Hackers Delivering And Hiding Malware While Undetected

Last year, Google made some important changes to their Chrome browser in a bid to increase user security.

Among these changes was to default to “HTTPS” in the browser in an attempt to reduce the number of “man in the middle” and similar types of attacks.

Their strategy worked.

Other companies adopted Google’s approach and HTTPS became the new standard on the web, and user security was increased. That’s a very good thing.

Unfortunately, we are now learning, courtesy of data collected by Sophos, that hackers are increasingly taking advantage of TLS (Transport Layer Security) to hide their own activities. Last year, Sophos reported that some 24 percent of malware was using TLS to communicate. This year, that value is up to 46 percent.

Where malware is concerned, there are, broadly speaking, three types of communication: downloading additional malware, exfiltration of data, and command and control. By using TLS when engaging in all three of these, hackers make it significantly more difficult for IT security professionals to detect, and ultimately to stop their malicious activity.

While user security has unquestionably increased over the last year, so too, has the security of hackers, and it’s complicating the lives of IT folks around the world.

Unfortunately, there’s not much that can be done about it. Anything that helps the general public by definition, can also be used by hackers around the world to help themselves, so it shouldn’t come as a great surprise that they’re increasingly embracing TLS. The first rule of hacking is, after all, ‘be at least two steps ahead.’ They are, and that’s unlikely to change in the foreseeable future.

For now, the best you can do is be mindful of the fact that hackers are increasingly taking advantage of TLS. Forewarned is forearmed. Good luck out there.