DissecTLS: A Scalable Active Scanner for TLS Server Configurations, Capabilities, and TLS Fingerprinting

Sosnowski, Markus; Zirngibl, Johannes; Sattler, Patrick; Carle, Georg

doi:10.1007/978-3-031-28486-1_6

2023

Zurück
Zurück zum Anfang der Trefferliste
Dauerhafter Link zum angezeigten Objekt

Titel:: DissecTLS: A Scalable Active Scanner for TLS Server Configurations, Capabilities, and TLS Fingerprinting
Dokumenttyp:: Konferenzbeitrag
Autor(en):: Sosnowski, Markus; Zirngibl, Johannes; Sattler, Patrick; Carle, Georg
Abstract:: Collecting metadata from Transport Layer Security (TLS) servers on a large scale allows to draw conclusions about their capabilities and configuration. This provides not only insights into the Internet but it enables use cases like detecting malicious Command and Control (C &C) servers. However, active scanners can only observe and interpret the behavior of TLS servers, the underlying configuration and implementation causing the behavior remains hidden. Existing approaches struggle between resource intensive scans that can reconstruct this data and light-weight fingerprinting approaches that aim to differentiate servers without making any assumptions about their inner working. With this work we propose DissecTLS, an active TLS scanner that is both light-weight enough to be used for Internet measurements and able to reconstruct the configuration and capabilities of the TLS stack. This was achieved by modeling the parameters of the TLS stack and derive an active scan that dynamically creates scanning probes based on the model and the previous responses from the server. We provide a comparison of five active TLS scanning and fingerprinting approaches in a local testbed and on toplist targets. We conducted a measurement study over nine weeks to fingerprint C &C servers and analyzed popular and deprecated TLS parameter usage. Similar to related work, the fingerprinting achieved a maximum precision of 99 % for a conservative detection threshold of 100 %; and at the same time, we improved the recall by a factor of 2.8.
Herausgeber:: Brunstrom, Anna; Flores, Marcel; Fiore, Marco
Kongress- / Buchtitel:: Passive and Active Measurement
Verlag / Institution:: Springer Nature Switzerland
Jahr:: 2023
Monat:: March
Seiten:: 110–126
Print-ISBN:: 978-3-031-28486-1
Volltext / DOI:: doi:10.1007/978-3-031-28486-1_6
BibTeX

Vorkommen:

mediaTUM Gesamtbestand Einrichtungen Schools TUM School of Computation, Information and Technology Departments Computer Engineering Informatik 8 - Lehrstuhl für Netzarchitekturen und Netzdienste (Prof. Carle)2023

mediaTUM Gesamtbestand Hochschulbibliographie 2023 Schools und Fakultäten TUM School of Computation, Information and Technology Informatik 8 - Lehrstuhl für Netzarchitekturen und Netzdienste (Prof. Carle)