Attackers often use advanced techniques to conceal their communication in an SSL connection. To detect and prevent those attacks, we need to look through an encrypted SSL connection and find malicious content. SSL Inspection is a technology using which encrypted SSL traffic can be decrypted and sent to other security appliances, which can analyze the traffic further to detect harmful contents and prevent possible damages.
How do attackers use encrypted communications?
If malicious communications are not encrypted, they can be detected easily by standard security appliances like IDS, IPS, and firewalls. However, these security tools are not able to decrypt an encrypted connection and look through it. So, many attackers take advantage of that to make attacks. They use SSL connections to conceal their malicious communication.
- If the initial communication for infection is through an approved port and a seemingly secured browser, it can bypass the firewall/IPS easily. In fact, it is easier to attack an organization using encryption applications.
- Many a time, attackers infect computers with malware and create a botnet. Then they exploit the computational resources of the infected computers for malicious purposes like making DDoS attacks, spreading malware, or for more attacks. For malware families like Zeus, the communication with the Command & Control Server of the botnet is concealed within an SSL connection. The malware first opens an SSL connection and then uses that for communication with the Command & Control Server to send stolen sensitive data of the victims.
- An attacker can use a Cross-Site Scripting (XSS) attack (How do attackers perpetrate a Cross-Site Scripting Attack? ) to steal the authentication cookie of a victim and send it to the attacker after hiding the communication using SSL.
- Attackers can use SSL for phishing attacks also. They can send malicious links to employees of an organization via emails and trick them into clicking on them. When a victim clicks on the link, it may redirect the victim to a malicious SSL server controlled by the attackers. If the communication is through some approved ports, the firewall/IPS may not detect it. And, the attackers can infect the computers with malware to create a botnet. After that, they can easily exfiltrate sensitive data like the financial account data of the organization using an encrypted SSL connection.
What is SSL Inspection?
Currently, many security devices cannot inspect encrypted traffic and the few that can decrypt SSL traffic cause significant performance degradation and are very expensive.
SSL inspectors work with secure network gateways to monitor inbound and outbound SSL traffic.
0 Comments