Encryption Growing in Importance for Enterprises AS WELL AS Malware Developers!
This was originally taken from an article (below) on a product that Cisco had introduced that can determine if traffic is malware even if it is encrypted with over 90% accuracy.
The thing that I found interesting about the article is that – according to Cisco, today 55% of web traffic and Gartner sees that growing to 80% by 2019 – next year! Cisco also claims that up to 41% of hackers are now encrypting their malware traffic as well.
Cisco’s Encrypted Traffic Analytics (ETA), which monitors network packet metadata to detect malicious traffic even if its encrypted, is now generally available.
https://www.networkworld.com/article/3246195/lan-wan/how-cisco-s-newest-security-tool-can-detect-malware-in-encrypted-traffic.html
Cisco’s Encrypted Traffic Analytics (ETA), a software platform that monitors network packet metadata to detect malicious traffic, even if its encrypted, is now generally available.
The company initially launched ETA in June, 2017 during the launch of its intent-based network strategy and it’s been in a private preview since then. Today Cisco rolled ETA out beyond just the enterprises switches it was originally designed for and made it available on current and previous generation data center network hardware too.
Cisco
Cisco’s Encrypted Traffic Analytics uses a software named Stealthwatch to compare the metadata of benign and malicious network packets to identified malicious traffic, even if its encrypted.
What ETA is
Encrypted Traffic Analytics is a product deployed on customers’ premises that monitors their network and collects information about traffic flows. It uses a series of sensors placed throughout the network to screen all traffic traversing through it. ETA uses a combination of local analysis engines combined with a cloud-based platform that analyzes anonymized metadata about network traffic to search for and block malicious traffic, even if it’s encrypted.
Cisco launched ETA during its intent based networking (IBN) strategy rollout because it uses some of the advanced software the company developed for IBN, including machine learning components that evolve to protect against changing vulnerabilities.
How ETA works
ETA collects metadata about traffic flows using a modified version of NetFlow and searches for characteristics that indicate the traffic could be malicious. It inspects the initial data packet, which is translated in the clear, even in encrypted traffic. It also records the size, shape and sequence of packets, how long they take to traverse the network, and it monitors for other suspicious characteristics such as a self-signed certificate, or whether it has command-and-control identifiers on it.
All of this data can be collected on traffic, even if its encrypted. “ETA uses network visibility and multi-layer machine learning to look for observable differences between benign and malware traffic,” Cisco explains in a blog post announcing ETA.
If characteristics of malicious traffic are identified in any packets, they are flagged for further ianalysis through deep packet inspection and potential blocking by an existing security appliance like a firewall.
ETA’s monitoring system is named StealthWatch and the cloud-based data store is named Talos. Meanwhile, if traffic is identified as malicious, ETA can report it to Cisco’s DNA Center network management software to ensure that traffic is blocked throughout the entire network. Cisco says its using machine learning algorithms to train ETA to search for new vulnerabilities and adapt to changing ones.
“When you’re doing security, the more visibility the better,” explains Scott Harrell, Cisco senior vice president and general manager of enterprise networking. “You want to have a huge wealth of data, not just about what’s happening in real-time, but what’s happened historically. A lot of times in security, there is smoke before you know there is fire.”
If potentially malicious traffic has been identified, information such as which host initiated the conversation and what information was exchanged are important to determine the scope of a problem, Harrell says.
Why ETA could be a big deal
More and more traffic is encrypted. Cisco estimates 55% of traffic on the web is encrypted now, a figure that Gartner predicts will grow to 80% by 2019. Meanwhile, up to 41% of hackers use encryption to evade detection, Cisco says.
Organizations use a range of options for ensuring the security of encrypted traffic in their networks. Most of these approaches use next-generation firewalls, deep packet inspection (DPI) or Secure Socket Layer (SSL) inspection. Harrell says these tools require some sort of tradeoff though. SSL inspection, for example, intercepts and decrypts traffic to determine if it is malicious and only after it’s confirmed to be safe will complete the connection. Malware can infect that SSL inspection, leaving it vulnerable. Harell argues that its inefficient to decrypt all traffic, then re-encrypt it before allowing users to access it. Cisco says it is the first company to have developed a way to monitor encrypted traffic for vulnerabilities.
