Rise in Malware Using Encryption Shows Importance of Network Traffic Inspection

guest · Feb 18, 2020

Rise in Malware Using Encryption Shows Importance of Network Traffic Inspection
February 18, 2020
https://www.securityweek.com/rise-m...n-shows-importance-network-traffic-inspection

The reason is simple: encryption obfuscates malware code, making it difficult to analyze; prevents users from accessing the component files in the event of an infection; and hides and secures the attackers' malicious network communication. In short, malware encryption makes it harder for traditional defenses to detect and mitigate that malware.

The success of hiding malware communications within encryption may partly explain the growth of malware taking new instructions from its C2 server over having the entire functionality coded within the malware.

"Without the protective layer of TLS encryption obfuscating the contents of this communication," writes SophosLabs threat researcher Luca Nagy, "a sharp-eyed analyst or data loss prevention tool might easily catch this type of theft in the act, before any harm may come as a result."
Click to expand...

The report highlights three prolific malware families that use encrypted communications.
The first is TrickBot, [...] TrickBot usually downloads its modules using https before injecting them into an instance of the legitimate Windows component svchost.exe.

The second family is IcedID, a banking trojan that uses web injection attacks against browsers. It too injects itself into svchost.exe, and can spread laterally through the network. Like TrickBot, it uses SSL/TLS for C2 communication.

The third family is Dridex, a banking trojan delivered by phishing campaigns and sometimes dropped by Emotet.

"Dridex frequently uses HTTPS on port 443 to download payload modules or send the collected data," comments SophosLabs. "The exfiltrated data can additionally be encrypted using RC4, if the attacker desires."
Click to expand...

"In order to protect yourself," concludes SophosLabs, "it's important to inspect network traffic and check the TLS certificate details of https communications. You should pay significant attention to unusual or unexpected volumes of https traffic to unknown domains or using invalid or forged TLS certificates."
Click to expand...

SophosLabs: Nearly a quarter of malware now communicates using TLS

itman · Feb 18, 2020

"Amen, I say to thee." And to hell with the SSl/TLS protocol naysayers.

guest · Nov 10, 2020

Malware Hidden in Encrypted Traffic Surges Amid Pandemic
November 10, 2020
https://www.darkreading.com/attacks...d-traffic-surges-amid-pandemic/d/d-id/1339420

The fact that attackers hide malware inside encrypted traffic is not news any longer. What might be surprising, however, is just how much the practice has recently spiked due in part to the shift to remote work in the COVID-19 pandemic.

Researchers from Zscaler analyzed attack data gathered from customers of the company's cloud security platform between January and September this year. The security vendor discovered a 260% increase over 2019 in the number of encrypted attacks that it handles per month.
Click to expand...

In the first nine months of this year, Zscaler's cloud blocked an average of 773 million attacks per month where malware was hidden in encrypted traffic. Last year, that number was around 283 million. In the first nine months of this year, Zscaler blocked some 6.6 billion encrypted attacks.
Ransomware attacks delivered via SSL/TLS channels soared 500% between March and September, with a plurality of the attacks (40.5%) targeted at telecommunication and technology companies.

Deepen Desai, CISO and vice president of security research at Zscaler, says the trend shows why security groups need to be wary about encrypted traffic traversing their networks.
Click to expand...

While many organizations routinely encrypt traffic as part of their security best practices, fewer are inspecting it for threats, he says.

"Most people assume that encrypted traffic means safe traffic, but that is unfortunately not the case," Desai says. "That false sense of security can create risk when organizations allow encrypted traffic to go uninspected."
Zscaler's analysis showed an in increase in SSL/TLS based attacks delivered through trusted cloud storage services such as Google, AWS, Dropbox, and OneDrive. In many of these attacks, cybercriminals hosted malicious content on these services and then lured users to the content via phishing emails and other social engineering methods
Click to expand...

Zscaler: New Research Shows Attackers Turning to Encrypted Attacks During Pandemic

SAN JOSE, November 10, 2020 -- Zscaler, Inc., the leader in cloud security, today released its 2020 State of Encrypted Attacks report, published by the Zscaler ThreatLabZ team. The threat research reveals the emerging techniques and impacted industries behind a 260-percent spike in attacks using encrypted channels to bypass legacy security controls.

The report provides guidance on how IT and security leaders can protect their enterprise from the rising trend of encrypted threats, based on insight sourced from over 6.6 billion encrypted threats across the Zscaler™ cloud from January through September 2020 over encrypted channels. To download and read, see the 2020 State of Encrypted Attacks.
Click to expand...

Log in or Sign up

Rise in Malware Using Encryption Shows Importance of Network Traffic Inspection

guest Guest

itman Registered Member

guest Guest

Log in or Sign up

Rise in Malware Using Encryption Shows Importance of Network Traffic Inspection

guest Guest

itman Registered Member

guest Guest

Useful Searches