2

So, I was skimming though this SANS research about skype . Long story short, it says :

Skype uses standard cryptographic primitives to achieve strong end-to-end encryption (Berson, 2005)........encrypting traffic prevents intrusion detection systems and firewalls from inspecting the contents of the traffic (Fawcett, 2012)........there is a significant risk of data exfiltration via Skype traffic or more importantly, traffic that simply mimics the characteristics of Skype communication.....

There goes my question : Lets say the attacker is not yet inside the target network but he knows that the target network is using encrypted traffic like skype does, or even HTTPS, SFTP, etc... Could he use the fact that technical control (IDS, Firewall...) won't block encrypted traffic as a vector to get inside the network ? i.e later he could leverage from that and harm the target system (since he got into a part of that system that needs encrytion....could he just then wander around the system...)

Improve this question
6
  • Well, a network administrator should have blocked unwanted ports. So that means the attacker needs to use an allowed service to try to exfiltrate data.
    – Limit
    Commented Dec 25, 2016 at 21:56
  • @Limit Nope that's not what I'm asking. What I mean is : since technical security control can't inspect encrypted packets, could a hacker get inside a target network using encrypted traffic and then do harm from that intrusion ? If yes then encryption becomes a security risk...
    – Jason Krs
    Commented Dec 25, 2016 at 22:12
  • jason can you give an example of what you mean? Encrypted traffic can be a mail with attached malware. There have also been cases of compromising a system by sending malicious links via Skype.
    – Limit
    Commented Dec 25, 2016 at 22:23
  • @Limit My example is in my OP.... Skype encrypts its traffic (which makes sence as it is p2p based and its a support for sensitive data exchange like voice, files, video...). Encrypting, from what I know, prevents security technical controls to analyze traffic packets ; they can't analyze the payload (the data). So could an attacker, from outside the network, mimic Skype's encrypted traffic packets to get inside the network (just as they from from inside the network to exfiltrate data). ? If yes it means any encrypted traffic (HTTPS, SFTP, ...) will do for such task, I assume
    – Jason Krs
    Commented Dec 25, 2016 at 22:31
  • 1
    About your point on an attacker creating fake encrypted traffic to get inside a network, it is possible and is exploited (community.skype.com/t5/Security-Privacy-Trust-and/…). But encryption is not the real reason for that problem. The real reason is ease of mimicking. If you solve that, then encrypted traffic will also be safe
    – Limit
    Commented Dec 25, 2016 at 22:35

1 Answer 1

Reset to default
4

IMHO these are two separate things. IDS and FW protects on different layers and if you do not have layered security on your network or services this network is serving the attacker could harm it.

Short example: you have a network where you have an application server which serves a web application for checking the DNS information (nslookup). If this application is not designed in a secured way attacker can create such a content that will give access to i.e. /etc/passwd file.

Summarizing - it is possible.

Improve this answer
4
  • 1
    Nope. That not what I mean. My concern is about using encrypted traffic as a vector to get inside a network and leverage from that to do harm... That why I talked about Skype in my OP....
    – Jason Krs
    Commented Dec 25, 2016 at 22:16
  • 2
    Jason - you have slightly misunderstood the quote you used in your question. It talks about exfil, not attack.
    – Rory Alsop ♦
    Commented Dec 25, 2016 at 22:28
  • @RoryAlsop Oh no I get it. I meant how about the other way around. Could it work ?
    – Jason Krs
    Commented Dec 25, 2016 at 23:40
  • 1
    It doesn't matter what the connection in is. Whether it's encrypted or not. You need a vulnerability in a listening service. The encryption is not the issue here.
    – Rory Alsop ♦
    Commented Dec 26, 2016 at 11:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .