ECH adoption is low, but risks remain for enterprises and users.

Encrypted Client Hello (ECH) is a security protocol designed to increase user privacy by encrypting the content exchanged between clients and servers when they are establishing a connection. Increased user privacy: what’s not to like?

Unfortunately, in the view of many enterprise security professionals, the increased privacy promised by ECH could simultaneously reduce their ability to detect and respond to threats. Widespread adoption of the security protocol would severely curtail the ability of enterprises to identify and block connections to malicious domains.

Late last year, our team at Corrata noticed an uptick in detections of an ECH domain. The numbers were small, low thousands among hundreds of millions of domain scans, but nonetheless intriguing. Did this herald the primetime arrival of ECH? Would widely-used security tools soon be blind to large swaths of internet traffic?

How ECH works

You’ve seen the padlock symbol and https designation in the address bar of your browser. Both are indications that the website you’re visiting uses the Transport Layer Security (TLS) internet encryption standard, which protects communications between an endpoint device and a web server. The vast majority of internet traffic uses the TLS 1.3 standard: ECH was designed as an extension to that standard.

Without ECH, a client will reveal the domain of the website it’s attempting to visit before the encrypted connection is established. This means that any entity that can see the user’s internet traffic, such as mobile operators, Internet Service Providers (ISPs), enterprise security teams and bad actors, can see their destination, even when the user and the server take precautions to avoid this.

ECH encrypts the entire Client Hello message (the first message sent by a client in a TLS handshake) so that only the gateway to the intended server, which holds the corresponding private key, can decrypt this inner message and complete the handshake securely. Network observers can no longer see which specific domain a user is trying to access.

Why does that matter?

Important cybersecurity tools like Secure Web Gateways and Next Generation Firewalls rely on that visibility to detect and block access to content that could represent a threat, such as phishing or malware download sites. Beyond security teams, ISPs have a commercial interest in understanding how their subscribers use the internet, and governments want to be able to passively monitor and potentially restrict access to illegal, malicious, or unacceptable content.

The visibility is particularly important for banks and other heavily regulated industries that are often required to monitor their incoming and outgoing internet traffic. As it stands, these organizations can decrypt traffic selectively without looking at sensitive data like employee PII or health records. But if ECH blocks filtering tools, banks will have to decrypt all internet traffic in order to remain compliant with regulations: degrading user privacy in the process.

ECH adoption is low, but risks remain for enterprises and users

Our analysis of the adoption and impact of ECH for enterprise users brought good news and bad news. Although overall adoption is very low (more than 9% of the top 1 million domains are ECH-enabled, but less than .01% of TLS connections used the protocol), malicious actors are already taking advantage of the anonymity the protocol provides: 17% of all ECH-enabled sites are risky. Chrome users with encrypted DNS enabled are most at risk.

You might wonder if such a small portion of internet traffic matters. If less than one-tenth of one percent of internet connections are using ECH, should enterprise security teams even worry about the protocol’s potential risks?

The short answer is yes.

To work, ECH requires traffic to flow through a content delivery network (CDN) that supports the protocol. Cloudflare is currently the only CDN that supports ECH, and the company has played an important role in driving ECH adoption. (Notably, Apple’s iOS does not support ECH.)

We found that over 90% of phishing detections use Cloudflare infrastructure. In addition to the ECH anonymity, these sites take advantage of other Cloudflare features. For example, the “captcha” page can direct desktop traffic to a legitimate site while mobile traffic is sent to a fake one.

We should expect ECH to grow in popularity over time, because there are opportunities and incentives for both the server side and client side to drive adoption. On the client side, Safari could support the standard or Chrome could enable encrypted DNS by default.

Server side

On the server side, you would need to see wholesale migration to Cloudflare (unlikely) or default support from other CDNs. It’s worth noting that ECH adoption is a positive for the CDNs. The complexity of implementation means more websites will opt to use CDN services: and the CDNs would become the only infrastructure players with widespread visibility of internet traffic.

For now, security teams can breathe a sigh of relief because the community’s fears that enterprise internet traffic would go dark are not yet being realized. But it would be irresponsible to expect this to continue long-term, given the significant market opportunities that ECH adoption offers for the CDN industry. The threat posed by the protocol must be taken seriously.

