Report: Hackers increasingly use encryption to hide malware

Hackers are increasingly benefiting from poorly managed encryption technologies deployed by organizations, according to a new repor​t from application networking and security firm A10 Networks in partnership with the Ponemon Institute.

Hackers are increasingly benefiting from poorly managed encryption technologies deployed by organizations, according to a new report from application networking and security firm A10 Networks in partnership with the Ponemon Institute.

The survey of 1,023 IT professionals suggests that encryption is allowing for some malware to surpass cybersecurity measures — including firewalls, secure web gateways and anti-malware solutions — by otherwise hiding in plain internet traffic.

“Encryption technology that is crucial to protecting sensitive data in transit, such as web transactions, emails and mobile apps, can allow malware hiding inside that encrypted traffic to pass uninspected,” the report reads.

While internal data that is purposefully encrypted presents an apparent security challenge to scan, a majority of the survey’s respondents also believe that hackers will increasingly leverage SSL encryption to evade both detection and bypass controls in the future.

Over the last 12 months, malware used in nearly half of the cyber attacks witnessed by respondents sneaked into systems due, in some part, to encryption.

Even so, the use of encryption to hide malware is nothing new.

“SSL encryption has become a ubiquitous tool for the enemy to hide sensitive data transfers and to obfuscate their command and control communications,” a November 2013 SANS Institute white paper separately states.

Formally known as secure sockets layer, SSL is a fundamental security technology, which establishes an encrypted link between two machines — usually a web server and an internet browser.

Though 75 percent of A10 Networks’ survey respondents said that malware hidden inside encrypted traffic represents a tangible risk to their enterprise networks, roughly two-thirds admitted they are completely unprepared to detect this malicious SSL traffic.

The largest group of survey respondents said they work in the financial services industry.

Broadly, companies are accepting more encrypted traffic as they shift towards cloud services, which is leading malware architects to take advantage of this common form of transport encryption, according to the SANS Institute.

By 2017, Gartner believes that more than 50 percent of cyber attacks targeting enterprises will use some form of SSL encryption.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure