X-Ray-TLS: transparent decryption of TLS sessions by extracting session keys from memory - Archive ouverte HAL Access content directly
Conference Papers Year : 2024

X-Ray-TLS: transparent decryption of TLS sessions by extracting session keys from memory

Abstract

While internet communications have been originally all in the clear, the past decade has seen secure protocols like TLS becoming pervasive, significantly improving internet security for individuals and enterprises. However, encrypted traffic raises new challenges for intrusion detection and network monitoring. Existing interception solutions such as Man-In-The-Middle are undesirable in many settings: they tend to lower overall security or are challenging to use at scale. We present X-Ray-TLS, a new target-agnostic TLS decryption method that supports TLS 1.2, TLS 1.3, and QUIC. Our method relies only on existing kernel facilities and does not require a hypervisor or modification of the target programs, making it easily applicable at scale. X-Ray-TLS works on major TLS libraries by extracting TLS secrets from process memory using a memory changes reconstruction algorithm. It works with TLS hardening, such as certificate pinning and perfect forward secrecy. We benchmark X-Ray-TLS on major TLS libraries, CLI tools, and a web browser. We show that X-Ray-TLS significantly reduces the manual effort required to decrypt TLS traffic of programs running locally, thus simplifying security analysis or reverse engineering. We identified several use cases for X-Ray-TLS, such as large-scale TLS decryption for CI/CD pipelines to support the detection of software supply chain attacks.
Fichier principal
Vignette du fichier
publi-7588.pdf (810.3 Ko) Télécharger le fichier
Origin : Files produced by the author(s)

Dates and versions

hal-04446027 , version 1 (08-02-2024)

Identifiers

Cite

Florent Moriconi, Olivier Levillain, Aurelien Francillon, Raphael Troncy. X-Ray-TLS: transparent decryption of TLS sessions by extracting session keys from memory. The 19th ACM ASIA Conference on Computer and Communications Security (ACM ASIACCS), ACM, Jul 2024, Singapore, Singapore. ⟨10.1145/nnnnnnn.nnnnnnn⟩. ⟨hal-04446027⟩
45 View
23 Download

Altmetric

Share

Gmail Facebook X LinkedIn More