Story image

Malware takes stealth approach to global content delivery networks

24 Jul 17

Content delivery networks that deliver web content to users based on their locations are now a primary threat for malware and command & control (C&C) traffic, security firm CyberArk warns.

The technique, called ‘domain fronting’, has been seen working across tens of thousands of high reputation domains, including those of Fortune 100 companies, but has been most prevalent in Akamai content delivery networks (CDNs).

According to CyberArk, this method allows attackers to bypass security systems such as network monitoring and tools that rely on SSL fingerprinting as well as ‘known good’ domains.

Organisations that use distinguishing tactics such as using ‘known good’ and ‘known bad’ domains are no longer safe and defenders can’t trust ‘known good’ outbound traffic anymore, and threat detection should focus inside the network.

It is not only harder to shut down malware, but also harder to trace it back to a specific domain and find out where it came from.

The Akamai CDN carries between 15-30% of the world’s internet traffic, which makes it a prime target for attacks.

CyberArk researchers say that the Tor project not only used Akamai domains to bypass China’s content filtering networks and was later blocked in China. The Tor project also used Google and other CDNs to avoid censorship.

Researchers say attackers are looking for two major vulnerabilities in CDNs for their command and control purposes: a two way read-write mechanism, malware that is designed specifically for that channel, and that users’ machine must be infected with the malware.

After a series of tweaks to the custom malware, CDN identification and server names, nothing is amiss on the defender’s end.

“The client machine will be communicating with a high-reputation domain’s IP address, and the web traffic will be encrypted and signed by this domain. In appearance, this will thus appear as legitimate traffic to a highly trusted entity,” researchers say in a blog.

One of the few ways organisations may be detect domain fronting traffic is by using an HTTPS proxy as part of a man-in-the-middle campaign. This allows organisations to decrypt all encrypted traffic and inspect it, but it does come with risks.

Some domains use HSTS, a security protocol that forces all users to communicate through HTTPS only. As a result, only some firms can decrypt SSL traffic that targets those domains.

CyberArk researchers say another approach is for organisations to use an HTTPS proxy with SSL termination. This allows them to spot a mismatch between the host header and request uniform resource locator (URI).

The CDN could also give each domain virtual IP addresses that are tied to a specific SSL certificate. This stops malware from nesting in CDNs, but there are simply not enough public IPv4 addresses to make this happen, researchers conclude.

Disruption in the supply chain: Why IT resilience is a collective responsibility
"A truly resilient organisation will invest in building strong relationships while the sun shines so they can draw on goodwill when it rains."
Verifi takes spot in Deloitte Asia Pacific Fast 500
"An increasing amount of companies captured by New Zealand’s Anti-Money laundering legislation are realising that an electronic identity verification solution can streamline their customer onboarding."
Businesses too slow on attack detection – CrowdStrike
The 2018 CrowdStrike Services Cyber Intrusion Casebook reveals IR strategies, lessons learned, and trends derived from more than 200 cases.
What disaster recovery will look like in 2019
“With nearly half of all businesses experiencing an unrecoverable data event in the last three years, current backup solutions are no longer fit for purpose."
Proofpoint launches feature to identify most targeted users
“One of the largest security industry misconceptions is that most cyberattacks target top executives and management.”
McAfee named Leader in Magic Quadrant an eighth time
The company has been once again named as a Leader in the Gartner Magic Quadrant for Security Information and Event Management.
Symantec and Fortinet partner for integration
The partnership will deliver essential security controls across endpoint, network, and cloud environments.
Is Supermicro innocent? 3rd party test finds no malicious hardware
One of the larger scandals within IT circles took place this year with Bloomberg firing shots at Supermicro - now Supermicro is firing back.