PaperlayerView exact revision on arXiv

Source-linked AI summary

Helol Tunnel: Covert Channel Exploitation of TLS Extensibility & Privacy Features

Reza Soosahabi, Rakesh Seal

arXiv:2610.01009v1cs.CR

TL;DR

Malware uses covert channels for command-and-control and exfiltration, but prior TLS approaches have limitations against interactive proxies. Helol encodes data in TLS Client Hello parameter arrangements. The paper reports successful evasion of modern NGFWs with advanced TLS proxies and throughput advantages over SNICat, while noting a trade-off between TLS extensibility and data protection.

  • Problem

    TLS Client Hello covert channels face limitations against interactive proxies, even though the Client Hello reaches its destination before the proxy verifies the server.

    Source: §2 · p. 2

  • Method

    Helol encodes messages by selecting or permuting cryptographic parameters in TLS Client Hello packets.

    Source: §1 · p. 2

  • Results

    Helol demonstrated successful evasion of modern NGFWs with advanced TLS proxy and data protection, and retained a throughput advantage over SNICat across the reported quartiles.

    Source: §7 · p. 7, §6.3 · p. 7

  • Takeaways & Limitations

    Helol is applicable to passive scenarios in which hosts communicate without acquiring an IP address from the incumbent network.

    Source: §7 · p. 7

    Reconfiguring TLS Client Hello packets for mitigation can degrade network-application performance, creating a trade-off between TLS extensibility and data protection.

    Source: §7 · p. 7

Abstract

from arXiv · show

Covert channels exploiting network protocols for data exfiltration and command-and-control (C2) are integral parts of modern cyberattacks. In search of a significant covert channel within the fabric of the Internet, we targeted the combinatorial properties of the Client Hello (CHLO) packets in the ubiquitous Transport Layer Security (TLS) protocol. The proposed Helol tunnel is a novel covert approach to embedding information in TLS Client Hello packets, which involves the strategic rearrangement of their cryptographic information elements. To sustain TLS protocol extensibility, the recent anti-ossification TLS compliance measures encourage the interactive middleboxes and next-generation firewalls (NGFWs) to preserve the parameter configuration in the Client Hello packets. Furthermore, to improve user privacy, popular Internet applications are varying their TLS CHLO parameter configurations to resist TLS fingerprinting by third-party network entities. We demonstrate the strength of the Helol tunnel to exploit these recent developments to evade NGFWs with interactive proxy and comprehensive threat protection. We also numerically show the efficacy of Helol tunneling over state-of-the-art covert channels that exploit TLS through the use of real traffic captures and public TLS fingerprinting data.

1. Introduction

Covert channels help malware communicate with command-and-control servers and exfiltrate data, while NGFWs seek to block them. Helol encodes information in TLS Client Hello parameter arrangements, exploiting recent TLS compliance and fingerprinting developments.

1. Introduction

  • Helol encodes messages by selecting and permuting cryptographic parameters in TLS Client Hello packets that resemble incumbent TLS traffic.The method targets data exfiltration to a C2 server.Source: §1 · p. 2
  • The authors report advantages including evading interactive TLS proxies, avoiding third-party applications and malware TLS libraries, and gaining throughput over TLS Client Hello covert channels.They also describe indistinguishability from normal application traffic, coexistence with other TLS covert channels, and passive IP-less channels.Source: §1 · p. 2
  • The paper also outlines remediation strategies, presents throughput computations and numerical results, and places additional analyses in Appendices A–D.The appendices cover encoding schemes, laboratory NGFW evasion, passive exploitation, and ethical considerations.Source: §1 · p. 2

2. Next-Generation Firewalls Defense Against Covert Channels

NGFWs inspect TLS traffic through interactive proxies, but the Client Hello reaches its destination before the proxy begins decryption and inspection. Earlier TLS covert channels face constraints including low throughput, detectable patterns, or NGFW blocking.

2. Next-Generation Firewalls Defense Against Covert Channels

  • NGFW proxies inspect the Client Hello, then establish separate TLS connections with the client and destination server to inspect encrypted application traffic.The proxy authenticates the server certificate and presents its own trusted certificate to the client.Source: §2 · p. 2
  • Because the Client Hello reaches the C2 server before server authenticity is verified, it offers a channel before proxy inspection begins.Prior TLS Client Hello schemes include embedding data in its initialization vector; cited work notes their limitations against interactive proxies,.Source: §2 · p. 2
  • Multi-packet TLS methods can have very low throughput and detectable traffic patterns, while SNICat encodes data in SNI but produces patterns NGFWs can detect and block.Earlier extension-field and client-certificate techniques had limited success against TLS inspection.Source: §2 · p. 3

3. TLS Fingerprinting & NGFW Compliance

TLS Client Hello parameters can identify client software and support network forensics, anomaly detection, and malware C2 detection. Parameter ordering also connects fingerprinting and privacy practices with anti-ossification efforts to preserve Client Hello configurations.

