Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

4/22/2021
09:30 AM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Nearly Half of All Malware Is Concealed in TLS-Encrypted Communications

Forty-six percent of all malware uses the cryptographic protocol to evade detection, communicate with attacker-controlled servers, and to exfiltrate data, new study shows.

Threat actors have sharply ramped up use of the Transport Layer Security (TLS) cryptographic protocol to hide malware communications -- creating new challenges for enterprise security teams in the process.

A Sophos analysis of malware samples observed during the first three months of 2021 showed that 46%--or nearly half—of all malware that communicated with a remote system over the Internet used TLS for that purpose. This represents a 100% increase from 2020, when 23% of malware tools used TLS.

Related Content:

7 Old IT Things Every New InfoSec Pro Should Know

Special Report: How Data Breaches Affect the Enterprise

New From The Edge: How to Create an Incident Response Plan From the Ground Up

A major reason for the increase is the growing practice among cybercriminals to use legitimate TLS-protected cloud and Web services such as Google cloud services, Pastebin, Discord, and Github for hosting malware or storing stolen data, and for their command and communication operations. Also contributing to the growth is the increased use by attackers of Tor and other TLS-based network proxies to encrypt communications between malware and the threat actors behind them, Sophos said.

"The main takeaways are that there is no such thing as a 'safe' domain or service when screening for malware, and that more traditional firewall defenses based on reputation scanning without deep packet inspection cannot protect systems," says Sean Gallagher, senior threat researcher at Sophos.

The Sophos report is the latest to highlight the double-edged nature of mushrooming encryption use on the Internet. Over the past few years, privacy advocates, security experts, browser makers, and others have pushed for broad adoption of cryptographic protocols to protect Internet communications from spying and surveillance.

The efforts have resulted in the HTTPS protocol, which uses TLS, almost completely replacing the older HTTP protocol. According to Google—one of the most influential proponents of HTTPS—92% of the traffic that hits its online properties in the US uses TLS. The percentage is higher in other countries. In Belgium and India, for instance, 98% of the traffic to Google sites is encrypted; in Japan and Brazil, the number is 96%, and in Germany, 94%.

While the increased use of HTTPS and TLS overall—in email systems, VPNs, and other areas—has enabled greater privacy and security, it has also given attackers a way to use the same technology to hide their malware and malware communications from conventional detection mechanisms.

"There's nothing we can build that the bad guys can't use," says Internet pioneer Paul Vixie, the chairman, CEO, and co-founder of Farsight Security. A lot of the impetus behind TLS came from well-intentioned efforts to protect Internet users—especially in repressive countries—from having their online communications intercepted and snooped on by governments and their intelligence agencies. But the same technology has benefited attackers as well, he says. "There's no way to build technology that only benefits dissidents," he says. 

Variety of Malicious Use Cases
Sophos' analysis showed that attackers are using TLS to exfiltrate data, to carry out command-and-control communications, and to evade detection systems when distributing malware. Of that activity, a vast majority of the day-to-day malicious TLS traffic came from malware droppers, loaders, and malware tools downloading additional malware on already compromised systems.

In many instances, malware droppers and loaders used legitimate TLS-supported websites such as Pastebin, Discord, and GitHub to further disguise the traffic. Sophos pointed to a few examples, such as a PowerShell-based dropper for LockBit ransomware retrieving malicious scripts from a Google Docs spreadsheet via TLS, and the information-stealer AgentTesla grabbing additional code from Pastebin.

Sophos also observed an increase in the use of TLS in ransomware attacks, especially in instances where the malware was deployed manually. A lot of it stemmed from a surge in the use of offensive security toolkits such as Metasploit and Cobalt Strike to execute scripts, harvest system information, extract credentials, and carry out other malicious activities.

"We see TLS used predominantly in the first stages of a malware attack, and by tools focused on manually driven attacks," Gallagher says. "Most RATs and bot malware use other means to obfuscate or encrypt communications, such as hardcoded AES encryption or more simple custom-encoding."

In data exfiltration, meanwhile, threat actors are using malware that among other things can encapsulate stolen data in a TLS-based HTTPS POST or export it via a private TLS connection to Telegram, Discord, or other cloud service APIs, according to Sophos' study.

Google cloud services and India's BSNL are currently the two largest malware "callhome" destinations accounting for 9% and 8% of all malware TLS requests that Sophos observed. Overall, half of all malware-related TLS communications currently are directed to servers in the US and India.

Some of the malicious TLS traffic on enterprise networks use ports other than the standard IP ports: 443, 80, and 8080. So the full range of malicious TLS usage may be greater than what is observed on standard port numbers, Sophos concluded.

'Random Noise'
Farsight's Vixie says emerging standards such as the QUIC Internet transport protocol on which the next generation HTTP/3 is based, and DNS over HTTPS will complicate matters even further for enterprise security teams. Existing firewall technology and other detection mechanisms will be unable to detect malware concealed via these mechanisms. "No one will be able to understand what's going on," Vixie says. "All they will be able to see is pure random noise coming in," he says. "They won't be able to tell one bit of random noise from the other."

The trend will likely result in organizations being forced to older models where they allow nothing in, except what they know to be legitimate traffic: Instead of having firewalls sitting at the network edge, a proxy would sit at the border and inspect all traffic coming in and going out of the network. All packets coming from inside the network would need to disclose the destination, and policies would then be applied to determine whether to send it onward or to block it, he says.

Implementing such a model will likely be vastly inconvenient, Vixie says. Organizations instead may have to consider organizing their network topology so less sensitive data runs on the network with fewer controls, and sensitive data is placed behind a proxy.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
FluBot Malware's Rapid Spread May Soon Hit US Phones
Kelly Sheridan, Staff Editor, Dark Reading,  4/28/2021
Slideshows
7 Modern-Day Cybersecurity Realities
Steve Zurier, Contributing Writer,  4/30/2021
Commentary
How to Secure Employees' Home Wi-Fi Networks
Bert Kashyap, CEO and Co-Founder at SecureW2,  4/28/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-26543
PUBLISHED: 2021-05-06
The "gitDiff" function in Wayfair git-parse <=1.0.4 has a command injection vulnerability. Clients of the git-parse library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability.
CVE-2021-27216
PUBLISHED: 2021-05-06
Exim 4 before 4.94.2 has Execution with Unnecessary Privileges. By leveraging a delete_pid_file race condition, a local user can delete arbitrary files as root. This involves the -oP and -oPX options.
CVE-2021-29490
PUBLISHED: 2021-05-06
Jellyfin is a free software media system that provides media from a dedicated server to end-user devices via multiple apps. Verions prior to 10.7.3 vulnerable to unauthenticated Server-Side Request Forgery (SSRF) attacks via the imageUrl parameter. This issue potentially exposes both internal and ex...
CVE-2021-29491
PUBLISHED: 2021-05-06
Mixme is a library for recursive merging of Javascript objects. In Node.js mixme v0.5.0, an attacker can add or alter properties of an object via 'proto' through the mutate() and merge() functions. The polluted attribute will be directly assigned to every object in the program. This will put the ava...
CVE-2021-29921
PUBLISHED: 2021-05-06
Improper input validation of octal strings in Python stdlib ipaddress 3.10 and below allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many programs that rely on Python stdlib ipaddress. IP address octects are left stripped instead of evaluated as valid I...