this supports TLS3 / perfect forward secrecy. If not lmk, I've written similar code to decrypt PFS in a pcap compatible way. If you need k8s support I can also help with that, if you get CAP_SYS_ADMIN you can break out of the container and then back into every other container ;)
- k__ 2y agoHalf-OT Is there any way to account a response of a TLS enabled server to it's public key? Something like reverse fingerprinting?
- fweimer 2y agoDo you mean that you can prove to a third party that a TLS transcript is accurate? Then the answer is no. TLS authenticates application data with a symmetric algorithm based on a negotiated secret. To verify authenticity, you need to disclose that secret, but you can also use the secret to authenticate a made-up application data stream. I think it's still possible to prove that a decryption is correct if everyone agrees that the ciphertext is genuine, but that's the extent of it.
- k__ 2y agoI feared so, thanks. I was hoping responses were signed.
- rocqua 2y agoIt is technically possible to verify the authenticity of a TLS transcript without disclosing the secret key. You would need a zero knowledge proof. Where you prove that you know a key that is consistent with the TLS handshake and that is consistent with the symmetric part of TLS. If the cipher suite used has authenticity in the symmetric part, that proof would be enough. There are no implementations of this to my knowledge, and all the general zero knowledge proof caveats of speed, proof-size, etc all still apply. It is definitely possible though. It would be cool to make. Why would anyone need this though?
- fweimer 2y agoThat's what I meant with a common understanding of what the ciphertext is. I don't think this is possible if all you have is your own recording of the ciphertext, with no proof that it was actually transferred over the wire. This is the typical situation with packet capturing at one endpoint only.
- 2y ago
- 1vuio0pswjnm7 2y agoThis requires Linux and an uncommon(?) kernel config/module. Further, it does not seem to offer a facility for modifying traffic. I use a localhost-bound TLS forward proxy. Works on both BSD and Linux, kernel config is irrelevant. Allows me to easily redirect and modify traffic. ECH is still lagging in server adoption. After Cloudflare discontinued their ESNI trial I have avoided sites that require SNI, e.g., ones using Cloudflare. What I have found is that most websites on the internet still do not require it. The sites that use a handful of large, popular CDNs are the exceptions. There are numerous workarounds for those, e.g., archive.org needs no SNI. Allows me to access Cloudflare sites without sending SNI. As for certificate pinning, I do not use closed source "apps". If corporations MITM their TLS traffic then individuals should do the same.
- SushiHippie 2y ago> This requires Linux and an uncommon kernel config/module. Works for me on a Debian 12 installation with the default kernel.
- PeterZaitsev 2y agoWhat is the fuss about ? Of course if you have root access you have access to any process memory and also can intercept communication before encryption takes place. We use similar approach in Coroot to get fantastic observability insights with zero configuration