HTTPSハニポとFingerprint

2019年3月9日に行われた第6回ハニーポッター技術交流会で発表したLT資料です。

Transcript

1. HTTPS
   Fingerprint @junk_coken
2. 
   • 3(@junk_coken) • HTTP &*/% '
     ($- '   )+",# !. 
3. HTTPS 
   HTTPS  
   (
   )
4. HTTPS
    1.   • DDNS
   OK 2. let’s encrypt   3. Nginx
5. HTTP
   HTTPS  0 200 400 600 800 1000 1200 HTTP HTTPS 2019129201922   1134 60
   
   HTTPS 468
6. Fingerprint
7. Fingerprinting
      ( 
    )   Machine Fingerprint  Fingerprinting
8. Fingerprinting
    Passive fingerprinting •   (
    )
9. Fingerprinting
    Active fingerprinting •   (JavaScript 
   )
10. Honeypot
    Fingerprint • p0f • OS " • T-POT  #  • FingerprintJS • % • Micro Honeypot ($ 
     '& • TLS Fingerprint • JA3, HASSH →OSS SSHCowrie !(HASSH)
11. fingerprintjs2 
     - https://valve.github.io/fingerprintjs2/
12. Honeypot
    Fingerprint • p0f • OS " • T-POT  #  • FingerprintJS • % • Micro Honeypot ($ 
     '& • TLS Fingerprint • JA3, HASSH →OSS SSHCowrie !(HASSH)
13. JA3 JA3(https://github.com/salesforce/ja3) • $ &%,
    '*,",!
    + • Black Hat Arsenal 2016 TLS Fingerprinting1 • HTTPS>8-45 3 E2. $ # /@=? D; ),# >8%# 6C: (-A7”(+ B9>8 0<” )
14. JA3
     1. Client Hello 2. Server Hello, Server Certificate, Server Key Exchange, Server Hello Done 3. Client Key Exchange, Change Cipher Spec, Finished 4. Change Cipher Spec, Finished 
    HTTPS  JA3
15. JA3
     Client Hello 
    • SSL Version • Cipher Suite • Extension • Elliptic Curves • Elliptic Curve Point Formats 10 
    MD5 
16. 16 ← 771 ← 49162 ← 49195 ← 49169 ← 49159 ← 49171 ← 49161 ← 49172 ← 49199 ← 5 ← 47 ← 53 ← 49170 ← 10 ← 0 ← 5 ← 10 ← 23 ← 24 ← 25 ← 11 ← 13 ← 65281 771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,0-5-10- 11-13-65281,23-24-25,0 ↓MD5
     20c9baf81bfe96ff89722899e75d0190
17.  
     Web (Nginx) tcpdump(
     )    (pcap) HTTPS
       ELK  
18. 
    Fingerprint ja3fingerprint.json (https://github.com/trisulnsm/trisul- scripts/tree/master/lua/frontend_scripts/reassembly/ja3/prints) • JA3  fingerprint  
     •  
     
19. 
    Fingerprint 
    fingerprint  
    
20. 
     • HTTPS # &  →%  !
     •  "( '$
21. ma couleur