Capturing Linux SSL/TLS plaintext without a CA certificate using eBPF

https://github.com/gojue/ecapture

by walterbell • 2 years ago

183 70 2 years ago

github.com

Brian_K_White2• 2 years ago

2022 https://news.ycombinator.com/item?id=33826131

walterbell• 2 years ago

Latest release: 2024-07-09

changelog: https://github.com/gojue/ecapture/blob/master/CHANGELOG.md

gtirloni2• 2 years ago

nice one comment thread.

Brian_K_White2• 2 years ago

Zero comment thread, since the only comment was the submitter. That was my point.

I figured the reason it wasn't interesting the first time was something like "Are you telling me that a kernel, and anyone with root access to that kernel, can ultimately know everything a kernel does? Shocking!"

evanjrowley• 2 years ago

Gigamon offers a capability they call Precryption which functions the same under the hood, but also with a centralized interface: https://www.gigamon.com/campaigns/precryption.html

bnjms• 2 years ago

Gigamon products consistently creep me out. Pretty sure they’re mostly good to great, but they always make me think panopticon.

p1mrx• 2 years ago

Note: Need ROOT permission.

cpach• 2 years ago

What is the use case for this? Learning more about how Android apps communicate with their home server?

jcrawfordor• 2 years ago

Very useful for reverse engineering and security auditing of internal APIs. Particularly on Android a lot of apps pin CA certs or use their own trust store, so you have to do a little RE on them to insert your own cert... Or do it this way.

mschuster912• 2 years ago

Unfortunately that requires root, and SDKs have gotten incredibly good at detecting root - not to mention SafetyNet Attestation.

For a full bypass of that crap, you nowadays need a lot of resources including a Secure Enclave exploit - for now they're (relatively) cheap but eventually they'll be the kind of stuff traded for seven figures a pop.

Eternal shame on Google for not insisting that Android would follow the "PC model" of the user being root on their own machine and DRM and whatnot can go and screw themselves. They had the chance of actually delivering something that would not require jailbreaking and cat-and-mouse games like iOS, but they blew it (and blew the MAFIAA instead).

justahuman74• 2 years ago

Inspecting what apps are sending out when they don't want you to see

hawski• 2 years ago

Just today I thought about a hypothetical strace analog for web requests. Something that could trace all the HTTPS requests a program makes without playing around with certificates.

xyzzy_plugh• 2 years ago

You can already do this with eBPF.

rocqua7• 2 years ago

Interception for regulated companies. Banks have to keep a log of all communication between their employees.

That requires HTTPS interception. Before TLS1.3 they would install root CAs on all company devices, have an edge proxy, and use SNI to determine whether an HTTPS session should be man in the middled. Because it would take way to much compute to MitM all trafic (like YouTube video).

After TLS1.3 encrypted SNI blocks this. But they still need (and other companies want) to selectively intercept HTTPS. With a tool like this you can achieve that clientside, rather than at the network edge.

new23d• 2 years ago

TLS 1.3 and ESNI (now called Encrypted Client Hello - ECH) are separate standards, although you'll see ECH only enabled in bleeding edge stacks. In fact, ECH is still in IETF draft phase [1].

It can be disabled if an organisation wishes to. I wrote about how to do this in Chrome [2,3], and will write about Firefox when I get a chance.

[1] https://datatracker.ietf.org/doc/draft-ietf-tls-esni/ [2] https://chasersystems.com/blog/disabling-encrypted-clienthel... [3] https://news.ycombinator.com/item?id=37823262

jcelerier• 2 years ago

In which country is this ? In France the law is pretty clear :

L’employeur ne peut pas mettre en place un dispositif d’écoute ou d’enregistrement permanent ou systématique, sauf texte légal (par exemple pour les services d’urgence).

And there's afaik no such legal text for banks.

Employees also have the right to privacy on their work-provided computer (e.g. to check their personal mails) so all those packet inspection and decryption things would be flat-out illegal there, thankfully

egberts13• 2 years ago

Note to Linus: We have to be able to compile out this eBPF kernel config option, like completely.

fragmede• 2 years ago

I believe that's CONFIG_BPF

egberts13• 2 years ago

It gets flipped on under most settings if you try to disable it, notably by nftables.

wmf• 2 years ago

If eBPF is disabled you can use other debugging facilities.

A1kmm• 2 years ago

Note that despite the headline, the feature actually used here is kprobe and uprobe (which use eBPF to collect data using eBPF every time an event, such as passing a certain point in code, is executed - allowing for hooking of functions and extraction of data). You can turn them off with CONFIG_KPROBE_EVENTS=n and CONFIG_UPROBE_EVENTS=n.

That said, there are other ways to do similar probing: - Loading kernel modules. - Using ptrace. - Using LD_PRELOAD against a dynamic binary.

brendangregg• 2 years ago

Right; disabling eBPF doesn't solve this. And the bigger point is that this kind of eBPF is still super-user only.

Apart from the more exotic facilities, the critical facilities that would be hard to disable include LD_PRELOAD for interposers/shims (as you mentioned), and gdb for just setting breakpoints on crypto functions. And if neither of those existed, then I may have to edit openssl code and recompile my own edited version. And if that wasn't allowed (signed libraries) then maybe I'd edit the application code or binaries.

the_clarence• 2 years ago

What is the point of eBPF? It seems like it can really do anything

jfoutz• 2 years ago

I've not used it in anger, so take it with a grain of salt.

it sorta gives you a kernel space VM. you can inspect the state of things, make decisions about that state, and react to those things.

for example, you could look at uri requests coming into your web server. if it's not a known good path, reply back with a canned 400 - without ever hitting the web server. you can do this in the kernel.

