TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

F5 Labs

The 2021 TLS Telemetry Report

2021-10-20 · Read original ↗

ATT&CK techniques detected

7 predictions
T1071.001Web Protocols
86%
"##m tls fingerprinting technique directly into cryptonice, we were able to capture server tls fingerprints for the top one million sites. 22 the results not only revealed a perhaps unsurprising lack of variance, but they also indicated that malicious command - and - control ( c &…"
T1566.002Spearphishing Link
83%
"in 2020 and 2021. the 2021 application protection report noted that trickbot and cobalt strike were two of the top three most frequently observed malware variants for delivering ransomware, along with emotet. the implication is that some of the web ’ s most popular sites are also…"
T1566.002Spearphishing Link
71%
"’ s encrypt has taken the lead, providing 28 % of certificates for phishing sites. phishers are either finding alternative ways to deploy their sites or perhaps using the optional let ’ s encrypt plug - in for cpanel. for service providers, phishers tended to prefer fastly, thoug…"
T1557.001Name Resolution Poisoning and SMB Relay
58%
"with sslstrip deception this kind of attack, dubbed sslstrip by its creator, moxie marlinspike, is extremely potent and can be used to capture sign - in credentials, personal information, and payment card details from any website. however, this attack can ’ t be performed remotel…"
T1566.002Spearphishing Link
58%
"’ s percentage. in other words, the diversity of webmail platforms shouldn ’ t obfuscate the fact that phishing victims are almost equally likely to experience a phish against their webmail accounts as against their facebook accounts. when is encryption not encryption? the web is…"
T1588.004Digital Certificates
39%
"date and therefore vulnerable. cas behaving badly let ’ s start with the problems that primarily result from malicious or negligent behaviour by certificate authorities. the web depends on a chain of trust, and that chain is anchored with the certificate authorities. there are hu…"
T1486Data Encrypted for Impact
36%
"- changing best practices. malicious servers here is where it gets interesting from a cybercrime standpoint : since phishing sites and c & c servers will intentionally attempt to disguise their configuration, fingerprinting techniques can be a useful way to spot the true identity…"

Summary

Creating an encrypted HTTPS website depends on a lot more than simply throwing a digital certificate at it and hoping for the best. In fact, Transport Layer Security (TLS) and HTTPS misconfigurations are now so commonplace that in the 2021 OWASP Top 10, Cryptographic Failures now comes in second place.