Innovations in Network Security — Through SSL/TLS Fingerprinting.

In the relam of cybersecurity, developers and security experts are constantly involved in developing innovative ways to safeguard sensitive information and protect against malicious threat actors. One such method that has gained prominence in recent years is JA3 fingerprint. A fingerprint technology that can assist in producing higher fidelity identification of the encrypted communication between a specific client and its server. Let’s delve into what JA3 fingerprint is, how it works and its significance in enhancing cybersecurity measure.

Before getting into JA3 fingerprint, lets understand what TLS fingerprint is:

Transport Layer Security (TLS), the successor of the now-deprecated Secure Sockets Layer (SSL), an encryption-based security protocol, ensuring a secure transmission of data over internet. Which performs a primary purpose in establishing a secure and encrypted connection between a user’s web browser (client) and a webserver.

Before TLS can be used in communication, the client and server agree on conversation’s encryption algorithm and cryptographic keys. This agreement is made through a TLS handshake. More about TLS handshake is written in one of my previous articles please refer. **Understanding TLS : An encryption based security protocol (Part 2)**

TLS fingerprinting is the identification of a client based on the fields in its Client Hello message during a TLS handshake. Where clients’ first approach would be the hello message, in which they declare the set of TLS parameters it supports. Some of these include:

• The max TLS version it supports.
• A list of cipher suites, that is, the cryptographic algorithm to be used for encryption.
• A list of supported extensions

Client Hello occurring as initial stage of TLS Handshake.

With TLS fingerprinting, TLS library is identified which is used by the client and compare it with what is expected from the library.

Even when client modifies its User-Agent string to display another browser version and operating system, but its Client Hello can sometimes reveal its actual browser version and operating system.

JA3 is an open-source method, used for implementation of TLS Fingerprinting. JA3 was invented at Salesforce in 2017. By John B. Althouse, Jeff Atkinson, Josh Atkins. However, the project is no longer being actively maintained by Salesforce. Its original creator, John Althouse, maintains the latest in TLS client fingerprinting technology at FoxIO-LLC.

How JA3 works?

JA3 gathers the decimal values of the bytes for the following fields from Client hello such as: TLS Version, Ciphers Suits, List of Extensions, Elliptic Curves and Elliptic Curve Formats. It then concatenates those values together in order, using a “,” to delimit each field and a “-” to delimit each value in each field.

The field order is as follows: TLSVersion, Ciphers, Extensions, EllipticCurves, EllipticCurvePointFormats

These strings are then MD5 hashed to produce an easily consumable and shareable 32-character fingerprint.

Every client has a unique fingerprint. Detecting which one is making an HTTPS request can be as simple as matching signatures to a database.

JA3S JA3S is similar as JA3, but it’s the fingerprint from the Server side of the TLS handshake, the TLS server Hello message.

The JA3S method is to gather the decimal values of the bytes for the following fields from Server Hello packet: Version, Cipher Suits, List of Extensions. It then concatenates those values together in order, using a “,” to delimit each field and a “-” to delimit each value in each field.

The field order is as follows: TLSVersion, Cipher, Extensions

These strings are then MD5 hashed to produce an easily consumable and shareable 32-character fingerprint. This is the JA3 SSL Client Fingerprint.

Why was JA3 and JA3S fingerprint strings were hashed to MD5. Even though most advanced encryption algorithms were available ?

The developer of these fingerprints wanted the hash value to be short and easy to be integrated into existing technologies. Even the legacy firewall and technologies can be able to churn out MD5s. Since the given data set is limited, hash collision are never considered as concern.

How do these JA3 fingerprint help in Security analysis?

By combing both JA3 and JA3S methods to fingerprint the TLS negotiation between client and server helps in producing higher fidelity identification of suspicious communication between a specific client and its server.

In an attack scenario the JA3 would be common in the environment and therefore not as useful for detection. This is where JA3S can assist in identifying the malicious communication. For example, Imagine a malicious executable using a Windows socket to initiate TLS communication. These sockets are used by other legitimate applications as well making it hard to identify malicious communications. Whereas the way that the C2 servers of the malware respond to this client application is unique compared to the way normal servers on the internet respond to this socket. So, if we combine JA3 + JA3S, we are then able to identify this malicious communication regardless of destination IP, Domain, or Certificate Details which can constantly be changing based on attack.

JA3 fingerprints are actively used as a bot management tool by Cloudflare for detecting and blocking bot related traffics, and DDOS traffics. We can also create custom rules to control incoming traffic by filtering requests to a zone. We can perform actions like Block or Managed Challenge on incoming requests according to rules defined. Ref: https://developers.cloudflare.com/bots/concepts/ja3-ja4-fingerprint/

JA3 is extensively used to fingerprint, and track-down Malware C&C activities, by making note of suspicious JA3 hashes occurring in the organization based on NDR logs, domain Abuse.ch contains the collection of malicious JA3 fingerprints which helps in analysis and block the well known malicious fingerprints as IOC’s.