_edit_ I think this particular trick would only work with http. the web server still has all the glue to decrypt the incoming request - but you could probably hook into ebpf at that point.

chatmasta• 2 years ago

Maybe you could do this with HTTPS if you’re using Kernel TLS offloading?

tptacek2• 2 years ago

Deep instrumentation of running binaries, especially the kernel, and packet manipulation.

SEJeff• 2 years ago

Let’s not forget syscall filtering. Using custom eBPF for what is in effect a syscall firewall is something my coworkers did for one of our clients and it’s really slick. It’s like super seccomp.

rocqua7• 2 years ago

It is guaranteed to terminate execution, making it Possible to run in the Kernel without threat of an indefinite hang.

XorNot2• 2 years ago

This is one of those things I think should be wrapped up and made more capable for the typical Linux user (so, more like a typical HN user I suppose).

Because IMO, what my PC is doing and sending over the network at all times should be inspectable by me, on that computer.

bigiain• 2 years ago

Have you seen OpenSnitch? https://github.com/evilsocket/opensnitch

It's a Linux project that's replication what Little Snitch does on macOS - it doesn't decrypt TLS secured data but it does show and allow blocking of network connections (even if it can't see exactly what's going on inside this connections).

Combining eCapture features with OpenSnitch would be awesome. It'd be great if as well as tracking all network connection, you could flag connections sending specific data (like your name, email address, or phone number) to unexpected servers.

userbinator• 2 years ago

Not sure why it mentions or needs eBPF or anything kernel-side; this is already possible with just OpenSSL/etc. shim libraries.

Brybry• 2 years ago

Aren't there cases where shim libraries/LD_PRELOAD won't work, like statically linked binaries?

So if this works there it might be useful in, for example, analyzing encrypted video traffic for some video games.

ranger_danger2• 2 years ago

You don't have to modify or restart any applications, it works globally and at runtime without interrupting existing processes.

Retr0id• 2 years ago

They mention golang, which uses static binaries, meaning you can't LD_PRELOAD it.

ranger_danger2• 2 years ago

Similar tools already available in many distros:

https://github.com/bpftrace/bpftrace/blob/master/tools/sslsn...

https://github.com/iovisor/bcc/blob/master/tools/sslsniff.py

https://embracethered.com/blog/posts/2021/offensive-bpf-snif...

On Ubuntu for example I can just "sudo apt install bpfcc-tools", then run "sudo sslsniff-bpfcc" and see curl TLS traffic right away.

_3u102• 2 years ago

Yes, but most of them don't output pcap. Its just sort of every bit of decrypted data. Sure it works well for curl, but for nginx, or multiple connections, not so much.

danobi• 2 years ago

bpftrace has support for outputting pcap files now.

_3u102• 2 years ago

Not sure if this supports TLS3 / perfect forward secrecy. If not lmk, I've written similar code to decrypt PFS in a pcap compatible way.

If you need k8s support I can also help with that, if you get CAP_SYS_ADMIN you can break out of the container and then back into every other container ;)

k__5• 2 years ago

Half-OT

Is there any way to account a response of a TLS enabled server to it's public key?

Something like reverse fingerprinting?

fweimer3• 2 years ago

Do you mean that you can prove to a third party that a TLS transcript is accurate? Then the answer is no. TLS authenticates application data with a symmetric algorithm based on a negotiated secret. To verify authenticity, you need to disclose that secret, but you can also use the secret to authenticate a made-up application data stream. I think it's still possible to prove that a decryption is correct if everyone agrees that the ciphertext is genuine, but that's the extent of it.

k__5• 2 years ago

I feared so, thanks.

I was hoping responses were signed.

rocqua7• 2 years ago

It is technically possible to verify the authenticity of a TLS transcript without disclosing the secret key. You would need a zero knowledge proof. Where you prove that you know a key that is consistent with the TLS handshake and that is consistent with the symmetric part of TLS.

If the cipher suite used has authenticity in the symmetric part, that proof would be enough.

There are no implementations of this to my knowledge, and all the general zero knowledge proof caveats of speed, proof-size, etc all still apply.

It is definitely possible though. It would be cool to make. Why would anyone need this though?

w3ll_w3ll_w3ll• 2 years ago

have a look at this https://tlsnotary.org/

wolf550e• 2 years ago

https://security.stackexchange.com/a/231019/70830

1vuio0pswjnm7• 2 years ago

This requires Linux and an uncommon(?) kernel config/module. Further, it does not seem to offer a facility for modifying traffic.

I use a localhost-bound TLS forward proxy. Works on both BSD and Linux, kernel config is irrelevant. Allows me to easily redirect and modify traffic.

ECH is still lagging in server adoption. After Cloudflare discontinued their ESNI trial I have avoided sites that require SNI, e.g., ones using Cloudflare. What I have found is that most websites on the internet still do not require it. The sites that use a handful of large, popular CDNs are the exceptions. There are numerous workarounds for those, e.g., archive.org needs no SNI. Allows me to access Cloudflare sites without sending SNI.

As for certificate pinning, I do not use closed source "apps".

If corporations MITM their TLS traffic then individuals should do the same.

SushiHippie• 2 years ago

This requires Linux and an uncommon kernel config/module.

Works for me on a Debian 12 installation with the default kernel.

PeterZaitsev• 2 years ago

What is the fuss about ? Of course if you have root access you have access to any process memory and also can intercept communication before encryption takes place.

We use similar approach in Coroot to get fantastic observability insights with zero configuration

Capturing Linux SSL/TLS plaintext without a CA certificate using eBPF

Related Stories