3. TLS Fingerprinting & NGFW Compliance

  • TLS Client Hello packets contain a cipher list and optional extensions, and their parameters can identify client software without decryption.JA3 fingerprints selected parameters by MD5 hash and is sensitive to their ordering, which applications and malware may randomize to resist fingerprinting.Source: §3 · p. 3
  • TLS anti-ossification efforts aim to limit middlebox interference; GREASE lets applications use unused registered extensions and cipher codes to detect and react to ossifying middleboxes.Some applications also use certificate pinning to prevent interception by interactive TLS proxies.Source: §3 · p. 3
  • Helol is motivated by parameter randomization for fingerprinting evasion and anti-ossification measures, encoding messages in the selection or permutation of list-type TLS Client Hello parameters.The authors state that this arrangement-based method can withstand compliant interactive proxies and be more effective than methods encoding data in TLS extensions.Source: §3 · p. 3

4. Proposed TLS CHLO Covert Channel

Helol uses TLS Client Hello parameter arrangements for covert communication through an enterprise NGFW. Its workflow probes which parameter arrangements survive, then encodes data in the preserved arrangements.

4. Proposed TLS CHLO Covert Channel

  • Helol uses TLS Client Hello sequence patterns for C2 communication, with an exfiltration scenario that sends more data uplink than the minuscule downlink used for commands and acknowledgments.The channel is synchronized through an NGFW; the authors consider it compatible with alternative downlink signaling channels.Source: §4 · p. 4

4.1. NGFW Probing & Initialization

  • During one-time initialization, the malware probes whether the NGFW preserves a parameter’s values and ordering, and proceeds with that encoding only after an ACK.It can generate Client Hello packets directly as TCP payloads without SSL libraries; dynamic probe arrangements and GREASE values can further test compliance, and agents may embed identifiers to distinguish sessions.Source: §4.1 · pp. 4–5

4.2. Data Exfiltration

  • For exfiltration, the malware encodes data chunks in preserved parameter arrangements, with capacity ⌊log2 N!⌋ bits for a list of N values.The C2 server can acknowledge or reject packets; the malware retransmits lost chunks or probes another strategy, and can signal transfer termination in its last Client Hello.Source: §4.2 · p. 5
  • Successive Client Hello packets that stop before the server response are not anomalous in most networks, including connections terminated and retried by applications using certificate or public-key pinning.This is the authors’ stated network-behavior basis for the exfiltration pattern.Source: §4.2 · p. 5

5. Paths to Remediation

The paper frames Helol as a trade-off between TLS extensibility and data protection, then outlines remediation strategies for limiting its covert-channel use.

5. Paths to Remediation

  • The paper presents these strategies as a foundation for future remediation research addressing the potential threat to organizations with strict data-loss policies.Source: §5 · p. 5
  • Static TLS Client Hello configurations let NGFW operators manage the extensibility–protection trade-off, including applying them only in restricted network segments.The paper proposes making anti-ossification measures optional.Source: §5 · p. 5
  • When static ordering would disrupt critical applications, NGFWs can randomize inbound list-element order, removing permutation encoding and forcing failure or slower selection encoding.Source: §5 · p. 5
  • Statistical and machine-learning monitoring could identify significant features of Helol activity if future IDS systems have sufficient compute power to track incumbent TLS Client Hello trends.Source: §5 · p. 5

6. Numerical Analysis & Results

The analysis compares Helol and SNICat throughput using TLS fingerprint and traffic-capture data. Helol shows higher throughput quartiles than SNICat, while its median is similar across the public fingerprint and local-capture datasets.

6.1. Throughput Analysis

  • Throughput comparison uses encoded payload per packet because packet rate depends on victim-network conditions; SNICat encodes through the server-name field’s available characters.The authors say NGFW processing delays mostly throttle transmission, making packet byte-size differences negligible.Source: §6.1 · pp. 5–6
  • Android telemetry averaged 0.48 TLS Client Hello packets per second per active device, close to the lab’s 0.42 packets per active user; the passive channel can draw on multiple hosts.Source: §6.1 · pp. 5–6

6.2. Evaluation Datasets

  • The evaluation uses top-application SNI strings, public JA3 fingerprints, and local traffic captures to obtain TLS Client Hello parameter-list length distributions.The SNI sample contains 3,907 strings; the public database contributes 364 application fingerprints, excluding malware and security tools.Source: §6.2 · p. 6
  • Local captures contained 96,825 TLS Client Hello packets but only 137 distinct parameter configurations; cipher suites contributed most to throughput, followed by extensions, hashing algorithms, and elliptic curves.Source: §6.2 · p. 6, Figure 4 · p. 7

6.3. Comparison Results

  • Helol shows significant throughput gains over SNICat in the median, third, and fourth quartiles, retaining an advantage even with cipher-list or extension permutation alone.Source: Figure 5 · p. 7, §6.3 · p. 7
  • Helol’s median throughput is close across Trisul fingerprints and the 137 distinct TLS Client Hello configurations observed in local captures.Source: §6.3 · p. 7

7. Conclusion

The conclusion reports Helol's potential for TLS Client Hello data exfiltration and successful evasion of modern NGFWs, including passive communication without an IP address. Appendix A frames codebook efficiency, then describes bitmap selection encoding.

7. Conclusion

  • Helol demonstrates potential for Client Hello data exfiltration and evasion of modern NGFWs, including passive communication without an IP address.The conclusion presents this versatility as a risk relative to other state-of-the-art covert channels.Source: §7 · p. 7

Appendix A. Efficacy of Combinatorial Encoding Schemes

  • Codewords are sequences drawn from a symbol set, and codebook efficiency compares data capacity with expected transmitted bits per codeword.For list-encoded parameters, codewords cannot repeat symbols and therefore have length less than N.Source: Appendix A · p. 7

A.1. Selection (Bitmap) Encoding

  • Selection encoding maps N-bit blocks to subsets of N symbols, with expected codeword length N/2 for equiprobable input data.The receiver reconstructs bits by setting a bit when its corresponding symbol appears in the received codeword.Source: §A.1 · p. 8

A.2. Permutation Encoding

Full permutation encoding uses equal-length permutations of all symbols, with efficiency approaching its maximum as codeword length grows. Partial permutation encoding instead permits sequences drawn from subsets of the symbol set.

A.2. Permutation Encoding

  • Full permutation encoding uses N! equal-size codewords, each formed by permuting the entire symbol set.The encoding and decoding procedure is attributed to classic algorithms [31].Source: §A.2 · p. 8
  • Permutation encoding efficiency converges to the maximum value of 1 as codeword length N increases.The method encodes ⌊log2 N!⌋ data bits as a permutation of all symbols in S, producing a codeword of size N.Source: §A.2 · p. 8

A.3. Partial Permutation Encoding

  • Partial permutation encoding builds a codebook from non-repeating permutations of subsets of S and evaluates its efficiency against full permutation encoding.The derivation considers codebook size and expected codeword length.Source: §A.3 · p. 8

A.4. Advantage of Permutation Encoding

The comparison favors fixed-length permutation encoding under the stated constraints: its efficiency approaches the maximum, while partial permutations offer little throughput gain at greater decoding complexity.

A.4. Advantage of Permutation Encoding

  • Fixed-length permutation encoding is the optimal choice for Helol under the stated encoding constraints.Its efficiency approaches the maximum as N increases.Source: §A.4 · p. 8
  • Bitmap efficiency rapidly declines as codeword length grows, unlike permutation efficiency, which approaches the maximum.The passage states this contrast for the calculated coding efficiencies.Source: §A.4 · p. 8
  • Partial permutations add only ⌊log2 e⌋ throughput, or one bit per codeword, while requiring variable-length codewords and more complex decoding.Their efficiency also rapidly converges to that of permutation encoding.Source: §A.4 · p. 8

Appendix B. Evaluating Next-Generation Firewalls

Three enterprise NGFWs were tested with maximum security features enabled. Two retained inbound Client Hello configurations in ways that left them vulnerable to permutation encoding, while all three were vulnerable to low-throughput bitmap encoding and raised no warning about repetitive Client Hello packets.

Appendix B. Evaluating Next-Generation Firewalls

  • All three products retained inbound Client Hello values when those values were within NIST recommendations.The evaluation enabled maximum security features, including advanced TLS proxy and data leak prevention.Source: Appendix B · p. 8
  • 2 of 3 evaluated NGFWs complied with anti-ossification measures that left them vulnerable to Helol permutation encoding; all 3 were vulnerable to low-throughput bitmap encoding.Table 2 reports the empirical evaluation of commonly deployed enterprise NGFWs.Source: Appendix B · pp. 8–9, Table 2 · p. 9
  • None of the three products raised a warning about the simulated malware agent sending repetitive Client Hello packets.Source: Appendix B · p. 9

Appendix C. Helol Tunnel for Passive Covert Channels

The passive Helol scenario uses compromised network equipment to covertly communicate across an NGFW by modifying incumbent TLS packets without requiring IP addresses. The paper also reports responsible disclosure to affected vendors before publication.

Appendix C. Helol Tunnel for Passive Covert Channels

  • The authors’ preliminary studies suggest Helol is likely the only TLS Client Hello covert channel capable of crossing NGFWs with interactive proxies.Earlier passive-channel work focused largely on layer 4 features, which the authors say are no longer relevant against modern NGFWs; prior TLS methods were mostly incompatible with interactive proxies.Source: Appendix C · p. 9
  • The scenario places an insider and outsider agent on a route across the NGFW; neither needs an IP address because they capture and modify incumbent TLS packets en route.The insider may be an infected LAN switch or privileged software on a host; the outsider may be an infected switch in the provider backhaul.Source: Appendix C · p. 9
  • Ordering TLS Client Hello parameters offers a way to encode covert messages without disrupting incumbent connections, which the authors describe as relevant to supply-chain attacks.The insider seeks to communicate without revealing its presence in the victim LAN, while the outsider passively monitors outbound traffic.Source: Appendix C · p. 9

Appendix D. Responsible Disclosure & Ethics

  • Before publication, the authors disclosed the scheme to impacted vendors through CISA’s Coordinated Vulnerability Disclosure program and discussed its viability and impact.The publication embargo was lifted as of November 2024.Source: Appendix D · p. 9
Loading 2610.01009v1…