Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

We are categorizing the network traffic, like determining if it is Facebook, Yahoo etc...

Now I have been asked also separate mobile devices (like iPad, Nexus, iPhone). It is easy to do that in HTTP with user agent information.

But I also need to consider HTTPS protocol. Is there any way I get any information about a user device in "client hello" or "certificate" messages?

share|improve this question

3 Answers 3

Provided they're not using something like VPN or a Proxy you should be able to check a few things with an app like WireShark:

  1. DNS requests for different websites (before the TLS or HTTPS devices will typically look-up the server). Eg. Facebook is using Akamai so if you can capture a DNS packet bound for fb.*\.akamai\.net that will give you both IPs (and the client MAC address). Then you can track the traffic from that IP through the session.
  2. IP Reverse Look-up (You can check an outside service's IP registrant at a directory like ARIN) - whois -h whois.arin.net 8.8.8.8
  3. You can look-up the device manufacturer via MAC Address
  4. Like Manishearth was saying, you can try to catch a user agent from web browsing on the same IP during that same session, then marry the user_agent to the MAC Address.
share|improve this answer

Not directly. The Certificate message is sent by the server. The ClientHello may help categorizing things, as different browsers/devices support different algorithms.

Instead, it may help to use the HTTP user agent to associate a device to an IP address and then use that tag for HTTPS connections.

share|improve this answer
    
I expect most browsers to have different ClientHellos. At least Opera, Firefox and Internet Explorer are totally different. –  CodesInChaos Jun 14 '13 at 8:12
    
@CodesInChaos: Hmm, you're right. Edited out. –  Manishearth Jun 14 '13 at 8:57

SSL is designed to keep eavesdroppers out, and, from your problem description, you want to be an eavesdropper...

In the handshake, the Certificate message is from the server, not the client, so you won't learn client details from that message. Of all the client messages, only the ClientHello can possibly teach you a few things, but this will be limited. Basically, you will have the list of supported cipher suites (with ordering), compression support, and the presence or absence of SSL extensions (e.g. Server Name Indication). Such parameters depend on the browser and the OS, but with only few variations, so don't expect miracles. If the client browser is Firefox, then it has its own SSL library (called NSS), but you won't be able to distinguish between Firefox on an Android smartphone and Firefox on a Windows machine. Otherwise, you may hope for recognizing Apple systems (iPad, iPhone, Mac OS X), Windows and Android/Linux as three different groups, but you won't get more details. If you know the client OS and browser types, then you might be able to work out the approximate version based on the presence or absence of some options.

At least some people have toyed with the idea of collecting SSL ClientHello information from many browsers to try to work out browser/OS types and versions. E.g. see these pages from Qualys SSL Labs. This still seems to be at the conceptual stage (and not actively developed).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.