Tracking ECH and its cloak of secrecy is no longer optional for enterprise security teams. Our data shows that while the potential certainly exists for ECH to become a thorn in the side of defenders, this is the time to prepare rather than panic.

This article was produced as part of TechRadarPro’s Expert Insights channel.

The post Is a new privacy protocol helping malicious actors more than internet users? appeared first on Corrata.

DUBLIN, May 21, 2025 — Corrata, the leading mobile endpoint threat detection and response provider, published the Living With ECH Report. The first-of-its-kind report examines the impact of the Encrypted Client Hello (ECH), a new privacy protocol that information security professionals fear could make widely-used security tools blind to large swaths of internet traffic.

ECH is an extension to TLS 1.3, the most recent version of the Transport Layer Security standard used to secure the vast majority of internet communications. ECH proposes to enhance privacy by encrypting key information between devices and Content Delivery Networks (CDNs), preventing network providers from identifying the names of websites that individuals are looking to access.

Information security professionals have raised concerns that its implementation may compromise the ability of enterprises to detect and counter cyber threats.

The inaugural report analyzed first-party platform data, billions of connections to web servers made by enterprise employee mobile devices, between January and March 2025. According to the research, more than 9% of the top 1 million domains are ECH-enabled, but less than .01% of TLS connections used the protocol.

However, even though ECH is rarely relied upon in practice, malicious actors are taking advantage of the anonymity the protocol provides: 17% of the total ECH-enabled sites are risky. Chrome users with encrypted DNS enabled are most at risk.

Findings from the Living With ECH Report include:

ECH could degrade, not improve, privacy: Banks and other regulated entities are often required to monitor the internet traffic going into and out of their organization. To date, these enterprises have been able to selectively decrypt traffic without looking at sensitive data like employees’ health records.

But with ECH blocking their filtering, enterprises would have little choice but to decrypt all internet traffic for inspection, drastically degrading employees’ privacy.

Cloudflare is driving ECH adoption: Cloudflare remains the sole tier-one CDN supporting ECH. Almost all of the sites that are ECH-enabled use Cloudflare infrastructure. Major website owners also seem to be wary of adopting the protocol, concerned that users might be blocked from accessing their services by enterprise security infrastructure or by public authorities.

While ECH reduces the visibility of internet service providers (ISPs) and enterprise security teams, CDNs like Cloudfare can still access data under the protocol.

Malicious actors are taking advantage of Cloudflare: Over 90% of phishing detections use Cloudflare infrastructure, according to Corrata’s analysis. In addition to the anonymity provided by ECH, these sites take advantage of other Cloudflare features.

For example, the “captcha” page can be used to direct desktop traffic to the legitimate site while mobile traffic is sent to the fake one. Alternatively, traffic not coming from the targeted country may be redirected to the legitimate site. These are deliberate tactics to avoid detection by security providers.

Barriers to widespread adoption are high: Widespread adoption of ECH would severely curtail the ability of enterprises to identify and block connections to malicious domains, but industry heavyweights who play different roles and have varied motivations must all support ECH before its use can become widespread.

While 20% of devices are configured to use encrypted DNS and DNS resolvers which support ECH, the lack of support from browsers such as Safari and operating systems such as Android make such choices moot.

“The extremely low level of ECH adoption suggests that the security community’s fears that enterprise internet traffic would go dark are not yet being realized,” said Matthieu Bentot, CTO of Corrata. “While the potential certainly exists for ECH to become a thorn in the side of defenders, the early signs are that this is the time to prepare rather than panic.”

The Living With ECH Report is available today.

Research Methodology
Corrata analyzed billions of connections made by devices running Corrata’s threat detection and response solution.

Corrata’s software is used to protect iOS and Android devices and is representative of that important segment of enterprise internet traffic. Corrata has visibility of DNS query and TLS connection metadata for all of these connections and tracked the number of successful ECH connections created between January and March 2025.

About Corrata
Corrata provides endpoint threat detection and response for mobile. Our pioneering architecture delivers real-time visibility into threats targeting both iOS and Android devices, without compromising performance or privacy. Corrata software detects and disables malware, blocks phishing attacks and ensures compromised devices cannot access sensitive data.

Corrata has customers across multiple verticals including healthcare, logistics, manufacturing and the public sector and is verified for use with FirstNet, the US Government network for first responders.

