New Method to Establish Covert Channel Communication by Abusing X.509 Digital Certificates

Security researchers from Fidelis identified a new method to establish a covert channel communication by abusing widely implemented X.509 public key certificates. Certificates remain as a critical component of secure connection to a website.

When a browser establishes a secure connection to a site, it checks that the server has the private key for the certificate it’s trying to use, this is no one can use our certificate.

A TLS X.509 certificate would have many fields Version, signature algorithm, Validity, subject and so on. Data transferred within X.509 extension can bypass the detection methods, attackers could take it as an advantage to hide data in any one of these fields.

Also Read Bypassing and Disabling SSL Pinning on Android to Perform Man-in-the-Middle Attack

The covert channel is not a new one, history reveals various publications, there are methods to exfiltrate data by using ICMP shell, yes PING as great convert channel to get victim shell access using ICMP Shell.

Jason from Fidelis describes a system that could be used to send or receive data from both a client and a server perspective utilizing research into X.509 certificates specifically in areas where you can place arbitrary binary data into the certificate or utilizing them as a covert channel. The research demonstrates that a sufficiently motivated attacker can utilize technologies outside of their intended purposes to not only accomplish their goals but also end up bypassing common security measures in the process.

Researchers published a PoC explaining the malicious binary could be transferred over TLS traffic that stimulates the malware that already installed in the system.

Mitigations

Researchers suggested mitigations and the detection are possible by creating YARA and Suricata rule by pivoting SSL handshake to detect unexpected extensions and large octet lengths.

Due to widespread of X.509 certificates, most of the organizations are open to attack, disabling the self-signed as like in the PoC could be an effective security measure.

Gurubaran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

Threat Actors Manipulate Search Results to Lure Users to Malicious Websites

Cybercriminals are increasingly exploiting search engine optimization (SEO) techniques and paid advertisements to manipulate search…

22 hours ago

Hackers Imitate Google Chrome Install Page on Google Play to Distribute Android Malware

Cybersecurity experts have unearthed an intricate cyber campaign that leverages deceptive websites posing as the…

22 hours ago

Dangling DNS Attack Allows Hackers to Take Over Organization’s Subdomain

Hackers are exploiting what's known as "Dangling DNS" records to take over corporate subdomains, posing…

22 hours ago

HelloKitty Ransomware Returns, Launching Attacks on Windows, Linux, and ESXi Environments

Security researchers and cybersecurity experts have recently uncovered new variants of the notorious HelloKitty ransomware,…

22 hours ago

RansomHub Ransomware Group Hits 84 Organizations as New Threat Actors Emerge

The RansomHub ransomware group has emerged as a significant danger, targeting a wide array of…

22 hours ago

Threat Actors Leverage Email Bombing to Evade Security Tools and Conceal Malicious Activity

Threat actors are increasingly using email bombing to bypass security protocols and facilitate further malicious…

2 days ago