According to Blue Coat System research growing use of encryption to address privacy concerns is creating perfect conditions for
cyber criminals to hide malware inside encrypted transactions and even reducing the level of sophistication required for malware to avoid detection.
The use of encryption on websites both business and consumer is increasing as concern around personal privacy grow. In fact, Eight of the top 10 global websites as ranked by Alexa Deploy SSL encryption technology throughout all or portions of their sites. For instance, technology goliaths Google, Amazon and Facebook have switched to an “always on HTTPS” model to secure all data in transit using SSL encryption.
Business-essential applications, such as file-storage, search, cloud-based business software and social media, have long-used encryption to protect data-in-transit. However, the lack of visibility into SSL traffic represents a potential vulnerability in many enterprises where benign and hostile uses of SSL are indistinguishable to many security devices. As a result, encryption enables threats to bypass network security and allows sensitive employee or corporate data to leak from anywhere inside the enterprise.
Blue Coat’s latest security report 2014 security report-The visibility void explains encrypted traffic is becoming more popular with cyber criminals because:
- Malware attacks, using encryption as a cloak, do not need to be complex because the malware operators believe the encryption prevents the enterprise from seeing the attack
- Significant data loss can occur as a result of malicious acts by hostile outsiders or disgruntled insiders, who can easily transmit sensitive information
- By simply combining short-lived websites, “One-Day Wonders,” with encryption and running incoming malware and/or outgoing data theft over SSL, organizations can be completely blind to the attack, and unable to prevent, detect or respond.
The growing use of encryption means many businesses are unable to track the legitimate corporate information entering and leaving their networks, creating a growing blind spot for enterprises. In fact, over a 12-month period beginning September 2013, between 11 percent and 14 percent of the security information requests that Blue Coat researchers received on average each week were asking about encrypted websites.
One example of an unsophisticated malware threat hiding in encrypted traffic is Dyre, a widely distributed, password-stealing Trojan originating in the Ukraine. After authorities shut down Zeus, one of the most successful Trojan horse malwares, Dyre quickly took its place by simply adding encryption. Today Dyre exploits human behavior to target some of the world’s largest enterprises to compromise accounts that can expose Social Security numbers, bank account information, protected health information, intellectual property and much more.