X-Ray-TLS: transparent decryption of TLS sessions by extracting session keys from memory - Archive ouverte HAL
Communication Dans Un Congrès Année : 2024

X-Ray-TLS: transparent decryption of TLS sessions by extracting session keys from memory

Résumé

While internet communications have been originally all in the clear, the past decade has seen secure protocols like TLS becoming pervasive, significantly improving internet security for individuals and enterprises. However, encrypted traffic raises new challenges for intrusion detection and network monitoring. Existing interception solutions such as Man-In-The-Middle are undesirable in many settings: they tend to lower overall security or are challenging to use at scale. We present X-Ray-TLS, a new target-agnostic TLS decryption method that supports TLS 1.2, TLS 1.3, and QUIC. Our method relies only on existing kernel facilities and does not require a hypervisor or modification of the target programs, making it easily applicable at scale. X-Ray-TLS works on major TLS libraries by extracting TLS secrets from process memory using a memory changes reconstruction algorithm. It works with TLS hardening, such as certificate pinning and perfect forward secrecy. We benchmark X-Ray-TLS on major TLS libraries, CLI tools, and a web browser. We show that X-Ray-TLS significantly reduces the manual effort required to decrypt TLS traffic of programs running locally, thus simplifying security analysis or reverse engineering. We identified several use cases for X-Ray-TLS, such as large-scale TLS decryption for CI/CD pipelines to support the detection of software supply chain attacks.
Fichier principal
Vignette du fichier
publi-7588.pdf (810.3 Ko) Télécharger le fichier
Origine Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-04446027 , version 1 (08-02-2024)

Identifiants

Citer

Florent Moriconi, Olivier Levillain, Aurélien Francillon, Raphael Troncy. X-Ray-TLS: transparent decryption of TLS sessions by extracting session keys from memory. The 19th ACM ASIA Conference on Computer and Communications Security (ACM ASIACCS), ACM, Jul 2024, Singapore, Singapore. pp.35-48, ⟨10.1145/3634737.3637654⟩. ⟨hal-04446027⟩
335 Consultations
222 Téléchargements

Altmetric

Partager

More