Exploring Network Security with JA3 by Rakesh Seal at Null/OWASP Kolkata Chapter Combined Monthly Meetup on 20th April

1. Enhancing Network Security with JA3
Detailed Explanation on JA3 for TLS fingerprinting and early threat detection

2. $ whoami
Rakesh Seal
● R&D, Keysight (ATI Research)
● Network Security
● Embedded Systems (IoT)
● Full Stack Dev
● Automation Enthusiast
● 15+ Patent Publication
● Play DoTA 👾
rakeshseal0.github.io

3. What & Why Fingerprinting?
Network Fingerprinting: A cybersecurity method that identifies unique system traits from transmitted data, creating a
specific identifier for security enhancement.
● Device Identification
● Security And Threat Detection
● Exfiltration Prevention
● Resource Efficiency

4. How TLS Works

5. How TLS Works

6. Pyramid of Pain
JA3

7. What is JA3
MD5

8. JA3 Demo
Some Pcap for Ja3 Analyisis

9. JA3 for Security Researchrs
C2
Detection
● Malware Communicationn
● Powershell APi
● EX: Empire C2
Malware
Sandbox
Research
● Baseline empty sandbox
● Add Malware
● Calc

10. JA3 Practical Use Case with DGA

11. JA3 Practical Use Case with Exfiltration Detection

12. Static Nature
03 ● Ja3 Might change on infrastructure change
● Need of ever updating DB
TLS Dependency
02 ● The Communication have to be encrypted
● Low adaptibility in ICS / SCADA Space
Evasion Strategies
01
● Extension Rotation
● Cipher Stunning
Limitations of JA3

13. Beyond Ja3

14. References
Arigatou!
(ありがとう)
● https://github.com/salesforce/ja3
● https://engineering.salesforce.com/tls-fingerprinting-with-ja3-and-ja3s-
247362855967/
● https://ja3.zone/