With deployment in less than 24 hours and seamless integration into your existing security infrastructure, Corrata ensures your mobile environment is no longer your weakest link. Corrata is a proud member of the Microsoft Intelligent Security Association and Cyber Ireland. Visit corrata.com.

###

The post Corrata Report Examines Impact of New Privacy Protocol appeared first on Corrata.

Over the years, TLS has evolved significantly, improving performance, tightening security and simplifying configuration. But while the protocol itself has improved, many of our assumptions about how and why we use TLS remain outdated.

There’s still a widespread belief that the safety of a connection depends on the network you’re using – that a coffee shop Wi-Fi or a public hotspot is risky, but your corporate VPN or home broadband is inherently trustworthy. This assumption is not only outdated – it’s dangerous.

We’ve all been told to watch out for “the guy in the hoodie” at the café spoofing a Wi-Fi network. But the real threat often lies much deeper: in the infrastructure itself. The routers, switches, telecom routes, and even undersea cables that move our data have been compromised time and time again – often at the state or enterprise level.

Consider some examples:

• NSA’s QUANTUM and TURBINE programs, revealed by Edward Snowden, tapped into backbone routers and silently injected malicious payloads mid-flight.
• NSO Group’s Pegasus spyware leveraged network injection over rogue telecom infrastructure, often using compromised routers and middleboxes.
• Cisco and Juniper zero-day vulnerabilities exposed core routing hardware to silent compromise and surveillance.

These aren’t rogue actors on public Wi-Fi. These are trusted, critical components of the global internet infrastructure being quietly turned against users.

The locked briefcase

Picture this: you’re sending sensitive documents across a city in a courier van. That van may pass through unsafe neighbourhoods, take detours, or even be briefly stopped and inspected – but it doesn’t matter, because your documents are in a locked briefcase, one only the recipient can open.

TLS is that locked briefcase. It doesn’t matter what path your data takes – it could go through your home Wi-Fi, a rogue router in a telco, or even a nation-state-controlled exchange point. With properly configured TLS, the message stays sealed.

TLS doesn’t just rely on “strong encryption” in a vague sense – it enforces several well-established principles that make it trustworthy, even when everything else isn’t. At the heart of TLS is ephemeral key exchange, most commonly using Elliptic Curve Diffie-Hellman (ECDHE). This means the client and server each generate temporary, one-time keys during the handshake – allowing them to derive a shared secret without ever sending the secret itself across the network. It’s like agreeing on a combination lock in separate rooms without shouting the numbers through the door. And since a brand-new lock is used every time, even if someone later steals your old keys, they can’t open yesterday’s box – that’s Perfect Forward Secrecy.

TLS also authenticates the server using X.509 certificates, issued by trusted Certificate Authorities (CAs). These are the digital equivalent of checking a passport before unlocking your side of the connection. Some systems go further by implementing certificate pinning, which tells clients to only trust specific public keys, guarding against mis-issued or rogue certs.

In TLS 1.3, many legacy algorithms and insecure options have been eliminated altogether – there’s no RSA key exchange, no static secrets, no downgrade paths to weak ciphers like RC4 or 3DES. Even the handshake itself is mostly encrypted, reducing metadata exposure. 

State of the Nation

A recent scan in May 2024 by Qualys SSL Labs evaluated 134,495 secure websites. The results were mostly encouraging: 66.0% of sites received an A- grade or higher – considered secure by modern standards. However, 34% – or 45,693 sites – were graded below that threshold:

• 32.1% scored a B (minor weaknesses),
• 1% scored C (moderate risk),
• 0.9% received an F (high-risk configuration).

Thankfully, browser vendors have raised the floor for users. By now, all major browsers – Chrome, Firefox, Safari, and Edge – have fully deprecated TLS 1.0 and 1.1: Chrome and Firefox disabled them in 2020. Safari and Edge followed shortly after, with Apple fully deprecating them across its ecosystem in 2021. As of 2025:

• TLS 1.2 is the minimum version browsers will negotiate.
• The weakest fallback cipher still in play would be similar to:
• TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA – a secure, but older, suite with 128-bit AES in CBC mode.

Browsers no longer tolerate truly weak configurations. If your server only supports deprecated ciphers, users simply won’t connect.

