Covert Channel by Abusing X509 Extensions
Jason Reaves · viXra · 2018
Malicious actors in the world are using more ingenuity than ever for both data infiltration and exfiltration purposes, also known as command and control communications. In this paper I aim to describe a system that could be used to send or receive data from both a client and a server perspective utilizing research into x509 certificates specifically in areas where you can place arbitrary binary data into the certificate or utilizing them as a covert channel. While lots of attention is given to data infiltration and exfiltration techniques they are commonly done so after they’ve been used in an incident, making this area of cyber security very retroactive in a defensive posture. The aim in presenting this material is to demonstrate that we can take some lessons from the other areas of cyber security research, namely exploitation, and look at potential use cases in how malware authors could utilize technologies outside of their intended purposes to not only accomplish their goals but also end up bypassing common security measures in the process. Doing this sort of research can lead to more advances in defensive security postures by spurring discussions in the community on how a technique either does or doesn’t bypass security measures.