Killed by Proxy: Analyzing Client-end TLS Interception Software - PowerPoint PPT Presentation

NDSS 2016 Presentation, Feb. 22, 2016 Killed by Proxy: Analyzing Client-end TLS Interception Software Xavier de Carné de Carnavalet Mohammad Mannan Madiba Security Research Group at Concordia University, Montreal, Canada X. de Carné de Carnavalet NDSS’16 — Killed by Proxy: Analyzing Client-end TLS Interception Software 1 / 24

What is this talk about? Strong movement by browsers to improve secure connections TLS 1.3 soon? Reports about tools undermining this effort, e.g., SuperFish What about antiviruses? Parental control applications? X. de Carné de Carnavalet NDSS’16 — Killed by Proxy: Analyzing Client-end TLS Interception Software 2 / 24

� � How to intercept/filter TLS traffic? Regular server-authenticated TLS connection: TLS 1.2 Client trusts or one of its issuers X. de Carné de Carnavalet NDSS’16 — Killed by Proxy: Analyzing Client-end TLS Interception Software 3 / 24

� � How to intercept/filter TLS traffic? Intercepted TLS connection by client-end proxy: � � TLS 1.2 TLS 1.0 Client trusts but, where is the private key? X. de Carné de Carnavalet NDSS’16 — Killed by Proxy: Analyzing Client-end TLS Interception Software 4 / 24

� � How to intercept/filter TLS traffic? Intercepted TLS connection by client-end proxy: client-end � � TLS 1.2 TLS 1.0 Client trusts but, where is the private key? Same system! X. de Carné de Carnavalet NDSS’16 — Killed by Proxy: Analyzing Client-end TLS Interception Software 4 / 24

Network appliance vs. client-end software (1/2) TLS filtering by network appliance: Not new, in enterprises 1 Appliances found to be vulnerable by Dell SecureWorks (2012) and 2 CMU CERT (2015) List of “common mistakes” 3 X. de Carné de Carnavalet NDSS’16 — Killed by Proxy: Analyzing Client-end TLS Interception Software 5 / 24

Network appliance vs. client-end software (2/2) TLS filtering by client-end software: Relatively new, e.g., advertisement products 1 Scandal early 2015 because of SuperFish/PrivDog/Komodia 2 Problems: root certificate reuse, no site certificate validation 3 X. de Carné de Carnavalet NDSS’16 — Killed by Proxy: Analyzing Client-end TLS Interception Software 6 / 24

Motivations Antivirus and parental control apps filter TLS connections, 1 shown to be significant Existing TLS test suites not adapted for these proxies 2 Bigger attack surface 3 Pre-installed by OEMs ⇒ millions of users 4 Antivirus = more security? 5 X. de Carné de Carnavalet NDSS’16 — Killed by Proxy: Analyzing Client-end TLS Interception Software 7 / 24

Cannot just uninstall antiviruses Banks sometimes require antiviruses: X. de Carné de Carnavalet NDSS’16 — Killed by Proxy: Analyzing Client-end TLS Interception Software 8 / 24

Contributions X. de Carné de Carnavalet NDSS’16 — Killed by Proxy: Analyzing Client-end TLS Interception Software 9 / 24

Contributions Design a general hybrid framework: adapt existing + custom tests 1 Private key protection 1 Certificate validation 2 Cipher suites & protocols 3 Transparency 4 X. de Carné de Carnavalet NDSS’16 — Killed by Proxy: Analyzing Client-end TLS Interception Software 9 / 24

Contributions Design a general hybrid framework: adapt existing + custom tests 1 Private key protection 1 Certificate validation 2 Cipher suites & protocols 3 Transparency 4 Review 14 {AntiVirus + Parental Control} apps for Windows 2 X. de Carné de Carnavalet NDSS’16 — Killed by Proxy: Analyzing Client-end TLS Interception Software 9 / 24

Contributions Design a general hybrid framework: adapt existing + custom tests 1 Private key protection 1 Certificate validation 2 Cipher suites & protocols 3 Transparency 4 Review 14 {AntiVirus + Parental Control} apps for Windows 2 Found —sometimes major— flaws in all 14 products 3 X. de Carné de Carnavalet NDSS’16 — Killed by Proxy: Analyzing Client-end TLS Interception Software 9 / 24

Analysis Initial list from Wikipedia, AV-comparatives.org, other ad-hoc 1 comparatives: 55 products 14 products, 12 proxies 2 Analyzed in March and August 2015: up to 2 versions/product 3 X. de Carné de Carnavalet NDSS’16 — Killed by Proxy: Analyzing Client-end TLS Interception Software 10 / 24

Framework X. de Carné de Carnavalet NDSS’16 — Killed by Proxy: Analyzing Client-end TLS Interception Software 11 / 24

