Alleged C.I.A. Hacking Documents Reinforce Need for SSL Traffic Inspection
WikiLeaks this week released thousands of documents containing several hundred million lines of code that it claims shine a light on the solutions and tactics the Central Intelligence Agency used to spy and hack into devices, including smartphones, computers and smart televisions.
While there are still questions around the documents’ authenticity, if they are legitimate they show that the C.I.A. has used sophisticated tools to, among other things, conceal malware and listening technology in SSL (Secure Sockets Layer) encrypted traffic.
Nation states are already known to be in possession of sophisticated tools, such as those alleged by WikiLeaks, but with the attention leaks such as this draw, the tools and ideas are now proliferating in the wild and are increasingly being used for more nefarious activities.
HIVE and Command and Control
There are numerous delivery mechanisms for the malware, but once implanted, most of them rely on some kind of Command and Control (C2) infrastructure. This infrastructure is generally used to control the malware and botnets, and it may be directly controlled by the malware operators or run on hardware compromised by the malware.
WikiLeaks alleges that the C.I.A. has a dedicated project, called HIVE, which is a multi-platform malware suite that provides Command and Control (C2) over “customizable implants for Windows, Solaris, MikroTik (used in Internet routers) and Linux platforms and a Listening Post (LP)/Command and Control (C2) infrastructure to communicate with these implants.” HIVE specifically uses SSL (HTTPS) to cover its tracks, according to WikiLeaks.
While the use of SSL for Command and Control of malware is increasingly common, HIVE went a step further and introduced the use of client-certificate authentication, a technique that allows them to mitigate the risk of SSL interception, WikiLeaks alleges.
The Power of SSL Inspection
Although A10 is not in a position to comment on WikiLeaks’ allegations, it does highlight the importance of understanding what’s in encrypted traffic and possibly hiding in plain sight. It’s up to you as a business or a consumer to decide what traffic you determine is good and what is undesired.
There is no doubt that the concealment techniques for Command and Control traffic as used by HIVE will very soon be in public domain and will fall into the hands of bad actors who can use them for nefarious purposes. Even script-kiddies will have access to sophisticated tools, like those alleged by WikiLeaks and used by nation states, that will enable them to conceal their footprints.
If these techniques are allegedly being employed by Intelligence Community to protect national interests, imagine what methods APTs (advanced persistent threats) are using to hide within the SSL/TLS blind spot to target your business and intellectual property for exfiltration. The Verizon Data Breach Investigations Report indicates that 89 percent of breaches had a financial or espionage motive.
That is why being able to decrypt and inspect encrypted traffic is a wise business decision.
A10 Thunder SSLi provides visibility into SSL encrypted traffic to stop potential threats. With Thunder SSLi, Command and Control traffic, like that of HIVE, can be detected, logged and blocked. Thunder SSLi understands when client-certificate are used for authentication and will allow it to only go to authorized sites while blocking the rest; and all activity is logged.
Defense in Depth
Thunder SSLi is a key component of a defense in depth strategy.
At A10, we encourage the use of best of breed solutions for robust security protections from the evolving threat landscape and to maximize your layers of defense. Having multiple layers of security increases the chances of catching and eradicating malware before it has the opportunity to wreak havoc. A multi-layered defense will also mitigate the risk of any single device being compromised and being rendered ineffective.
Additionally, we strongly encourage the use of a hardware security module (HSM) to safeguard and manage SSL private keys, which can be construed as master keys for any digital encrypted communications, to ensure strong authentication and privacy.
To summarize, we recommend the following to protect your organization:
- Maximize your layers of defense
- Minimize the sprawl of your private keys
- Protect private keys via HSM
For more on protection against threats hidden in encrypted traffic, download our complimentary white paper, “The Ultimate Guide to SSL Inspection: Uncover Threats in SSL Traffic.”
Seeing is believing.
Schedule a live demo today.