Easily Identify Malicious Servers on the Internet with JARM

I'm wary of relying on the response from unknown hosts on a messy, adversarial network like the internet, even if I'm hoping to catalog some as malicious. There really is no reason why I should expect well- and consistently-ordered responses against which I can fingerprint. Adjusting the underlying libraries to generate a randomized list of acceptable ciphers, or to randomize any other data that program is using to build this fingerprint is trivial.

Putting aside the adversarial case, I can imagine even well intentioned networks with, say, anycasted addresses munging this up as well. I can give you one IP address but six, 11, 91 or however many different responses if I so choose. Which response is the 'correct' one? Are you going to ban entire blocks of addresses because one happened to match a known C&C host?

> Moving from reactive to proactive cybersecurity blocklists.

Well that might explain why once a year Salesforce randomly stops working with some server and of course support being so useless we just move server. 1 month later we get message “ah yeah that was us”.

But that was pleasant read. Wonder if anyone ever tried to scan entire ipv6

This appears to be complementary to their other TLS fingerprinting project, JA3. Where JARM quickly scans servers for TLS configuration, JA3 sniffs network traffic to fingerprint client/server TLS handshakes.

I wonder what research is happening at Salesforce to create these byproducts.

seems like its only a matter of time then that malicious servers wrap their TLS libs in a one time randomizer that gives them the appearance of not matching other C&C hosts.