Visibility Solutions

Garland Technology is committed to educating the benefits of having a strong foundation of network visibility and access. By providing this insight we protect the security of data across your network and beyond.

Resources

Garland Technology's resource library offers free use of white papers, eBooks, use cases, infographics, data sheets, video demos and more.

Blog

The TAP into Technology blog provides the latest news and insights on network access and visibility, including: network security, network monitoring and appliance connectivity and guest blogs from Industry experts and technology partners

Partners

Our extensive technology partnership ecosystem solves critical problems when it comes to network security, monitoring, application analysis, forensics and packet inspection.

Company

Garland Technology is dedicated to high standards in quality and reliability, while delivering the greatest economical solutions for enterprise, service providers, and government agencies worldwide.

Contact

Whether you are ready to make a network TAP your foundation of visibility or just have questions, please contact us. Ask us about the Garland Difference!

Blogheader image

TAP Into Technology

Leading the Way in Network Technology

Detecting Fake SSL Sessions as Part of C&C Activity

Posted by Jim Curtin | 12/13/16 8:00 AM

One of the best ways to learn how to protect against malware is to learn how to detect malware traffic. Towards this end, we are constantly searching the Internet for as many types of malware pcaps as we can find.

This blog focuses on the use of a fake SSL session where the TCP session starts with an SSL handshake but doesn’t actually do the handshake – it is a fake.

We will also show in this blog how to detect this type of fake SSL using the powerful yet flexible pcap analytics.

Join me in this deep dive...

A research group in the Czech Technical University in Prague has published a relevant and interesting list of malware pcap files. While studying this pcap file, a specific SSL session caught my eye. While a typical SSL handshake sequence starts with the client side sending CLIENT_HELLO message and the server side sending the messages SERVR_HELLO, CERTIFICATE, SERVER_HELLO_DONE, I did not see any sign of the SERVER_HELLO or CERTIFICATE messages in the following pcap:

Hello Server pcap file

While it is true that a Server CERTIFICATE message could be so big that is spans over 1 or 2 packets, I have never seen a server side message so big that it could span over at least 8 1514-byte TCP data frames! My curiosity lead me to examine the TCP data of the first server data packet (see the highlighted part in the following):

TCP data of the first server data packet


This data is by no ways an SSL message, which has a very well-defined structure. A typical such response would start with something like (all hex):  22 03 01 00 51. The “01” and “00 51” may change slightly due to the version and the actual length, but it's clear that the server response in the pcap (highlighted part in the above snapshot) is not an SSL message.

This is not surprising, since we should be anticipating malware traffic in such samples, but it is still very interesting to see this “new” method of evasion being employed in C&C communications. 

So, how do we detect this evasion automatically? The idea is simple: if the first data packet from the server side doesn't begin with bytes 0x22 and 0x03 on a connection to port 443 (the standard SSL port), there is something suspicious. The challenge is how to implement this simple idea. If someone plans on using Wireshark to do the search/detection, he/she will immediately run into the problem of specifying the first data packet from the server side. Wireshark does not support stateful packet searching, which is required in the logic for this simple technique. Fortunately, CapStar Packet Analyzer (CPA) is designed from the start to support stateful search and is, in fact, the perfect tool for this. 

The following is a simple analytic that can perform this logic and find these fake SSL sessions:

int marked;

data:
    if (!tcp) return 0;
    if (session.serverPort != 443) return 0;
    if (session.marked) return 0;
    if (side == SERVER) {
        if (len < 2) {
            session.marked = 2;
        } else if (data[0] != 0x16 && data[1] != 3) {
            session.marked = 1;
            return 1;
        } else
            session.marked = 2;
    }

 The output shows that there 3 such fake SSL sessions:

Fake SSL Sessions.png

In the above analytic, we use the per-session variable “marked” to indicate when a session is marked. By default, it is 0. If we encounter a server data packet that is the first server data packet for this session, we will check whether the first two bytes are as specified. Regardless, we set the value of this variable (session.marked) so we will know not to bother analyzing other packets in this session.

CPA not only has the most flexibility when it comes to performing complex packet analysis and search, but it also performs these actions very fast. CapStar can chew through 1GB of pcap data in a second, making it easier for an investigator to quickly test out various ideas. This speed and flexibility can greatly improve the productivity of a security investigation where the investigator will never need to worry about the following dilemma facing many talented investigators: "Should I spend the next 2 hours writing a script to do the search for a complex, potentially promising pattern, knowing that the result may not be interesting and I may end up wasting the 2 hours?"

In this blog, we provide a detailed explanation of how to automatically detect a fake SSL session with CPA. If you want to know more about the capacity and power of CPA when it comes to analyze huge pcaps, or if you would like to have a demo, or try an evaluation, please don’t hesitate to send us a note at info@capstarforensics.com.

Topics: Network Security, Technology Partners

Written by Jim Curtin

Jim Curtin is the Co-Founder and CEO of CapStar Forensics, based in Austin, Texas. Jim has spent most of his career in the high-tech field, initially in finance and then in management. After his apprenticeship at Digital Equipment Corporation,he jumped into start-ups and small companies to introduce new infrastructure offerings and take them to larger companies and their established distribution infrastructures. Jim's goals are to keep the evolution of IT moving towards openness and efficiency, helping to drive the value-add higher and higher in the software stack while providing measurable success for customers, shareholders and employees.

Sign up for blog updates