High quality TLS is not optional

The internet isn’t unsafe because of rogue cafés or sketchy Wi-Fi – it’s unsafe because the very infrastructure we rely on has proven untrustworthy time and again. From compromised telcos to nation-state surveillance implants, there is no safe path – only secure payloads.

That’s why TLS matters. Not just on public networks, but always. TLS 1.3, and strong configurations of TLS 1.2, ensure that even if someone owns the wire, they can’t read the message. So if you’re an organisation building apps, running servers, or managing mobile devices – don’t treat TLS as optional. Treat it as your armoured truck, locked briefcase, and diplomatic pouch – because the road is anything but safe.

The post TLS – Trust the Lock, Not the Road. appeared first on Corrata.

Successfully blocking malicious links is the fundamental technical defence against spear phishing attacks.  However, on mobile devices, this protection is far less effective than many realize, leaving enterprises exposed to various threats.

To understand why we’ll use a recent phishing text that was delivered to the phones of one of our staff members as a case study..  While this isn’t the kind of highly targeted attacks we see delivered to our enterprise clients, it nonetheless will serve to illustrate how unreliable the build-in protections provided by networks, applications and browsers.  

The First Line of Defense: Carrier-Level Filtering

For SMS based attacks, the first line of defence should be an SMS firewall deployed on the carrier network.  But this is where the problems start: its not mandatory for carriers to implement such firewalls in all jurisdictions.  Even where such firewalls exist they simply cannot be tuned to reliably spot every zero day malicious url without generating large numbers of false positives (and angry customers).  They face the same problem when they filter based on keywords e.g. messages with the name of a bank or postal service are often blocked. 

It’s worth noting that text message services aren’t just about text.  With the use of iMessage and the wider adoption of RCS the ‘texting’ channel increasingly sees multimedia content.  Recently we’ve seen attackers adopt detection by sending links in pdfs.  To avoid keyword filtering the ‘text’ accompanying  is now being sent as an image

So lots of attacks get through the carrier.  Similar issues arise if you’re receiving a link over another channel whether its iMessage, RCS, WhatsApp or Teams. The operators of these services struggle to filter out spear phishing attacks as their filtering is designed to block ‘consumer’ grade fraud.  Today most of these services over end-to-end encryption for messages sent between two devices.  In this scenario filtering is limited to the connections they offer to businesses.

 But getting back to our recent phishing text.  Where are the other opportunities to filter out these malicious messages ?

The Browser’s Role in Blocking Malicious Links

The next line of defence is the browser.  On mobile the predominate browsers are Chrome and Safari.  Both use the Google Safe browsing block list but the refresh rates appear to vary.  In the case of the recent phishing text received by our employee we found that while Safari correctly identified it as malicious, Chrome did not.

Phishing site blocked by Safari but allowed by Chrome

A check on VirusTotal showed that at  of ninety four vendors, only Google detected this link as problematic. This is worrying as it suggests that the next line of defence, web filtering solutions, might not be updated sufficiently quickly to block the malicious link in the message.  Web filtering can be deployed on network (for example if you’re connecting to your corporate wifi network or using a vpn or equivalent to connect to a gateway ) or on device (if you’re device is running an mobile endpoint security solution).  But some such solutions have blindspots.  Their threat intelligence can be out of date.  When we tested the malicious link using a leading mobile threat defense solution the link was not marked as dangerous.  Another issue is when filtering is limited to DNS ‘sniffing.’  This is a lightweight approach to filtering by examining only DNS traffic (a tiny proportion of all IP traffic going to and from a device) which, when introduced first, was very effective.  However, Corrata research shows that circa 20% of devices are now using encrypted DNS making DNS sniffing completely ineffective.  Secure Web Gateway solutions can overcome this blindspot but bring with them challenges around latency and privacy.  On device solutions can avoid these shortcoming, but none of them, with the exception of Corrata, incorporate the host firewall technology required to accurate identity malicious domains.  

