Slashdot Mirror
Cisco Can Now Sniff Out Malware Inside Encrypted Traffic (theregister.co.uk)
Simon Sharwood, writing for The Register: Cisco has switched on latent features in its recent routers and switches, plus a cloud service, that together make it possible to detect the fingerprints of malware in encrypted traffic. Switchzilla has not made a dent in transport layer security (TLS) to make this possible. Instead, as we reported in July 2016, Cisco researchers found that malware leaves recognisable traces even in encrypted traffic. The company announced its intention to productise that research last year and this week exited trials to make the service -- now known as Encrypted Traffic Analytics (ETA) -- available to purchasers of its 4000 Series Integrated Service Routers, the 1000-series Aggregation Services Router and the model 1000V Cloud Services Router 1000V. Those devices can't do the job alone: users need to sign up for Cisco's StealthWatch service and let traffic from their kit flow to a cloud-based analytics service that inspects traffic and uses self-improving machine learning algorithms to spot dodgy traffic.
...malware is torrents.
They are not analyzing payload/application data, this is not possible with end-to-end. They are not analyzing metadata, as most malware C&C now pretends to be web traffic. So how? Packet sizes and frequency? This would be trivial for malware creators to circumvent.
But what happens when they detect something?
That's wonderful news. I wonder how long it will be until Cisco caves to NSA pressure and starts looking for other "mal"traffic as well. And then how long until Russia learns how to do it as well.
I suppose this the the banks (hubs of the financial world) being made to detect money laundering by the pattern and size / frequency of money transfers. They don't know about the source or nature of the transaction underlying the money, just that when it obeys certain flows, they're supposed to flag it.
"Malware" can't be the only thing... Can the same algorithms not be used to detect bomb-making instructions, racism, and counter-revolutionary activities?
In Soviet Washington the swamp drains you.
They can recognize traffic patterns in TLS streams, created by malware on IP connected devices.
They can't detect the malware itself in the stream.
This just sounds really fishy to me. What's the encryption, A Ceaser cypher? The whole point of modern encryption is that the same input renders wildly different outputs. Their is no pattern to speak of. I'm sorry, I'm just not buying it... (figuratively or literally)
You can sniff packets without decrypting them and tell the difference between "regular" data and "malicious" data? Smells like BS to me.
and this time it's not just my hygiene
"switched on latent features in its recent routers and switches"
and
"users need to sign up for Cisco's StealthWatch service and let traffic from their kit flow to a cloud-based analytics service that inspects traffic and uses self-improving machine learning algorithms to spot dodgy traffic"
it's what is NOT being revealed that truly is scary
https://www.cisco.com/c/dam/en...
"Encrypted Traffic Analytics extracts four main data elements: the sequence of packet lengths and times, the byte distribution, TLS-specific features and the initial data packet."
Well, probably the logical thing to do: they set the evil bit.
Nae king! Nae laird! Nae yurrupiean pressedent! We willna be fooled again!
This seems somewhat "old news" certain applications still have fingerprints on packets that can be detected even if you can't read the data being exchanged.
Our Sophos XG firewall does this with many different torrent applications, and it ends up blocking non-VPNed, but still encrypted connections.
I'm a little sketchy about the "upload your traffic to us" part, but I guess that allows for more analysis across more hsots
SV
I will not give in to the terrorists. I will not become fearful.
What they actually can do is recognize TLS tunnels created and used my malware. They cannot detect anything in the encrypted stream of data. The way this works is carefully observing how exactly the TLS tunnel was established. This apparently differs enough between different implementations, that typical code used by malware for this purpose becomes identifiable.
Of course, as soon as the malware-makers just use more standard code, their tunnels become unrecognizable as well.
Caveat: I read the abstract, but not the paper.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Pure BS. A sales gimmick. Look at us. buy the latest and greatest overpriced hardware.
Fortinet and Palo Alto Networks have been doing this for years. Both can also decrypt SSL in real time (one better than they other, but who is counting right?) So this is a bit of a silly post. Looks like marketing to me.
I predict that this concept will ring alarm bells for a lot of normal traffic.
My company uses Trend Antivirus. In their wisdom, they turned on the "heuristic" behavior detection mode. Now, every time our software team writes software that renames a file, it has to be excluded from Trend's scanners. Apparently, ransomware does a lot of file renaming, therefore, any software that renames a lot of files is suspect.
So far, anti-malware isn't very good at detecting "suspicious" patterns, in my experience.