Hackers Use TLS to Hide Activities since Google made some important changes to their Chrome browser to increase user security.
Among these changes was for the browser to default to “HTTPS” reducing the number of “man in the middle” and similar types of attacks.
Their strategy worked.
Other companies adopted Google’s approach, and HTTPS became the new standard globally and an increase in user security. That’s a very good thing.
Unfortunately, we are now learning, courtesy of data collected by Sophos, that hackers are increasingly taking advantage of TLS (Transport Layer Security) hiding their activities. Last year, Sophos reported that some 24 percent of malware was using TLS to communicate. This year, that value is up to 46 percent.
There are three types of communication where malware is concerned: downloading additional malware, exfiltration of data, and command and control. Using TLS when engaging in all three of these, hackers make it significantly more difficult for IT security professionals to detect and ultimately stop their malicious activity.
While user security has unquestionably increased over the last year, so too, hackers have the security of hackers, and it’s complicating the lives of IT folks around the world.
Unfortunately, there’s not much that anyone can do about it. Hackers worldwide can also use anything that helps the general public by definition to help themselves, so it shouldn’t come as a great surprise that they’re increasingly embracing TLS. The first rule of hacking is, after all, ‘be at least two steps ahead.’ They are, and that’s unlikely to change in the foreseeable future.
For now, the best you can do is be mindful of the fact that hackers are increasingly taking advantage of TLS.
Forewarned is forearmed. Good luck out there.
