Chisel
Chisel is an open-source tool primarily used for creating secure tunnels over HTTP or WebSocket protocols. While it is designed for legitimate purposes, such as bypassing restrictive firewalls, it has also been misused by threat actors to facilitate unauthorized access to networks. Chisel operates as a fast TCP/UDP tunnel, which can be used to forward traffic between a client and a server, allowing for covert communication channels. As of October 2023, Chisel continues to be a tool of interest in both cybersecurity defenses and attacks.
Overview
Chisel is a tunneling tool that creates secure connections over HTTP or WebSocket protocols. It is designed to work efficiently in environments with strict firewall rules. The tool is open-source and available on platforms like GitHub, making it accessible to both legitimate users and malicious actors. Chisel's ability to tunnel TCP/UDP traffic allows it to bypass network restrictions, making it a valuable tool for penetration testers and attackers alike.
History
Chisel was initially developed as a legitimate tool for network administrators and security professionals to bypass restrictive firewalls and perform network diagnostics. Over time, its capabilities attracted the attention of threat actors who began using it for malicious purposes. The tool's open-source nature and ease of use have contributed to its popularity in both legitimate and illicit activities.
Technical characteristics
Chisel operates by establishing a client-server architecture. The client component runs on the machine that needs to bypass network restrictions, while the server component runs on a machine with unrestricted internet access. The client connects to the server over HTTP or WebSocket, creating a tunnel that can forward TCP/UDP traffic. This setup allows Chisel to bypass firewalls and network monitoring tools, making it difficult to detect.
Chisel is written in the Go programming language, which contributes to its speed and efficiency. It supports encryption, ensuring that the data transmitted through the tunnel remains secure. The tool can also compress data to optimize bandwidth usage.
Infection vector
Chisel itself is not malware, but it can be used as part of a larger attack strategy. Threat actors typically deploy Chisel after gaining initial access to a network. They may use phishing emails, exploiting vulnerabilities, or other social engineering techniques to compromise a system. Once inside, attackers can use Chisel to establish a covert communication channel, facilitating [lateral movement] within the network and exfiltrating data.
Notable campaigns
Chisel has been observed in various cyber campaigns where threat actors use it to maintain persistence and evade detection. For example, in some advanced persistent threat (APT) operations, attackers have used Chisel to create tunnels that allow them to control compromised systems remotely. These campaigns often target organizations with valuable data, such as financial institutions and government agencies.
Detection and mitigation
Detecting Chisel can be challenging due to its ability to blend in with legitimate network traffic. However, network administrators can look for unusual outbound connections over HTTP or WebSocket protocols, especially those that do not match typical user behavior. Implementing network monitoring solutions that analyze traffic patterns and flag anomalies can help identify potential Chisel usage.
Mitigation strategies include restricting outbound connections to known and trusted destinations, employing intrusion detection systems (IDS) to monitor for suspicious activity, and conducting regular security audits to identify and patch vulnerabilities. Educating employees about phishing and other social engineering tactics can also reduce the risk of initial compromise.