publications

2022

1. TMA 2022

   Active TLS Stack Fingerprinting: Characterizing TLS Server Deployments at Scale

   Sosnowski, Markus, Zirngibl, Johannes, Sattler, Patrick, Carle, Georg, Grohnfeldt, Claas, Russo, Michele, and Sgandurra, Daniele

   In Proc. Network Traffic Measurement and Analysis Conference (TMA) Jun 2022 *Best Paper Award*

   Abs Bib PDF Website

   Active measurements can be used to collect server characteristics on a large scale. This kind of metadata can help discovering hidden relations and commonalities among server deployments offering new possibilities to cluster and classify them. As an example, identifying a previously-unknown cybercriminal infrastructures can be a valuable source for cyber-threat intelligence. We propose herein an active measurement-based methodology for acquiring Transport Layer Security (TLS) metadata from servers and leverage it for their fingerprinting. Our fingerprints capture the characteristic behavior of the TLS stack primarily caused by the implementation, configuration, and hardware support of the underlying server. Using an empirical optimization strategy that maximizes information gain from every handshake to minimize measurement costs, we generated 10 general-purpose Client Hellos used as scanning probes to create a large database of TLS configurations used for classifying servers. We fingerprinted 28 million servers from the Alexa and Majestic toplists and two Command and Control (C2) blocklists over a period of 30 weeks with weekly snapshots as foundation for two long-term case studies: classification of Content Delivery Network and C2 servers. The proposed methodology shows a precision of more than 99 % and enables a stable identification of new servers over time. This study describes a new opportunity for active measurements to provide valuable insights into the Internet that can be used in security-relevant use cases.

   @inproceedings{sosnowski2022tlsfingerprinting,
     author = {Sosnowski, Markus and Zirngibl, Johannes and Sattler, Patrick and Carle, Georg and Grohnfeldt, Claas and Russo, Michele and Sgandurra, Daniele},
     title = {{Active TLS Stack Fingerprinting: Characterizing TLS Server Deployments at Scale}},
     booktitle = {Proc. Network Traffic Measurement and Analysis Conference (TMA)},
     year = {2022},
     month = jun,
   }

2023

1. PAM 2023

   DissecTLS: A Scalable Active Scanner for TLS Server Configurations, Capabilities, and TLS Fingerprinting

   Sosnowski, Markus, Zirngibl, Johannes, Sattler, Patrick, and Carle, Georg

   In Proc. Passive and Active Measurement (PAM) Jun 2023

   Abs Bib PDF Website

   Collecting metadata from Transport Layer Security (TLS) servers on a large scale allows to draw conclusions about their capabilities and configuration. This provides not only insights into the Internet but it enables use cases like detecting malicious Command and Control (C &C) servers. However, active scanners can only observe and interpret the behavior of TLS servers, the underlying configuration and implementation causing the behavior remains hidden. Existing approaches struggle between resource intensive scans that can reconstruct this data and light-weight fingerprinting approaches that aim to differentiate servers without making any assumptions about their inner working. With this work we propose DissecTLS, an active TLS scanner that is both light-weight enough to be used for Internet measurements and able to reconstruct the configuration and capabilities of the TLS stack. This was achieved by modeling the parameters of the TLS stack and derive an active scan that dynamically creates scanning probes based on the model and the previous responses from the server. We provide a comparison of five active TLS scanning and fingerprinting approaches in a local testbed and on toplist targets. We conducted a measurement study over nine weeks to fingerprint C &C servers and analyzed popular and deprecated TLS parameter usage. Similar to related work, the fingerprinting achieved a maximum precision of 99 % for a conservative detection threshold of 100 %; and at the same time, we improved the recall by a factor of 2.8.

   @inproceedings{10.1007/978-3-031-28486-1_6,
     author = {Sosnowski, Markus and Zirngibl, Johannes and Sattler, Patrick and Carle, Georg},
     editor = {Brunstrom, Anna and Flores, Marcel and Fiore, Marco},
     title = {{DissecTLS: A Scalable Active Scanner for TLS Server Configurations, Capabilities, and TLS Fingerprinting}},
     booktitle = {Proc. Passive and Active Measurement (PAM)},
     year = {2023},
     publisher = {Springer Nature Switzerland},
     pages = {110--126},
     isbn = {978-3-031-28486-1},
     doi = {10.1007/978-3-031-28486-1_6},
   }