While encryption technologies have been key tools for ensuring web traffic stays private and secure, cybercriminals are also using encryption to hide malware and execute web-based attacks. 

Inspecting encrypted traffic is more critical than ever before to keep modern business networks secure. Yet, detecting suspicious web traffic for malicious content is not as straightforward as it seems.

First, networks have evolved to support new ways of working. That means security operations are much more complex today. Employees are using a mix of personal and company-issued devices, connecting to networks from multiple locations. At the same time, small and mid-size businesses (SMBs) may be in various stages of cloud-enabling their operations — and security measures may not be keeping pace. Managed service providers (MSPs) and managed security service providers (MSSPs) may be dealing with a range of traditional, on-premise security appliances that simply aren’t effective against encrypted web threats.

Next, in order to see inside encrypted data flows, traffic is decrypted as it enters and exits networks, then typically scanned for threats, and re-encrypted. You can imagine the costs and network performance considerations with the sheer amount of data that needs to be processed for growing, modern workforces. 

Bandwidth and latency are key issues. In fact, latency caused by some security appliances that are designed to inspect traffic and protect networks can be so severe that businesses may turn off web traffic inspection features entirely. According to Gartner, it’s turned off in 90% of unified threat management (UTM) appliances. 

Even worse, when faced with performance impact or more costs and complexity, some companies may choose not to deploy any services to inspect encrypted web traffic.

The reality is, for deep inspection of encrypted traffic, MSPs and MSSPs need advanced cloud-based security strategies that won’t impact performance for SMB customers who rely on the cloud — and won’t create new maintenance headaches and added costs.

All of these factors create gaps in protection, increase the chances of malicious encrypted web traffic bypassing your security defenses, and fuel a massive volume of successful encrypted web attacks.

In our What’s Hiding in SSL/TLS Traffic? white paper, we look at the challenges with encrypted web traffic inspection, the types of attacks that are growing due to lack of realistic inspection techniques, and modern security strategies to help MSPs and MSSPs respond with a smart defense.

Understanding the top threats to your customer’s web traffic

One thing is certain, if you ever question the need for inspecting encrypted traffic, one look at the web attacks gaining traction today may change your mind.

Here are just a few examples:

• Zero day: Zero day malware or viruses exploit a potentially serious software security weakness that a vendor or developer may be unaware of. In this case, it can execute its damage until a patch is developed and deployed for the vulnerability. A zero day attack is especially dangerous because only the attacker is aware of its existence and it can go undetected by IT teams.
• Reductor: A new malware strain, called Reductor, enables attackers to manipulate Hypertext Transfer Protocol Secure (HTTPS) traffic by compromising a browser’s random numbers generator. This makes the encryption process unpredictable, enabling attackers to spy on all information and actions carried out by the web browser. Researchers noted the following ‘alarming’ characteristics:
  • It compromises encrypted Transport Layer Security (TLS) traffic.
  • It manipulates digital traffic and marks outbound TLS traffic with unique identifiers.
  • It infects the browser itself.
  • It compromises the random number generator, enabling the attacker to know how traffic will be encrypted when a TLS connection is established.
  • It allows the malware to decode traffic and send relevant data to its command-and-control (C2) server.
  • By decoding the data, the malware remains undetected by administrators or security tools.
  • It shares similar code to the COMpfun trojan, which was first documented in 2014 and is closely associated with the Russian Advanced Persistent Threat (APT) group Turla.
  • It has been operational since 2019, and has been used in a malware campaign targeting entities in Russia and Belarus.
• Trickbot: Trickbot is an infostealer malware that redirects user, system, and user account data to an attacker’s site. It injects malware modules directly into legitimate host software, using spam emails and Adobe Flash Player updates to execute its attacks. Research has linked Trickbot malware to more COVID-19 phishing scams than any other malware. Last month, when Black Lives Matter protests began worldwide over police violence, Trickbot was already being used in phishing scams asking recipients to “leave a review confidentially about Black Lives Matter” or “vote anonymously,” claiming to include a survey in their ask.
• IcedID: Icedid is a banking trojan that injects malware into browser sites, with the ability to spread laterally through the network. When discovered in 2017, it was targeting banks, payment card providers, payroll, webmail and e-commerce sites, and mobile services providers. mainly in the U.S. It has continued a focus on the North American financial sector. For example, recent scams are targeting tax return data, targeting ‘tax software and using customer kits to solicit important documentation from unsuspecting users.’
• Dridex: Dridex is a banking trojan malware detected in 2011 that steals credentials, cookies, certificates, and keystrokes — it can even take screenshots. Dridex relies on phishing attacks to execute its malware. It can capture banking credentials, execute unauthorized transfers from bank accounts, open fraudulent accounts, and more. Damage done in 2015 alone was estimated at $40 million. In December 2019, the Russian hacking group Evil Corp used Dridex to steal $100 million from banks.

Smart strategies for inspecting encrypted web traffic

As MSPs and MSSPs will agree, securing Internet traffic today goes well beyond traditional security measures of the past and inspection plays a critical role. The fact is, facing inspection challenges head-on with a firewall like the Secure Internet Gateway will help prevent encrypted web attacks on your customers’ networks.

We created our white paper, What’s Hiding in SSL/TLS Traffic?, as a guide to understanding the factors driving encrypted web attacks and how to evaluate the right inspection technologies and security measures to stay well ahead of these attacks. Be sure to get your free copy today.