JA3 vs. JA4 – Understanding the Differences

In the realm of network security, accurately identifying and monitoring TLS traffic is crucial for detecting anomalies and potential threats. Two prominent techniques in this space are JA3 and JA4 fingerprinting. While both serve to identify TLS clients, they differ in their scope and capabilities.

What is JA3?

JA3 is a method for creating a fingerprint of the TLS Client Hello message. By focusing on specific fields within the Client Hello, JA3 can uniquely identify the client's software stack. The primary fields JA3 examines include:

• TLS version
• Cipher suites
• Extensions
• Elliptic curves
• Elliptic curve formats

This fingerprinting allows security professionals to recognize patterns associated with legitimate clients or malicious actors.

Introducing JA4

JA4 extends the capabilities of JA3 by broadening the fingerprinting scope to encompass both client and server interactions within the TLS handshake. Part of the broader JA4+ family, JA4 delves deeper into various fields of the TLS handshake, providing a more comprehensive view of the communication between client and server.

JA4 Includes

The JA4+ family comprises several components, each targeting different aspects of network traffic fingerprinting. Below is a structured overview of each JA4 type, including their full names, short names, and descriptions:

Detailed Breakdown of the JA4+ Family

To fully leverage JA4+, it's essential to understand how each component operates within the network traffic fingerprinting process.

A. JA4 - TLS Client Fingerprinting

• Fingerprint Type: JA4

• What It Consists Of:

• TLS Version: The version of the TLS protocol being used.

• Cipher Suites: The list of cipher suites supported by the client.

• Extensions: Various TLS extensions enabled by the client.

• Supported Groups (Elliptic Curves): The elliptic curves supported for key exchange.

• Elliptic Curve Point Formats: The formats for elliptic curve points.

• Filters to Use:

tls.handshake.type == 1

• Example Fingerprint:

t13d301000_002f,0033,0035,0039,003c,003d,0067_0403,0503,0603

• Why It Matters: JA4 allows for the precise identification of client software stacks, enabling the detection of unusual or malicious clients that may not conform to known patterns. This is crucial for identifying unauthorized access or potential botnet activity. • How It Can Be Used: Security teams can use JA4 fingerprints to monitor and block traffic from clients that exhibit suspicious or unknown fingerprints, thereby preventing potential attacks from compromised or malicious clients.

B. JA4S - TLS Server Response / Session Fingerprinting

• Fingerprint Type: JA4S • What It Consists Of: • Selected Cipher Suite: The cipher suite chosen by the server. • Chosen Extensions: TLS extensions selected by the server. • TLS Version: The version of the TLS protocol used by the server. • Selected Elliptic Curve: The elliptic curve chosen for key exchange (if applicable).

Filters to Use:

tls.handshake.type == 2

Example Fingerprint:

t13d201000_002f,0033_1301

Why It Matters: JA4S enables the identification of server software and configurations. Recognizing unexpected server fingerprints can help in detecting rogue or compromised servers within the network. • How It Can Be Used: By comparing server fingerprints against a database of known good servers, organizations can quickly identify and isolate connections to potentially malicious or unauthorized servers.

C. JA4H - HTTP Client Fingerprinting

• Fingerprint Type: JA4H • What It Consists Of: • HTTP Methods: The HTTP methods used (e.g., GET, POST). • Header Fields: Specific HTTP header fields present in the request. • User-Agent Strings: The User-Agent header identifying the client software. • Request Patterns: Patterns in HTTP requests that indicate client behavior. • Filters to Use:

http.request

Example Fingerprint:

a1b2c3d4e5f6g7h8i9j0

• Why It Matters: JA4H helps in distinguishing between different types of HTTP clients, including browsers, bots, and malicious scripts. This differentiation is essential for enforcing access controls and preventing automated attacks. • How It Can Be Used: Organizations can use JA4H to block or rate-limit requests from clients that exhibit suspicious HTTP request patterns, thereby mitigating the risk of automated scraping or brute-force attacks.

D. JA4Latency - Client to Server Latency Measurement / Light Distance

• Fingerprint Type: JA4L • What It Consists Of: • Latency Measurements: Time taken from client initiation to server response during the TLS handshake. • Round-Trip Time (RTT): The total time for a packet to travel to the server and back. • Packet Delay Variance: Variations in latency over multiple connections.

Filters to Use:

tls.handshake

Example Fingerprint:

150ms_latency_measurement

Why It Matters: Monitoring latency helps in identifying network performance issues and detecting attempts to disrupt or delay the TLS handshake process. Abnormal latency can indicate the presence of middleboxes, proxies, or attackers attempting timing attacks. • How It Can Be Used: Security teams can set thresholds for acceptable latency and trigger alerts when measurements exceed normal ranges, enabling proactive investigation into potential network anomalies or malicious activities.

E. JA4LatencyServer - Server to Client Latency Measurement / Light Distance

• Fingerprint Type: JA4LS • What It Consists Of: • Server-Side Latency: Time taken by the server to respond to client handshake requests. • Response Time Metrics: Detailed measurements of response times from the server’s perspective. • Latency Trends: Analysis of latency patterns over time.

