HTTP/2 is the second major version of the HTTP protocol. It changes the way HTTP is transferred “on the wire” by introducing a full binary protocol that is made up of TCP connections, streams, and frames, rather than a plain-text protocol. Such a fundamental change from HTTP/1.x to HTTP/2, means that client-side and server-side implementations have to incorporate completely new code in order to support new HTTP/2 features. This introduces nuances in protocol implementations, which, in return, might be used to passively fingerprint web clients. Our research is based on more than 10 million HTTP/2 connections from which we extracted fingerprints for over 40,000 unique user agents across hundreds of implementations. In the presentation, we intend provide the following: *HTTP/2 Overview - Introduction into the basic elements of the protocol - a review the different components chosen for the fingerprint format (alongside a discussion on those left out) - Potential use cases of the proposed fingerprint - Usage Statistics - prevalence of HTTP/2 usage on Akamai’s platform *Examples of common HTTP/2 Implementations & Client fingerprints collected during the research *HTTP/2 support (or the lack of) among common web security tools (Burp suite, sqlmap, etc.) *Review of attacks over HTTP/2 observed on Akamai’s platform

1. PASSIVE FINGERPRINTING OF
HTTP/2 CLIENTS
CODEBLUE
@TOKYO
Ory Segal
Sr. Director, Threat Research
Akamai
@orysegal

2. AGENDA
▸Data collection, and background on the Akamai Intelligent
Platform
▸HTTP/2 overview
▸Passive client & device fingerprinting
▸HTTP/2 passive client fingerprinting
▸Use cases for client fingerprinting
▸HTTP/2 threat landscape
© 2017 AKAMAI | FASTER FORWARD™

3. The Intelligent Platform
▸220,000+ Edge Servers
▸3,315+ Locations
▸1200+ Cities
▸129 Countries
▸1,227+ Networks
▸60 Tbps at last peak
The Data
▸3 trillion hits per day
▸1 Billion unique IPs seen quarterly
▸13+ trillion log lines per day
▸260+ TB of compressed daily logs
15 - 30% of all web traffichttp://wwwnui.akamai.com/gnet/globe/
http://tech.akamai.com/attack-globe/
AKAMAI

4. © 2017 AKAMAI | FASTER FORWARD™

5. 1,000,000,000+ Hits
25,600,000 IP Addresses
13,200 Hosts
632,900 User-Agents
413,400,000 Logins
HTTP/2 [ DAILY ] USAGE STATISTICS
10%Daily Traffic

6. HTTP/2 OVERVIEW

7. HTTP/2 OVERVIEW
▸Based on the SPDY protocol (developed by )
▸Published during 2015:
▸RFC 7540: Hypertext Transfer Protocol Version 2 (HTTP/2)
▸RFC 7541: HPACK: Header Compression for HTTP/2
▸Addresses (performance) challenges in HTTP/1.1

8. HTTP/1.1 CHALLENGES
© 2017 AKAMAI | FASTER FORWARD™
Concurrency
Compression
HTTP/1.0 allowed only one request to be outstanding at a time
on a given TCP connection. HTTP/1.1 added request pipelining,
but this only partially addressed request concurrency and still
suffers from head-of-line blocking
HTTP header fields are often repetitive and verbose, causing
unnecessary network traffic as well as causing the initial TCP
congestion window to quickly fill
In HTTP/1.x, the server never initiates traffic push. It has to be
passive and wait for the client to request resources, even
when it knows which resources the client is about to request
next
Passive server< / >

9. ENTER HTTP/2...
© 2017 AKAMAI | FASTER FORWARD™
Concurrency
Compression
Allows interleaving of request and response messages on the
same TCP connection
Uses an efficient coding for HTTP header fields, as well as
header compression
Adds a new interaction mode whereby a server can push
responses to a client, if it thinks the client will need them
Server push< / >

10. CONCURRENCY
© 2017 AKAMAI | FASTER FORWARD™
TCP CONNECTION
STREAM 0
STREAM 1
STREAM 2
STREAM n
STREAM 1
A Stream is an independent, bidirectional sequence of frames
exchanged between the client and server
Frame
FrameFrame
FrameFrame
Frame
Frame Frame

11. HTTP/2 KEY ELEMENTS
▸Connection: a transport-layer connection between two
endpoints
▸Stream: a bidirectional flow of frames within the HTTP/2
connection
▸Frame: the smallest unit of communication within an
HTTP/2 connection. Consists of a header and a variable-
length sequence of octets structured according to the
frame type
▸Message: a sequence of one or more frames (maps to a
request or response)
© 2017 AKAMAI | FASTER FORWARD™

12. FRAME STRUCTURE
© 2017 AKAMAI | FASTER FORWARD™
Length (24 bit)
Type (8 bit) Flags (8 bit)
R Stream Identifier (31 bit)
Frame payload (0...)

