Attackers use advanced techniques to conceal their communication in an SSL connection. And, to detect and prevent those attacks we need to look through an encrypted SSL connection and find out malicious contents. SSL Inspection is a technology using which encrypted SSL traffic can be decrypted and sent to other security appliances, that can analyze the traffic further to detect harmful contents and prevent possible damages.
How do attackers use encrypted communications?
If malicious communications are not encrypted, they can be detected by standard security appliances like IDS, IPS, firewalls easily. But, these security tools are not able to decrypt an encrypted connection and look through it. So, many a time attackers take advantage of that to make attacks. They use SSL connections to conceal their malicious communication.
- If the initial communication for infection is through an approved port and a seemingly secured browser, it can bypass the firewall/IPS easily. In fact, it is easier to attack an organization using applications that use encryption.
- Many a time attackers infect computers with malware and create a botnet. Then they exploit the computational resources of the infected computers for malicious purposes like making DDoS attacks, spreading malware, or for more attacks. For malware families like Zeus, the communication with the Command & Control Server of the botnet is concealed within an SSL connection. The malware first opens an SSL connection and then uses that for communication with the Command & Control Server for sending stolen sensitive data of the victims.
- An attacker can use Cross-Site Scripting or XSS attack (How do attackers perpetrate a Cross-Site Scripting Attack ? ) to steal authentication cookie of a victim and send it to the attacker hiding the communication using SSL.
- Attackers can use SSL for phishing attacks also. They can send malicious links to employees of an organization via emails and trick them to click on them. When a victim clicks on the link, it may redirect the victim to a malicious SSL server controlled by the attackers. If the communication is through some approved ports, the firewall/IPS may not detect it. And, the attackers can infect the computers with malware to create a botnet. After that, they can easily exfiltrate sensitive data like financial account data of the organization using an encrypted SSL connection.
What is SSL Inspection?
Currently, many security devices cannot inspect encrypted traffic, and the few that can decrypt SSL traffic cause significant performance degradation and are very expensive.
SSL inspectors work with secure network gateways to monitor inbound and outbound SSL traffic.
0 Comments