Uncategorized

This was originally taken from an article (below) on a product that Cisco had introduced that can determine if traffic is malware even if it is encrypted with over 90% accuracy.

The thing that I found interesting about the article is that – according to Cisco, today 55% of web traffic and Gartner sees that growing to 80% by 2019 – next year!  Cisco also claims that up to 41% of hackers are now encrypting their malware traffic as well.

Cisco’s Encrypted Traffic Analytics (ETA), which monitors network packet metadata to detect malicious traffic even if its encrypted, is now generally available.

https://www.networkworld.com/article/3246195/lan-wan/how-cisco-s-newest-security-tool-can-detect-malware-in-encrypted-traffic.html

Cisco’s Encrypted Traffic Analytics (ETA), a software platform that monitors network packet metadata to detect malicious traffic, even if its encrypted, is now generally available.

The company initially launched ETA in June, 2017 during the launch of its intent-based network strategy and it’s been in a private preview since then. Today Cisco rolled ETA out beyond just the enterprises switches it was originally designed for and made it available on current and previous generation data center network hardware too.

Cisco

Cisco’s Encrypted Traffic Analytics uses a software named Stealthwatch to compare the metadata of benign and malicious network packets to identified malicious traffic, even if its encrypted.

What ETA is

Encrypted Traffic Analytics is a product deployed on customers’ premises that monitors their network and collects information about traffic flows. It uses a series of sensors placed throughout the network to screen all traffic traversing through it. ETA uses a combination of local analysis engines combined with a cloud-based platform that analyzes anonymized metadata about network traffic to search for and block malicious traffic, even if it’s encrypted.

Cisco launched ETA during its intent based networking (IBN) strategy rollout because it uses some of the advanced software the company developed for IBN, including machine learning components that evolve to protect against changing vulnerabilities.

How ETA works

ETA collects metadata about traffic flows using a modified version of NetFlow and searches for characteristics that indicate the traffic could be malicious. It inspects the initial data packet, which is translated in the clear, even in encrypted traffic. It also records the size, shape and sequence of packets, how long they take to traverse the network, and it monitors for other suspicious characteristics such as a self-signed certificate, or whether it has command-and-control identifiers on it.

All of this data can be collected on traffic, even if its encrypted. “ETA uses network visibility and multi-layer machine learning to look for observable differences between benign and malware traffic,” Cisco explains in a blog post announcing ETA.

If characteristics of malicious traffic are identified in any packets, they are flagged for further ianalysis through deep packet inspection and potential blocking by an existing security appliance like a firewall.

ETA’s monitoring system is named StealthWatch and the cloud-based data store is named Talos. Meanwhile, if traffic is identified as malicious, ETA can report it to Cisco’s DNA Center network management software to ensure that traffic is blocked throughout the entire network. Cisco says its using machine learning algorithms to train ETA to search for new vulnerabilities and adapt to changing ones.

“When you’re doing security, the more visibility the better,” explains Scott Harrell, Cisco senior vice president and general manager of enterprise networking. “You want to have a huge wealth of data, not just about what’s happening in real-time, but what’s happened historically. A lot of times in security, there is smoke before you know there is fire.”

If potentially malicious traffic has been identified, information such as which host initiated the conversation and what information was exchanged are important to determine the scope of a problem, Harrell says.

Why ETA could be a big deal

More and more traffic is encrypted. Cisco estimates 55% of traffic on the web is encrypted now, a figure that Gartner predicts will grow to 80% by 2019. Meanwhile, up to 41% of hackers use encryption to evade detection, Cisco says.

Organizations use a range of options for ensuring the security of encrypted traffic in their networks. Most of these approaches use next-generation firewalls, deep packet inspection (DPI) or Secure Socket Layer (SSL) inspection. Harrell says these tools require some sort of tradeoff though. SSL inspection, for example, intercepts and decrypts traffic to determine if it is malicious and only after it’s confirmed to be safe will complete the connection. Malware can infect that SSL inspection, leaving it vulnerable. Harell argues that its inefficient to decrypt all traffic, then re-encrypt it before allowing users to access it. Cisco says it is the first company to have developed a way to monitor encrypted traffic for vulnerabilities.

IoT security 

Harell says ETA could be important in the world of IoT, too. ETA’s ability to monitor encrypted traffic’s metadata means it could analyze all IoT traffic without necessarily needing to put security tools like firewalls on each of the small-form-factor IoT devices.

Cisco says ETA has another benefit: cryptographic compliance. Some organizations are required to use certain levels of encryption for regulatory reasons. ETA, through its use of analysis metadata, can provide proof of certain levels and types of encryption being used.

https://finance.yahoo.com/news/police-down-world-apos-largest-043200031.html

A combined contingent of law enforcement officials from the US, UK and Netherlands has shut down what was once deemed as the worlds largest contract DDoS service.  The article describes how, for as little as $15, someone could order up a massive bot swarm to successfully attack almost any website by flooding it with useless traffic using a Distributed Denial of Service  tool called ‘WebStresser’.  The arrests were not just restricted to the US, UK and Netherlands – they included individuals from around the world from as far away as Australia.

I am not sure if anyone else watch congresses questioning of Mark Zukerberg, but I did.  It was streamed live on Bloomberg nation and CNBC.  While I was watching and listening, I was shocked at how uneducated our government leaders are on technology.  I actually found a youtube video explaining what I mean.  Here are a few questions our leaders, who are supposed to sign laws, asked.  It is shocking.  I actually remember some of these questions and couldn’t believe they were being asked.

Big earning 350k+ as bugs hunter.

http://www.bbc.com/news/technology-43581624

Warning – 3 Popular VPN Services Are Leaking Your IP Address

https://thehackernews.com/2018/03/vpn-leak-ip-address.html

A team of security researchers discovered vulnerable flaws with three VPN service providers that could compromise user privacy. The three service providers; HotSpot Shield, PureVPN, and Zenmate   have millions of customers worldwide.  One of the providers, PureVPN had previously been caught lying about not logging its customers traffic when it was reveiled that they had provided the FBI with logs that lead to the arrest of a man in a cyberstalking case.

The research team discovered after running a series of privacy tests that all three VPN services were leaking their user’s real IP address.

The exact issues in ZenMate and PureVPN were not disclosed because they have not been patched yet.

Three separate vulnerabilities were discovered:

CVE-2018-7879 Hijack all traffic:      Allows remote hackers to potentially hijack and redirect victim web traffic to a malicious site.

CVE-2018-7878, DNS Leak:    Exposes the users original IP address to the DNS server, allowing ISP’s to monitor and record user activities.

CVE-2018-7880 Real IP Address Leak:      Allows hackers to track the users real location

Researchers believe that most other VPN services also suffer from similar issues.

Advanced Penetration Testing -Week-1 Advanced Penetration Testing -Week-2