Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

4/22/2021
09:30 AM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Nearly Half of All Malware Is Concealed in TLS-Encrypted Communications

Forty-six percent of all malware uses the cryptographic protocol to evade detection, communicate with attacker-controlled servers, and to exfiltrate data, new study shows.

Threat actors have sharply ramped up use of the Transport Layer Security (TLS) cryptographic protocol to hide malware communications -- creating new challenges for enterprise security teams in the process.

A Sophos analysis of malware samples observed during the first three months of 2021 showed that 46%--or nearly half—of all malware that communicated with a remote system over the Internet used TLS for that purpose. This represents a 100% increase from 2020, when 23% of malware tools used TLS.

Related Content:

7 Old IT Things Every New InfoSec Pro Should Know

Special Report: How Data Breaches Affect the Enterprise

New From The Edge: How to Create an Incident Response Plan From the Ground Up

A major reason for the increase is the growing practice among cybercriminals to use legitimate TLS-protected cloud and Web services such as Google cloud services, Pastebin, Discord, and Github for hosting malware or storing stolen data, and for their command and communication operations. Also contributing to the growth is the increased use by attackers of Tor and other TLS-based network proxies to encrypt communications between malware and the threat actors behind them, Sophos said.

"The main takeaways are that there is no such thing as a 'safe' domain or service when screening for malware, and that more traditional firewall defenses based on reputation scanning without deep packet inspection cannot protect systems," says Sean Gallagher, senior threat researcher at Sophos.

The Sophos report is the latest to highlight the double-edged nature of mushrooming encryption use on the Internet. Over the past few years, privacy advocates, security experts, browser makers, and others have pushed for broad adoption of cryptographic protocols to protect Internet communications from spying and surveillance.

The efforts have resulted in the HTTPS protocol, which uses TLS, almost completely replacing the older HTTP protocol. According to Google—one of the most influential proponents of HTTPS—92% of the traffic that hits its online properties in the US uses TLS. The percentage is higher in other countries. In Belgium and India, for instance, 98% of the traffic to Google sites is encrypted; in Japan and Brazil, the number is 96%, and in Germany, 94%.

While the increased use of HTTPS and TLS overall—in email systems, VPNs, and other areas—has enabled greater privacy and security, it has also given attackers a way to use the same technology to hide their malware and malware communications from conventional detection mechanisms.

"There's nothing we can build that the bad guys can't use," says Internet pioneer Paul Vixie, the chairman, CEO, and co-founder of Farsight Security. A lot of the impetus behind TLS came from well-intentioned efforts to protect Internet users—especially in repressive countries—from having their online communications intercepted and snooped on by governments and their intelligence agencies. But the same technology has benefited attackers as well, he says. "There's no way to build technology that only benefits dissidents," he says. 

Variety of Malicious Use Cases
Sophos' analysis showed that attackers are using TLS to exfiltrate data, to carry out command-and-control communications, and to evade detection systems when distributing malware. Of that activity, a vast majority of the day-to-day malicious TLS traffic came from malware droppers, loaders, and malware tools downloading additional malware on already compromised systems.

In many instances, malware droppers and loaders used legitimate TLS-supported websites such as Pastebin, Discord, and GitHub to further disguise the traffic. Sophos pointed to a few examples, such as a PowerShell-based dropper for LockBit ransomware retrieving malicious scripts from a Google Docs spreadsheet via TLS, and the information-stealer AgentTesla grabbing additional code from Pastebin.

Sophos also observed an increase in the use of TLS in ransomware attacks, especially in instances where the malware was deployed manually. A lot of it stemmed from a surge in the use of offensive security toolkits such as Metasploit and Cobalt Strike to execute scripts, harvest system information, extract credentials, and carry out other malicious activities.

"We see TLS used predominantly in the first stages of a malware attack, and by tools focused on manually driven attacks," Gallagher says. "Most RATs and bot malware use other means to obfuscate or encrypt communications, such as hardcoded AES encryption or more simple custom-encoding."

In data exfiltration, meanwhile, threat actors are using malware that among other things can encapsulate stolen data in a TLS-based HTTPS POST or export it via a private TLS connection to Telegram, Discord, or other cloud service APIs, according to Sophos' study.

Google cloud services and India's BSNL are currently the two largest malware "callhome" destinations accounting for 9% and 8% of all malware TLS requests that Sophos observed. Overall, half of all malware-related TLS communications currently are directed to servers in the US and India.

Some of the malicious TLS traffic on enterprise networks use ports other than the standard IP ports: 443, 80, and 8080. So the full range of malicious TLS usage may be greater than what is observed on standard port numbers, Sophos concluded.

'Random Noise'
Farsight's Vixie says emerging standards such as the QUIC Internet transport protocol on which the next generation HTTP/3 is based, and DNS over HTTPS will complicate matters even further for enterprise security teams. Existing firewall technology and other detection mechanisms will be unable to detect malware concealed via these mechanisms. "No one will be able to understand what's going on," Vixie says. "All they will be able to see is pure random noise coming in," he says. "They won't be able to tell one bit of random noise from the other."

The trend will likely result in organizations being forced to older models where they allow nothing in, except what they know to be legitimate traffic: Instead of having firewalls sitting at the network edge, a proxy would sit at the border and inspect all traffic coming in and going out of the network. All packets coming from inside the network would need to disclose the destination, and policies would then be applied to determine whether to send it onward or to block it, he says.

Implementing such a model will likely be vastly inconvenient, Vixie says. Organizations instead may have to consider organizing their network topology so less sensitive data runs on the network with fewer controls, and sensitive data is placed behind a proxy.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
A Startup With NSA Roots Wants Silently Disarming Cyberattacks on the Wire to Become the Norm
Kelly Jackson Higgins, Executive Editor at Dark Reading,  5/11/2021
Edge-DRsplash-10-edge-articles
Cybersecurity: What Is Truly Essential?
Joshua Goldfarb, Director of Product Management at F5,  5/12/2021
Commentary
3 Cybersecurity Myths to Bust
Etay Maor, Sr. Director Security Strategy at Cato Networks,  5/11/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-19924
PUBLISHED: 2021-05-18
In Boostnote 0.12.1, exporting to PDF contains opportunities for XSS attacks.
CVE-2020-20220
PUBLISHED: 2021-05-18
Mikrotik RouterOs prior to stable 6.47 suffers from a memory corruption vulnerability in the /nova/bin/bfd process. An authenticated remote attacker can cause a Denial of Service (NULL pointer dereference).
CVE-2020-20227
PUBLISHED: 2021-05-18
Mikrotik RouterOs stable 6.47 suffers from a memory corruption vulnerability in the /nova/bin/diskd process. An authenticated remote attacker can cause a Denial of Service due to invalid memory access.
CVE-2020-20245
PUBLISHED: 2021-05-18
Mikrotik RouterOs stable 6.46.3 suffers from a memory corruption vulnerability in the log process. An authenticated remote attacker can cause a Denial of Service due to improper memory access.
CVE-2020-20246
PUBLISHED: 2021-05-18
Mikrotik RouterOs stable 6.46.3 suffers from a memory corruption vulnerability in the mactel process. An authenticated remote attacker can cause a Denial of Service due to improper memory access.