Threat model Attacker is an active Man-in-the-Middle (MitM). Motivations: Impersonate the server to the client Extract authentication cookies Two types of attacks: Generic MitM: no additional per-user effort 1 Targeted MitM: can launch unprivileged code on the target 2 X. de Carné de Carnavalet NDSS’16 — Killed by Proxy: Analyzing Client-end TLS Interception Software 12 / 24

(1/4) Root certificate and private key X. de Carné de Carnavalet NDSS’16 — Killed by Proxy: Analyzing Client-end TLS Interception Software 13 / 24

(1/4) Root certificate and private key Is the root certificate install-time generated or pre-generated? 1 X. de Carné de Carnavalet NDSS’16 — Killed by Proxy: Analyzing Client-end TLS Interception Software 13 / 24

(1/4) Root certificate and private key Is the root certificate install-time generated or pre-generated? 1 Imported in the OS/browser trusted stores? 2 X. de Carné de Carnavalet NDSS’16 — Killed by Proxy: Analyzing Client-end TLS Interception Software 13 / 24

(1/4) Root certificate and private key Is the root certificate install-time generated or pre-generated? 1 Imported in the OS/browser trusted stores? 2 Period of validity? Removed upon uninstallation? 3 X. de Carné de Carnavalet NDSS’16 — Killed by Proxy: Analyzing Client-end TLS Interception Software 13 / 24

(1/4) Root certificate and private key Is the root certificate install-time generated or pre-generated? 1 Imported in the OS/browser trusted stores? 2 Period of validity? Removed upon uninstallation? 3 Where/how is the private key stored? 4 X. de Carné de Carnavalet NDSS’16 — Killed by Proxy: Analyzing Client-end TLS Interception Software 13 / 24

(1/4) Root certificate and private key Is the root certificate install-time generated or pre-generated? 1 Imported in the OS/browser trusted stores? 2 Period of validity? Removed upon uninstallation? 3 Where/how is the private key stored? 4 Does the proxy accept site certificates signed by its own root cert? 5 X. de Carné de Carnavalet NDSS’16 — Killed by Proxy: Analyzing Client-end TLS Interception Software 13 / 24

(2/4) Site certificate validation X. de Carné de Carnavalet NDSS’16 — Killed by Proxy: Analyzing Client-end TLS Interception Software 14 / 24

(2/4) Site certificate validation Tests with a corpus of “tricky” certificates 1 9 invalid certificates/broken chain of trust MD5, SHA1, RSA512, RSA1024 X. de Carné de Carnavalet NDSS’16 — Killed by Proxy: Analyzing Client-end TLS Interception Software 14 / 24

(2/4) Site certificate validation Tests with a corpus of “tricky” certificates 1 9 invalid certificates/broken chain of trust MD5, SHA1, RSA512, RSA1024 How are errors propagated? 2 X. de Carné de Carnavalet NDSS’16 — Killed by Proxy: Analyzing Client-end TLS Interception Software 14 / 24

(2/4) Site certificate validation Tests with a corpus of “tricky” certificates 1 9 invalid certificates/broken chain of trust MD5, SHA1, RSA512, RSA1024 How are errors propagated? 2 How to make the proxy trust our test root certificate? 3 X. de Carné de Carnavalet NDSS’16 — Killed by Proxy: Analyzing Client-end TLS Interception Software 14 / 24

(2/4) Site certificate validation Tests with a corpus of “tricky” certificates 1 9 invalid certificates/broken chain of trust MD5, SHA1, RSA512, RSA1024 How are errors propagated? 2 How to make the proxy trust our test root certificate? 3 Which CAs does the proxy trust? OS or custom trusted store? 4 X. de Carné de Carnavalet NDSS’16 — Killed by Proxy: Analyzing Client-end TLS Interception Software 14 / 24

(2/4) Site certificate validation Tests with a corpus of “tricky” certificates 1 9 invalid certificates/broken chain of trust MD5, SHA1, RSA512, RSA1024 How are errors propagated? 2 How to make the proxy trust our test root certificate? 3 Which CAs does the proxy trust? OS or custom trusted store? 4 Used some network tricks to avoid caching of certificate 5 Other proposals can extend our tests (e.g., Frankencert) X. de Carné de Carnavalet NDSS’16 — Killed by Proxy: Analyzing Client-end TLS Interception Software 14 / 24

(3/4) Protocol, cipher suites and attacks X. de Carné de Carnavalet NDSS’16 — Killed by Proxy: Analyzing Client-end TLS Interception Software 15 / 24

(3/4) Protocol, cipher suites and attacks Are all domains filtered? All clients (browsers)? All ports? 1 X. de Carné de Carnavalet NDSS’16 — Killed by Proxy: Analyzing Client-end TLS Interception Software 15 / 24

(3/4) Protocol, cipher suites and attacks Are all domains filtered? All clients (browsers)? All ports? 1 What library is the proxy using? 2 X. de Carné de Carnavalet NDSS’16 — Killed by Proxy: Analyzing Client-end TLS Interception Software 15 / 24