Effectiveness of consumer and enterprise protections

Attackers’ Evasion Tactics

Coming back to our case study – it turns out that our attackers took further measures to avoid detection.  The domain’s DNS information initially directed the browser to Cloudflare’s infrastructure.  And the attackers used this to take advantage of Cloudflare’s support for Encrypted Client Hello (ECH).  ECH hides the name of the requested domain which would otherwise be transmitted in the clear and therefore detectable at the firewall level.   The net/net of this is that, for those 20% of devices which use encrypted dns, the malicious site would be completely undetectable.  The Corrata Labs team has identified that over 90% of phishing sites are now using Cloudflare ECH to bypass security controls. 

Table summarising the gaps in protections

The combination of ‘permissive filtering’ by service providers and browser vendors and gaps in ‘lightweight’ enterprise solutions means that organizations are more exposed to spear phishing attacks on mobile that they appreciate.  This is a marked contrast to the corporate email box: defenders and solution providers have worked relentlessly to augment the limitations in the built-in protections.  Attackers are fully aware that other messaging platforms are both growing in popularity within the enterprise and that such channels are poorly defended.  Its time for organizations to re-visit their risk assessments in light of the challenges that mobile brings. 

The post No Filter – Part Two appeared first on Corrata.

The news that Donald Trump has intervened to keep TikTok accessible for American users may slow the exodus of “TikTok refugees” to Xiaohongshu, also known as Rednote. However, given the rapidly evolving situation, it’s impossible to predict how this story will unfold.

Efforts to ban TikTok, which began during President Trump’s first term, are driven by concerns that the Chinese government could exploit the app for national security purposes to the detriment of the United States. However, there’s also a more practical reason to be cautious about Chinese social media platforms and consumer tech: their failure to consistently adhere to basic cybersecurity standards when transmitting user data over the internet.

One of Corrata’s key features is its ability to monitor the quality of encryption between a user’s mobile device and the services they access. Frequently, we flag cases where websites use outdated cryptographic suites or TLS versions. Such vulnerabilities leave users exposed to potential interception by skilled hackers with the motivation and expertise to exploit these weak connections.

In examining traffic to and from Chinese apps, we often encounter a more glaring issue: data being sent “in the clear,” meaning without any encryption. This problem is common with Chinese consumer IoT devices, but it also extends to other popular Chinese apps in the West. E-commerce platforms are frequent offenders. Thankfully, the data exposed is often limited to non-sensitive information, such as app analytics or performance metrics.

However, there are occasions when we uncover far more concerning issues: like the one involving Rednote.

Thumbnails in the clear

Last week, our systems began flagging unusual activity related to the app, prompting a deeper investigation. While requests to view videos and the videos themselves are transmitted securely using TLS 1.3, we discovered HTTP GET requests for image resources, such as WebP thumbnails, being sent to content delivery network (CDN) hosts like sns-na-i9.xhscdn.com. These requests, which include formats like WEBP, JPG, PNG, and potentially a proprietary format labeled REIF, are not encrypted.

This unencrypted traffic exposes users’ viewing activity to anyone monitoring the network, whether it’s a neighbor on shared Wi-Fi, colleagues on a corporate network, or even state actors. Moreover, plaintext HTTP traffic lacks authenticity, leaving it vulnerable to tampering or spoofing. Our investigation revealed that even simple actions like registering for the app can generate upwards of 16,000 unencrypted traffic frames, making the scale of exposure significant. This issue appears to be linked to the app’s configuration, as its XML definitions indicate a base configuration that permits cleartext traffic: a setting that Android security guidelines strongly discourage due to the risks of data manipulation and exposure.

We’ve shared our findings with Xiaohongshu and are currently awaiting their response. For more technical details, please refer to the full incident report.

The post TikTok alternative, RedNote, leaking user data appeared first on Corrata.

According to Verizon’s authoritative Data Breach Investigation Report, 90% of data breaches start by stealing user credentials. Once the attackers have gotten a username and password combination, they have unrestricted access to your account, be it email, online storage, CRM, ERP, or any online business application. This is a particular problem in today’s cloud computing era, when web access to business applications is the norm. So you no longer have to be connected to the corporate network to access these systems – an internet connection is enough.

Why Multi-factor Authentication is critical to cyberdefense

Security professionals are well aware of this reality and, for this reason, have promoted the adoption of multi-factor authentication (MFA). MFA addresses the risk of account compromise by ensuring that possession of a username/password combination alone is no longer enough to get access. Now the attacker must also be able to get hold of a second factor. This can take many forms: a one-time use code sent to a trusted device, a code generated by an authenticator app or security device or a biometric fingerprint.