Filters to Use:

tls.handshake and ip.src == <server_ip>

• Example Fingerprint:

200ms_server_latency_measurement

• Why It Matters: Server-side latency measurements provide insights into server performance and can help detect server-side issues such as resource exhaustion, misconfigurations, or deliberate tampering aimed at degrading service quality. • How It Can Be Used: By monitoring server latency, organizations can identify and address performance bottlenecks or security incidents that impact server responsiveness, ensuring reliable and secure communications.

F. JA4X509 - X509 TLS Certificate Fingerprinting

• Fingerprint Type: JA4X • What It Consists Of: • Certificate Issuer Details: Information about the Certificate Authority (CA) that issued the certificate. • Subject Information: Details about the entity to which the certificate was issued. • Public Key Algorithms: The algorithms used for the public key in the certificate. • Certificate Extensions: Additional fields and attributes included in the certificate.

Filters to Use:

tls.handshake.certificates

• Example Fingerprint:

cert_fingerprint_abcdef1234567890

• Why It Matters: JA4X509 enables the verification of certificate authenticity and integrity. Detecting rogue or untrusted certificates is essential for preventing man-in-the-middle (MITM) attacks and ensuring that communications are established with legitimate servers. • How It Can Be Used: Organizations can use JA4X509 to automatically validate certificates against trusted CAs and flag or block connections presenting certificates from untrusted or unknown issuers, thereby enhancing the security of TLS communications.

G. JA4SSH - SSH Traffic Fingerprinting

• Fingerprint Type: JA4SSH • What It Consists Of: • SSH Handshake Parameters: Initial parameters exchanged during the SSH handshake. • Key Exchange Algorithms: The algorithms used for establishing secure keys. • Encryption Methods: The encryption ciphers employed for the session. • MAC (Message Authentication Code) Algorithms: Algorithms used for ensuring message integrity.

Filters to Use:

ssh

• Example Fingerprint:

ssh_fingerprint_1234abcd5678efgh

• Why It Matters: JA4SSH helps in identifying and monitoring SSH traffic patterns, enabling the detection of unauthorized SSH tunnels, brute-force attacks, or misuse of SSH for malicious purposes. • How It Can Be Used: Security teams can implement JA4SSH fingerprints to detect and block SSH sessions that use deprecated or weak algorithms, as well as to identify unusual SSH traffic that may indicate attempted intrusions or lateral movement within the network.

H. JA4TCP - TCP Client Fingerprinting

• Fingerprint Type: JA4T • What It Consists Of: • TCP Options: Specific options set in the TCP headers, such as window scaling, selective acknowledgments, etc. • Window Sizes: The size of the TCP window used for flow control. • Initial Sequence Numbers (ISNs): The starting sequence numbers for TCP connections. • Other TCP Handshake Characteristics: Additional TCP-level parameters that can vary between clients.

Filters to Use:

tcp.flags.syn == 1 and tcp.flags.ack == 0

Example Fingerprint:

tcp_fingerprint_9a8b7c6d5e4f3g2h

• Why It Matters: TCP fingerprinting allows for the identification of client operating systems and potential spoofed connections. Recognizing unique TCP fingerprints can help in distinguishing legitimate clients from malicious actors attempting to disguise their true identity. • How It Can Be Used: Organizations can use JA4TCP fingerprints to enforce policies based on client operating systems, detect anomalies in TCP handshake parameters, and identify potential spoofing attempts, thereby strengthening network access controls.

I. JA4TCPServer - TCP Server Response Fingerprinting

• Fingerprint Type: JA4TS • What It Consists Of: • TCP Options in Server Replies: Specific TCP options set by the server in response packets. • Response Patterns: Patterns in how the server responds to connection requests. • Server-Specific TCP Behaviors: Unique behaviors exhibited by the server’s TCP stack.

Filters to Use:

tcp.flags.syn == 1 and tcp.flags.ack == 1

Example Fingerprint:

tcp_server_fingerprint_a1b2c3d4e5f6g7h8

Why It Matters: JA4TCPServer enables the identification of server operating systems and configurations. Detecting unusual or unexpected server TCP fingerprints can indicate misconfigurations, outdated systems, or compromised servers within the network. • How It Can Be Used: Security teams can monitor server TCP fingerprints to ensure consistency with known server configurations, detect unauthorized changes, and identify servers that may require updates or security patches based on their TCP behavior.

J. JA4TCPScan - Active TCP Fingerprint Scanner

• Fingerprint Type: JA4TScan • What It Consists Of: • Crafted TCP Packets: Specialized packets sent to target servers to elicit specific responses. • Response Analysis: Evaluation of server responses to determine fingerprint characteristics. • Operating System Identification: Using response patterns to infer the server’s operating system. • Filters to Use:

JA4TCPScan operates as an active scanning tool and does not use Wireshark filters. Instead, it utilizes crafted packet sequences to analyze server responses. • Example Fingerprint:

tcp_scan_fingerprint_0f1e2d3c4b5a6978

Why It Matters: Active TCP fingerprinting allows organizations to proactively assess their infrastructure for vulnerable or misconfigured servers. Identifying servers running outdated TCP stacks can help in prioritizing security updates and mitigating potential attack vectors. • How It Can Be Used: Security teams can use JA4TCPScan to perform regular scans of their external-facing servers, identifying those that exhibit fingerprints indicative of known vulnerabilities. This proactive approach enables timely remediation and strengthens the overall security posture of the organization’s network.

Example of JA4+ in Use

To illustrate the practical application of JA4+, consider the following scenario where you’re monitoring a network for potential threats.

JA4/JA4S in Action

While monitoring network traffic, you capture a JA4 fingerprint that matches known malware signatures, such as those used by botnet clients. Concurrently, the JA4S fingerprint reveals responses from unfamiliar servers, suggesting potential connections to malicious or untrusted entities.

JA4H for Deep Inspection

Deploying JA4H allows for a more thorough analysis. The extended handshake fingerprint may indicate that traffic is being tampered with, pointing to a possible MITM (Man-in-the-Middle) attack intercepting your connections.

JA4Latency for Latency Measurement

Further monitoring with JA4Latency (JA4L) uncovers that some TLS sessions exhibit abnormal latency patterns, which could signify attempts to interfere with the handshake process or evade detection through timing attacks.

JA4LatencyServer for Server-Side Latency

Using JA4LatencyServer (JA4LS), you identify that server responses are consistently delayed beyond normal thresholds, indicating potential server-side issues or malicious interventions.

JA4X509 for Certificate Verification

Implementing JA4X509 (JA4X), you detect that some TLS certificates do not match known legitimate issuers, flagging them as potential rogue certificates used in phishing or MITM attacks.

JA4SSH for SSH Monitoring

Implementing JA4SSH reveals that multiple SSH handshakes are reusing the same key exchange algorithms. This pattern raises concerns about potential brute-force SSH attacks targeting your network.

JA4TCP for Client TCP Fingerprinting

Through JA4TCP (JA4T), you identify that certain clients are using unusual TCP options and window sizes, suggesting possible spoofed connections or non-standard client configurations.

JA4TCPServer for Server TCP Fingerprinting

Using JA4TCPServer (JA4TS), you discover that some servers exhibit atypical TCP behaviors, which could indicate misconfigurations or compromised servers within your infrastructure.

JA4TCPScan for Active Scanning

With JA4TCPScan (JA4TScan), your security team actively scans external servers to identify those running outdated or vulnerable TCP configurations, allowing for proactive remediation.

Real-World Application

Scenario:

You’re monitoring outbound traffic from your organization using JA4, JA4S, and other JA4+ components. You observe unusual Client Hello fingerprints that don’t correspond to any known browsers or operating systems (e.g., they don’t match Chrome, Firefox, Edge, etc.).

Next Steps:

1. Trace the Fingerprints: Identify the external servers associated with these unusual fingerprints.
2. Verify Server Fingerprints: Use JA4S to check the server’s fingerprint, finding no matches with legitimate servers.
3. Analyze Handshake Integrity: Employ JA4H and JA4X509 to confirm that the entire handshake is being tampered with or that certificates are untrusted, indicating a possible MITM attack.

Mitigation:

Integrate JA4+ fingerprints into your Security Information and Event Management (SIEM) system to automatically flag these anomalies. Implement rules to block connections to suspicious servers or halt communication attempts flagged by JA4+.

Best Practices

To maximize the effectiveness of JA4+ in your security infrastructure, consider the following best practices:

• Use JA4+ in Combination: Employ a combination of JA4, JA4S, JA4H, and other relevant JA4+ components to gain a comprehensive understanding of client-server interactions across different protocols and layers. • Create Alerts: Configure your SIEM or Intrusion Detection/Prevention Systems (IDS/IPS) to trigger alerts for unusual or unexpected fingerprints, especially those that don’t match known devices or applications. • Continuous Monitoring: Implement ongoing monitoring with JA4Latency, JA4SSH, JA4TCP, and other JA4+ tools to detect issues like key reuse, unauthorized SSH connections, or anomalous TCP behaviors promptly. • Regular Updates: Keep the JA4+ tools and plugins updated to ensure compatibility with the latest protocols and fingerprinting techniques. • Educate Your Team: Ensure that your security team understands how to interpret JA4+ fingerprints and respond to potential threats effectively.

Conclusion

JA4+ represents a significant advancement in TLS, SSH, and TCP fingerprinting techniques, offering enhanced capabilities beyond the foundational JA3 method. By accurately identifying and monitoring both client and server interactions across multiple protocols and layers, JA4+ enables security professionals to detect anomalies, potential threats, and misconfigurations with greater precision. Integrating JA4+ into your security infrastructure empowers your organization to proactively defend against sophisticated attacks, ensuring the integrity and security of your encrypted communications.

References

• JA3 Explained • JA4 GitHub Repository • Wireshark JA3 Plugin • TLS Fingerprinting

Additional Resources

• Understanding TLS Handshakes • Advanced Network Security Techniques • Wireshark Tutorial for Beginners • SSH Protocol Overview • Detecting Man-in-the-Middle Attacks • Best Practices for Secure SSH