John Althouse
John Althouse was previously at Salesforce for 10 years as the Director of Threat Detection. While there, John and his team created notable network fingerprinting methods such as JA3/S, JARM, and HASSH, used throughout the industry. He is now working on JA4+ network fingerprinting to solve as many cybersecurity challenges as possible.
Sessions
In this presentation I will explain how JA4+ network fingerprinting works and show you how to use it to detect malware clients, their c2 servers, reverse SSH shells, connections from proxies and VPNs, estimating the location of the true client behind the proxy or VPN, and a lot more, all just by passively looking at the network traffic with JA4+ and without the need to break encryption.
JA4+ is free and available across a wide range of open source and vendor tools you already use including Wireshark, Zeek, Arkime, Suricata, Censys, Vectra, etc.