Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

End of Bibblio RCM includes -->
09:30 AM
Connect Directly

Nearly Half of All Malware Is Concealed in TLS-Encrypted Communications

Forty-six percent of all malware uses the cryptographic protocol to evade detection, communicate with attacker-controlled servers, and to exfiltrate data, new study shows.

Threat actors have sharply ramped up use of the Transport Layer Security (TLS) cryptographic protocol to hide malware communications -- creating new challenges for enterprise security teams in the process.

A Sophos analysis of malware samples observed during the first three months of 2021 showed that 46%--or nearly half—of all malware that communicated with a remote system over the Internet used TLS for that purpose. This represents a 100% increase from 2020, when 23% of malware tools used TLS.

Related Content:

7 Old IT Things Every New InfoSec Pro Should Know

Special Report: How Data Breaches Affect the Enterprise

New From The Edge: How to Create an Incident Response Plan From the Ground Up

A major reason for the increase is the growing practice among cybercriminals to use legitimate TLS-protected cloud and Web services such as Google cloud services, Pastebin, Discord, and Github for hosting malware or storing stolen data, and for their command and communication operations. Also contributing to the growth is the increased use by attackers of Tor and other TLS-based network proxies to encrypt communications between malware and the threat actors behind them, Sophos said.

"The main takeaways are that there is no such thing as a 'safe' domain or service when screening for malware, and that more traditional firewall defenses based on reputation scanning without deep packet inspection cannot protect systems," says Sean Gallagher, senior threat researcher at Sophos.

The Sophos report is the latest to highlight the double-edged nature of mushrooming encryption use on the Internet. Over the past few years, privacy advocates, security experts, browser makers, and others have pushed for broad adoption of cryptographic protocols to protect Internet communications from spying and surveillance.

The efforts have resulted in the HTTPS protocol, which uses TLS, almost completely replacing the older HTTP protocol. According to Google—one of the most influential proponents of HTTPS—92% of the traffic that hits its online properties in the US uses TLS. The percentage is higher in other countries. In Belgium and India, for instance, 98% of the traffic to Google sites is encrypted; in Japan and Brazil, the number is 96%, and in Germany, 94%.

While the increased use of HTTPS and TLS overall—in email systems, VPNs, and other areas—has enabled greater privacy and security, it has also given attackers a way to use the same technology to hide their malware and malware communications from conventional detection mechanisms.

"There's nothing we can build that the bad guys can't use," says Internet pioneer Paul Vixie, the chairman, CEO, and co-founder of Farsight Security. A lot of the impetus behind TLS came from well-intentioned efforts to protect Internet users—especially in repressive countries—from having their online communications intercepted and snooped on by governments and their intelligence agencies. But the same technology has benefited attackers as well, he says. "There's no way to build technology that only benefits dissidents," he says. 

Variety of Malicious Use Cases
Sophos' analysis showed that attackers are using TLS to exfiltrate data, to carry out command-and-control communications, and to evade detection systems when distributing malware. Of that activity, a vast majority of the day-to-day malicious TLS traffic came from malware droppers, loaders, and malware tools downloading additional malware on already compromised systems.

In many instances, malware droppers and loaders used legitimate TLS-supported websites such as Pastebin, Discord, and GitHub to further disguise the traffic. Sophos pointed to a few examples, such as a PowerShell-based dropper for LockBit ransomware retrieving malicious scripts from a Google Docs spreadsheet via TLS, and the information-stealer AgentTesla grabbing additional code from Pastebin.

Sophos also observed an increase in the use of TLS in ransomware attacks, especially in instances where the malware was deployed manually. A lot of it stemmed from a surge in the use of offensive security toolkits such as Metasploit and Cobalt Strike to execute scripts, harvest system information, extract credentials, and carry out other malicious activities.

"We see TLS used predominantly in the first stages of a malware attack, and by tools focused on manually driven attacks," Gallagher says. "Most RATs and bot malware use other means to obfuscate or encrypt communications, such as hardcoded AES encryption or more simple custom-encoding."

In data exfiltration, meanwhile, threat actors are using malware that among other things can encapsulate stolen data in a TLS-based HTTPS POST or export it via a private TLS connection to Telegram, Discord, or other cloud service APIs, according to Sophos' study.

Google cloud services and India's BSNL are currently the two largest malware "callhome" destinations accounting for 9% and 8% of all malware TLS requests that Sophos observed. Overall, half of all malware-related TLS communications currently are directed to servers in the US and India.

Some of the malicious TLS traffic on enterprise networks use ports other than the standard IP ports: 443, 80, and 8080. So the full range of malicious TLS usage may be greater than what is observed on standard port numbers, Sophos concluded.

'Random Noise'
Farsight's Vixie says emerging standards such as the QUIC Internet transport protocol on which the next generation HTTP/3 is based, and DNS over HTTPS will complicate matters even further for enterprise security teams. Existing firewall technology and other detection mechanisms will be unable to detect malware concealed via these mechanisms. "No one will be able to understand what's going on," Vixie says. "All they will be able to see is pure random noise coming in," he says. "They won't be able to tell one bit of random noise from the other."

The trend will likely result in organizations being forced to older models where they allow nothing in, except what they know to be legitimate traffic: Instead of having firewalls sitting at the network edge, a proxy would sit at the border and inspect all traffic coming in and going out of the network. All packets coming from inside the network would need to disclose the destination, and policies would then be applied to determine whether to send it onward or to block it, he says.

Implementing such a model will likely be vastly inconvenient, Vixie says. Organizations instead may have to consider organizing their network topology so less sensitive data runs on the network with fewer controls, and sensitive data is placed behind a proxy.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
How Machine Learning, AI & Deep Learning Improve Cybersecurity
Machine intelligence is influencing all aspects of cybersecurity. Organizations are implementing AI-based security to analyze event data using ML models that identify attack patterns and increase automation. Before security teams can take advantage of AI and ML tools, they need to know what is possible. This report covers: -How to assess the vendor's AI/ML claims -Defining success criteria for AI/ML implementations -Challenges when implementing AI
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2022-09-24
Nepxion Discovery is a solution for Spring Cloud. Discover is vulnerable to SpEL Injection in discovery-commons. DiscoveryExpressionResolver’s eval method is evaluating expression with a StandardEvaluationContext, allowing the expression to reach and interact with Java classes suc...
PUBLISHED: 2022-09-24
Nepxion Discovery is a solution for Spring Cloud. Discovery is vulnerable to a potential Server-Side Request Forgery (SSRF). RouterResourceImpl uses RestTemplate’s getForEntity to retrieve the contents of a URL containing user-controlled input, potentially resulting in Information...
PUBLISHED: 2022-09-24
Jodit Editor is a WYSIWYG editor written in pure TypeScript without the use of additional libraries. Jodit Editor is vulnerable to XSS attacks when pasting specially constructed input. This issue has not been fully patched. There are no known workarounds.
PUBLISHED: 2022-09-24
Besu is a Java-based Ethereum client. In versions newer than 22.1.3 and prior to 22.7.1, Besu is subject to an Incorrect Conversion between Numeric Types. An error in 32 bit signed and unsigned types in the calculation of available gas in the CALL operations (including DELEGATECALL) results in incor...
PUBLISHED: 2022-09-24
MyGraph is a permission management system. Versions prior to 1.0.4 are vulnerable to a storage XSS vulnerability leading to Remote Code Execution. This issue is patched in version 1.0.4. There is no known workaround.