IoT security
Harell says ETA could be important in the world of IoT, too. ETA’s ability to monitor encrypted traffic’s metadata means it could analyze all IoT traffic without necessarily needing to put security tools like firewalls on each of the small-form-factor IoT devices.
Cisco says ETA has another benefit: cryptographic compliance. Some organizations are required to use certain levels of encryption for regulatory reasons. ETA, through its use of analysis metadata, can provide proof of certain levels and types of encryption being used.
Police take down the world’s largest DDoS-for-hire service
https://finance.yahoo.com/news/police-down-world-apos-largest-043200031.html
A combined contingent of law enforcement officials from the US, UK and Netherlands has shut down what was once deemed as the worlds largest contract DDoS service. The article describes how, for as little as $15, someone could order up a massive bot swarm to successfully attack almost any website by flooding it with useless traffic using a Distributed Denial of Service tool called ‘WebStresser’. The arrests were not just restricted to the US, UK and Netherlands – they included individuals from around the world from as far away as Australia.
Warning – 3 Popular VPN Services Are Leaking Your IP Address
Warning – 3 Popular VPN Services Are Leaking Your IP Address
https://thehackernews.com/2018/03/vpn-leak-ip-address.html
A team of security researchers discovered vulnerable flaws with three VPN service providers that could compromise user privacy. The three service providers; HotSpot Shield, PureVPN, and Zenmate have millions of customers worldwide. One of the providers, PureVPN had previously been caught lying about not logging its customers traffic when it was reveiled that they had provided the FBI with logs that lead to the arrest of a man in a cyberstalking case.
The research team discovered after running a series of privacy tests that all three VPN services were leaking their user’s real IP address.
The exact issues in ZenMate and PureVPN were not disclosed because they have not been patched yet.
Three separate vulnerabilities were discovered:
CVE-2018-7879 Hijack all traffic: Allows remote hackers to potentially hijack and redirect victim web traffic to a malicious site.
CVE-2018-7878, DNS Leak: Exposes the users original IP address to the DNS server, allowing ISP’s to monitor and record user activities.
CVE-2018-7880 Real IP Address Leak: Allows hackers to track the users real location
Researchers believe that most other VPN services also suffer from similar issues.
El Cheapo Man-in-the-middle Attack Example Video and PPT Available
I wrote an example of a *very* basic, ‘El-Cheapo’ man-in-the-middle attack that leverages the Python socket library to ‘eavesdrop’ on a series of message transmissions between a ‘legitimate server’ VM and its associated ‘client’ VM. The ‘legitimate’ messages are just basic text messages and a message sequence number.
Basically, the attacking VM, called ‘Evil Server’, spins up a Python socket receive thread that ‘hoovers in’ any traffic destined for a predetermined UDP port number and then displays those messages (i.e., the messages sent by the ‘legitimate’ server that were intended only for the client) .
Evil Server then spins up a send thread which basically starts infinitely broadcasting an ‘Evil Server message’ which get injected into all the other legitimate messages that are being sent by the legitimate server.
I put delays into the evil server broadcasts so that you can see the intermingled messages that hit the client – otherwise evil server could also be used as a simple denial of service tool that would swamp both the client and the server as well.
I posted a 5 minute demo video and a ppt deck that explains the environment – the box link is below
comments welcome.
https://www.dropbox.com/sh/myuz5kmq8llgogy/AABGN4yYKRJSn86dlkq4ziCXa?dl=0
Atlanta spends more than $2 million to recover from ransomware attack
https://finance.yahoo.com/news/atlanta-spends-more-2-million-202000413.html
. the attackers ‘only’ asked for $51K but the city of Atlanta ended up shelling out $2.7M for what ultimately became an unmitigated disaster and cautionary tale about crisis management and the importance of taking basic steps to protect systems.