Helol Tunnel: Covert Channel Exploitation of TLS Extensibility & Privacy Features

RFC 8701 GREASE anti-ossification measures require compliant NGFWs and middleboxes to preserve TLS CHLO parameter orderings unmodified; simultaneously, popular browsers and applications randomize their JA3 fingerprints by shuffling cipher suites and extension order as a privacy measure. These two trends together make traffic with varied TLS CHLO orderings indistinguishable from legitimate application traffic at static inspection, eliminating a reliable detection signal for censors.

§3 / Remark 1 defense tls-fingerprintmiddlebox-interference generic

Static NGFW inspection cannot distinguish Helol tunnel TLS CHLO packets from legitimate privacy-motivated parameter randomization; only advanced statistical or ML monitoring of 'incumbent TLS CHLO trends' could potentially surface anomalies (§5). Local captures across 9 devices over 4 days yielded 96,825 TLS CHLO packets with only 137 distinct parameter-combination fingerprints, illustrating that real traffic is sparse enough for ML baselines to be practical but that the cover population is large.

§5 / §6.2 detection tls-fingerprintml-classifier generic

Empirical testing of 3 enterprise NGFWs (2020–2024 software) found that 2 out of 3 complied with anti-ossification measures and preserved TLS CHLO parameter ordering, making them fully vulnerable to permutation-encoded covert channels; all 3 preserved parameter values within NIST-allowed sets, leaving all vulnerable to the lower-throughput bitmap (selection) encoding. None of the 3 products raised warnings about simulated malware sending repetitive TLS CHLO packets.

Appendix B / Table 2 evaluation tls-fingerprintdpimiddlebox-interference generic

Helol tunnel supports a 'passive (IP-less)' variant in which an insider agent with tap access to layer-3 traffic encodes messages in the ordering of TLS CHLO parameters belonging to incumbent connections traversing the wire, without originating any new IP flows. This bypasses NGFW explicit-proxy and CGNAT defenses that prevent direct socket connections from internal hosts to the Internet.

Appendix C defense dpitls-fingerprintmiddlebox-interference generic

The Helol tunnel encodes data in the permutation of TLS CHLO list-type parameters (cipher suites, extensions, elliptic curves, signature hashing algorithms), achieving a median throughput of roughly 8–12 bytes/packet from cipher-suite permutation alone, significantly outperforming SNICat across median and upper quartiles. The per-packet payload from full factorial encoding is ⌊log₂ N!⌋ bits for a list of N elements, yielding ~17–22 bytes/packet at median cipher-suite list lengths observed in local captures.

§6.1 / Figure 4–5 defense tls-fingerprint generic