JARM

JARM is an active TLS, Server fingerprinting tool. Which is developed and open sourced by Salesforce. JARM scans helps in providing the ability to identify and group of malicious servers on the Internet.

The fingerprints, from JARM is utilized to efficiently ascertain uniform TLS configurations among desperate servers, categorize them by organizational affiliation, also for identifying potential malware command and control infrastructure and other malicious entities across the internet.

JARM can be downloaded from here

JARM search

How does JARM work?

JARM works by actively sending 10 TLS Client Hello packets to a target TLS server and capturing specific attributes of the TLS Server Hello responses. The aggregated TLS server responses are then hashed in a specific way to produce the JARM fingerprint.

JARM fingerprint hash uses the combination of a reversible and non-reversible hash algorithm to produce a 62-character fingerprint. The first 30 characters are made up of the cipher and TLS version chosen by the server for each of the 10-client hellos sent. A “000” denotes that the server refused to negotiate with that client hello. The remaining 32 characters are a truncated SHA256 hash of the cumulative extensions sent by the server, ignoring x509 certificate data. When comparing JARM fingerprints, if the first 30 characters are the same but the last 32 are different, this would mean that the servers have very similar configurations, accepting the same versions and ciphers, though not the same given the extensions are different.

We can identify servers using JARM fingerprint, specially the C2 servers involved in malicious activity.

JA3 and JARM.

JA3 and JA3S listens to network traffic and passively fingerprints TLS client and server based on the connection occurring between client and server. JA3S is not much indeed helpful in fingerprinting the server application. Where as JARM actively scans the server and builds a fingerprint of the server application by actively probing the target. And helps to build a fingerprint of the server application where JA3S could not.

JA4+

JA4+ is a successor of JA3 fingerprint, developed by John Althouse one member among JA3 developer trio. This is an open-source fingerprinting tool.

JA4+ is a modular network fingerprints which are easy to use and share, fingerprints are easily understood and readable by both human and machines. These fingerprints are helpful by involving in activities such as scanning for threat actors, malware detection, session hijacking prevention, compliance automation, location tracking, DDoS detection, grouping of threat actors, reverse shell detection, and many more.

JA4+ is a collection of multiple fingerprints, uses different methods for every implementation. Some of the current available methods and implementations are:

JA4: It’s a client-based fingerprint which analyses TLS Client Hello packet and builds out an easily understandable and shareable fingerprint.

JA4S: TLS server fingerprint, once the client hello is received by the server the server responds with a Server hello packet which are formulated and sent based on options provided in client hello.

JA4H: HTTP client fingerprints, which are based on each HTTP request. JA4H is best utilized on servers, proxies, WAFs, TLS terminating load balancers, and environments where TLS is decrypted. Also, with environments where TLS is not decrypted.

JA4L: These fingerprint measures the distance between a client and a server by looking at the latency between the first few packets in a connection. JA4L is running server side, will measure the distance of the client from the server and if this is running client side, this will measure the distance of the server from the client. If this is running on a network tap, it will measure the distance of each from the network tap location.

JA4X: X509 TLS Certificate Fingerprinting, fingerprints the way in which TLS certificates are generated — not the values within the certificate. This can identify applications and settings used to create the certificate which can be extremely useful in threat hunting as threat actors will create different certificates but tend to use the same methods to create said certificates, thereby having the same JA4X fingerprint.

JA4SSH: SSH session fingerprinting, by looking at SSH packets and providing a small, simple, easy-to-read fingerprint of the session on a configurable rolling basis, every 200 packets by default. With this, we can determine what is happening within the SSH connection, even though the traffic is encrypted, and provide an analyst with a simple set of fingerprints for their analysis.

These are some of the fingerprinting, currently available under JA4+ collection and some are still getting developed and updated by developer in near future.

The JA4+ are still being familiarized within the organizations, and not as commonly found as it’s older version JA3 which can be found more commonly, as JA3 has been around longer and more established. JA4+ provides more holistic view of network activity by incorporating multiple protocols. However, the prevalence of each may vary depending on specific network environment and security requirements.

Whereas, when it comes to utilizing JA3 fingerprint, we cannot totally depend our investigations upon these fingerprints and also require looking into other IOC’s as well in an attack scenario, as these JA3 fingerprints can also be impersonated which are sent by the TLS application. Organization CU-Cyber has explained well how these JA3 fingerprint are impersonated using their tool ja3transport.

Conclusion:

In the emerging threat world, most attacks are defenced and evaded based on IOC’s and threat intel tools developed. In which TLS fingerprint-based analysis is also one among them, where we conduct our investigation from the base client and server application tool level to identify this malicious communication regardless of destination IP, Domain, or Certificate Details which can constantly be changing based on attack scenario.

I thank you all who spent there valuable time in going through this article and found useful.

References for the Article: JA3 & JA3S JARM JA4+

Linkedin : Arunkumar P P