Open wkrp opened 5 years ago
The talk turns out to have been based on a paper from CODASPY 2019:
The paper shows how to passively infer certain HTTP features from an HTTPS connection, given only the stream of TLS records. These HTTP features include the status-code, the method, the contents of certain header fields, and the presence/absence of certain other header fields. Their generally high rates of inferring these features show a partial failure of TLS to provide confidentiality. They apply the technique to a "defensive" use case—malware classification—and an "offensive" use case—website fingerprinting—and propose the technique as an alternative to full HTTPS MITM interception and the associated difficulties.
The technique requires a large, diverse, and up-to-date corpus of labeled samples; i.e., correlations between HTTPS features and the underlying ground-truth HTTP features. (In the talk, Anderson says that 99% of what they did was building the training datasets, and the remaining 1% was some light machine learning.) They focused on HTTP/1.2 and HTTP/2 in TLS 1.2, with Firefox, Chrome, Tor Browser, and a collection of Windows malware. To get ground-truth decryptions of recorded traffic, they needed to recover keys. In Firefox and Chrome, they used the SSLKEYLOGFILE
environment variable. In Tor Browser and the malware, they extracted keys from memory snapshots.
The effects on malware classification were good. They enriched standard malware classification features, such as the list of ciphersuites, with their HTTP inference features and notably improved over the state of the art. In contrast, the additional HTTP features did not help with website fingerprinting against Tor Browser, which the author attribute mainly to Tor's multiplexing of multiple HTTPS sessions within one TLS connection.
The video of the talk by Blake Anderson is now available. 19 minutes talk, 6 minutes questions.
The Applied Networking Research Workshop next week (July 22) will have an invited talk called "Limitless HTTP in an HTTPS World: Inferring the Semantics of the HTTPS Protocol without Decryption."
Two of the speakers (Blake Anderson and David McGrew) have previously published research papers on inferring the contents of TLS without decryption:
The ANRW program page says the talk will be recorded: