Stealthy Data Exfiltration Exploiting Tls Handshake With Next Generation Firewalls

This talk examines the potential for attackers to exfiltrate sensitive data through next-generation firewalls via a zero-day covert channel within the TLS Client Hello handshake, as presented by Rakesh Seal from Keysight Technologies. The speaker reveals how altering the order of TLS extensions and cipher suites allows data to be encoded and transmitted invisibly, emulating the JA3 fingerprint-evasion techniques of browsers like Chrome and Firefox. The session covers the effectiveness of this technique against major firewalls in laboratory tests, as well as insights gained from responsible disclosures to security organizations and vendors regarding mitigations available to security teams against such protocol-layer covert channels.