13. HEADERS FRAME - EXAMPLE
© 2017 AKAMAI | FASTER FORWARD™
Length (24 bit) = XXXXX
Type = 0x1
HEADERS_FRAME
Flags = 0x25
END_HEADERS (0x4) ,
END_STREAM (0x1),
PRIORITY (0x20)
R Stream Identifier (Stream ID = 73)
Pad Length = 0
E = 1
Weight = 220
Stream Dependency = 0
:method: GET
:authority: http2.akamai.com
:scheme: https
:path: /resources/h2.css
user-agent: Mozilla/5.0 (......) Chrome/62.0.3202.75

14. HTTP/2 FRAME TYPES
▸DATA {type = 0x0}
▸HEADERS {type = 0x1}
▸PRIORITY {type = 0x2}
▸RST_FRAME {type = 0x3}
▸SETTINGS {type = 0x4}
▸PUSH_PROMISE {type = 0x5}
▸PING {type = 0x6}
▸GOAWAY {type = 0x7}
▸WINDOW_UPDATE {type = 0x8}
▸CONTINUATION {type = 0x9}
© 2017 AKAMAI | FASTER FORWARD™

15. HTTP/2 INSPECTION TOOLS
© 2017 AKAMAI | FASTER FORWARD™
Server side
Web server debug logs

16. HTTP INSPECTION TOOLS
© 2017 AKAMAI | FASTER FORWARD™
Client side
Chrome://net-internals

17. HTTP/2 SESSION INITIALIZATION
© 2017 AKAMAI | FASTER FORWARD™

18. HTTP (GET) REQUEST
© 2017 AKAMAI | FASTER FORWARD™

19. HTTP RESPONSE
© 2017 AKAMAI | FASTER FORWARD™

20. KEEP IN MIND
▸HTTP/2 is binary (you can’t use netcat to draft traffic)
▸HTTP/2 implementations use TLS
▸Most intercepting proxies (e.g. Burp) don’t support H2
© 2017 AKAMAI | FASTER FORWARD™

21. © 2017 AKAMAI | FASTER FORWARD™
PASSIVE CLIENT
FINGERPRINTING

22. PASSIVE CLIENT FINGERPRINTING
▸Passive collection of attributes that might expose
consistent unique behavior
▸Fingerprinting software clients, not end users
▸Transport layer, Session layer, Application layer
▸Deduce information about:
▸Operating system (type and version)
▸System uptime
▸Software client type
© 2017 AKAMAI | FASTER FORWARD™

23. ▸HEADERS {type = 0x1}
▸PRIORITY {type = 0x2}
▸SETTINGS {type = 0x4}
▸WINDOW_UPDATE {type = 0x8}
HTTP/2 FRAME TYPES USED IN
FINGERPRINT
▸DATA {type = 0x0}
▸HEADERS {type = 0x1}
▸PRIORITY {type = 0x2}
▸RST_FRAME {type = 0x3}
▸SETTINGS {type = 0x4}
▸PUSH_PROMISE {type = 0x5}
▸PING {type = 0x6}
▸GOAWAY {type = 0x7}
▸WINDOW_UPDATE {type = 0x8}
▸CONTINUATION {type = 0x9}
© 2017 AKAMAI | FASTER FORWARD™

24. SETTINGS FRAME
The SETTINGS frame conveys configuration parameters
that affect how endpoints communicate. It MUST be sent
by both endpoints at the start of a connection
© 2017 AKAMAI | FASTER FORWARD™
Fingerprint = [ 1:65536; 3:1000; 4:6291456 ]

25. SETTINGS FRAME
The SETTINGS frame conveys configuration parameters
that affect how endpoints communicate. It MUST be sent
by both endpoints at the start of a connection
© 2017 AKAMAI | FASTER FORWARD™
Fingerprint = [ 1:65536; 3:1000; 4:6291456 ]

26. SETTINGS FRAME - ENTROPY
© 2017 AKAMAI | FASTER FORWARD™

27. THE WINDOW_UPDATE FRAME
▸The WINDOW_UPDATE frame is used to implement flow
control
▸Flow control operates at two levels: on each individual stream
and on the entire connection
▸The RFC defines a default window size of 65,535 octets
▸The connection flow-control window can only be changed
using WINDOW_UPDATE frames
© 2017 AKAMAI | FASTER FORWARD™

28. ADDING ‘WINDOW_UPDATE’ TO THE
FINGERPRINT
© 2017 AKAMAI | FASTER FORWARD™
Fingerprint = [ 1:65536; 3:1000; 4:6291456 | 15663105 ]

29. PRIORITY FRAME
▸Sets stream dependencies and priorities
▸Priority is set by assigning weights to
streams
▸Weights express preference of resources
allocation
▸Used by some at the beginning of each
connection
▸Each frame has three fields:
▸Weight
▸Stream Dependency
▸Exclusivity Bit
© 2017 AKAMAI | FASTER FORWARD™
index.html
<stream 1>
theme.css
<stream 9>
jquery.js
<stream 3>
fonts.js
<stream 5>
main.js
<stream 7>

30. FIREFOX PRIORITY FRAME
© 2017 AKAMAI | FASTER FORWARD™
<3>
201
<5>
101
<7>
1
0
<9>
1
<11>
1
Priority = 3:0:0:201, 5:0:0:101, 7:0:0:1, 9:0:7:1, 11:0:3:1

31. SUMMARY
© 2017 AKAMAI | FASTER FORWARD™
User-Agent SETTINGS WINDOW UPDATE PRIORITY
okhttp/3.6.0 4:16777216 16711681 0
curl/7.54.0 3:100;4:1073741824 1073676289 0
nghttp2/1.22.0 3:100;4:65535 00
3:0:0:20,5:0:0:101,
7:0:0:1,9:0:7:1,11:0:3:1
Fingerprint = [3:100;4:65535|00|3:0:0:20,5:0:0:101,7:0:0:1,9:0:7:1,11:0:3:1]

32. © 2017 AKAMAI | FASTER FORWARD™

33. PSEUDO-HEADERS
▸HTTP/1.x used the message to convey the target URI,
the method of the request, and the status code for the
response
▸HTTP/2 uses special pseudo-header fields beginning
with ':' character for this purpose
© 2017 AKAMAI | FASTER FORWARD™
GET / HTTP/1.1
Host: www.example.com
User-Agent: Mozilla/5.0
Accept: text/html
:method: GET
:path: /
:authority: www.example.com
:scheme: https
User-Agent: Mozilla/5.0
Accept: text/html
GET / HTTP/1.1
Host: www.example.com
User-Agent: Mozilla/5.0
Accept: text/html

34. PSEUDO-HEADER ENTROPY
CONTRIBUTION
© 2017 AKAMAI | FASTER FORWARD™

35. [1:65535;3:100;4:131072 | 00 | 3:0:0:20,5:0:0:101,7:0:0:1,9:0:7:1,11:0:3:1 | m,p,a,s]
SETTINGS WINDOW_UPDATE PRIORITY PSEUDO-HEADER-ORDER
HTTP/2 FINGERPRINT FORMAT
© 2017 AKAMAI | FASTER FORWARD™

36. PASSIVE HTTP/2 FINGERPRINTING USE
CASES
▸Detection of spoofed web clients:
▸Spoofed clients’ fingerprint will be inconsistent with known
fingerprints
▸Detection of attack tools & bots:
▸Use a dictionary of “known” tool signatures
▸Positive enforcement of web clients
▸E.g. mobile apps accessing APIs
▸Anonymous proxy & VPN detection
▸Traffic & fingerprint statistical analysis
© 2017 AKAMAI | FASTER FORWARD™

37. © 2017 AKAMAI | FASTER FORWARD™
HTTP/2 THREAT
LANDSCAPE

38. Most security tools lack H2 support:
✘ Burp Suite
✘ Zed Attack Proxy
✘ Fiddler
✘ SQLmap
✘ Acunetix
✘ AppScan
✘ NetSparker
✘ SentryMBA
✘ THC-Hydra

39. BUT WHY?
No real incentive for
attackers - Web servers
support both HTTP/1.x and
HTTP/2
© 2017 AKAMAI | FASTER FORWARD™
Not all common and simple
HTTP libraries support
HTTP/2 at the moment.
Adoption will require code
refactoring
Some server implementation weaknesses were found in 2016 - Handling
of Compression, Stream management, however these do not require tool
adoption.

40. © 2017 AKAMAI | FASTER FORWARD™