Introducing MFA is not without challenges. Employees and customers need to be educated in the new process and often view the additional step or steps as an annoyance. Nonetheless, there has been real progress, and a variety of industry surveys suggest that today more than 78% of organizations with more than 1,000 employees have implemented MFA.

How cyber-criminals bypass MFA

But in the arms race that characterizes the battle between cybersecurity attackers and defenders, the bad guys have responded with new techniques which have been successful in breaching accounts protected with multi-factor authentication.

They have done this by combining phishing with a variety of methods. This includes re-directing one-time use passwords sent over SMS to a cloned SIM card (Sim Swapping)  or using mobile malware to capture authentication codes. But by far, the most dangerous technique for undermining the effectiveness of MFA is an attack which combines phishing with a method known as ‘Adversary-in-the-Middle” (AiTM for short). Rather than intercepting the one-time password this technique works by ‘listening-in’ on the login process and then stealing the authentication cookie generated when a user successfully logs in.

Traditionally a phishing attack steals credentials by presenting the account owner with a fake version of the login page of a legitimate service. As the example of a recent attack against Revolut users shows, such fake login pages can be extremely well crafted and difficult for even the vigilant to detect.

Adversary-in-the-Middle

However, an attack like this is easily defeated when multi-factor authentication is required.  So how have the bad guys altered their tactics? What is an Adversary-in-the-Middle attack?

As in all phishing attacks, it starts with a malicious link delivered over email, sms or some other messaging platform. But instead of re-directing to a fake login page, the link sends the user to a server which transparently forwards the users’ request to the legitimate site. This  ‘reverse proxy’ simply sits in the middle and is invisible to the end user. Once the user successfully authenticates by entering their password and one-time use code, the attacker steals the authentication cookie. Once in possession of the cookie, the attacker can inject this into their browser and have unrestricted access to the compromised account without the need to provide a username, password, or second-factor code.

What about encryption?

Transport layer security is a fundamental building block of security on the web. It ensures that even when attackers can intercept communications, they have no way of decoding their contents.

However, encryption doesn’t protect against an AiTM attack. The user who falls for the lure and clicks on the malicious link believes they are requesting to connect to a legitimate site. An encrypted session is created between the user’s browser and the site to which it connects (so you’ll see the lock sign in your browser). But everything you enter, including username, password, and authentication code, is fully visible to the attacker as it is their website to which you are connected. The attacker then logs into the legitimate site (for example, Office365.com) on your behalf. You now have access to the service as expected, but so does the attacker who has, unknown to you, copied your authentication cookie. With the authentication cookie, the attacker is free to login into the compromised account for weeks, if not months, after the initial breach.

Evidence that the threat is growing

There have been multiple reports of successful breaches using the AitM technique. Microsoft documented large-scale AiTM attacks targeting over 10,000 organizations which successfully compromised business email accounts. To make matters worse potential attackers now have access to a range of toolkits, including Modlishka, Necrobrowser, Evilginx2, and Evilproxy, which are making it increasingly easy to launch this type of sophisticated attack.  Phishing resistant forms of MFA n offer hope of a better future but widespread adoption is still some way off: according to Okta’s Secure Sign-In Trends report only 4% of organizations use such methods today. 

Understanding in detail how these attacks are executed helps reinforce how devastating they can be and emphasizes how important it is to have protection in place to block phishing attacks over every channel: email, sms, AR codes, WhatsApp, and all the communications channels your staff use today. Phishing protection is no longer solely about protecting your email service – it must encompass all of the delivery channels through which phishing links can be delivered.

The post MFA Bypass – Stealing Cookies appeared first on Corrata.

The era when the vast majority of sensitive organizational data traveled over networks under corporate control has long passed. In today’s cloud-centric world, security professionals are acutely aware they must build security on the basis that much of their organizations’ information will routinely traverse networks which are fundamentally insecure. The rapid adoption of SaaS and the internet enablement of in-house applications means more and more data is exposed to the risks that these networks present.

This is not a new challenge. As Matthieu Bentot, Chief Technical Architect at Corrata put it in a recent post, “The problem always was, and remains, how to ensure the authenticity, confidentiality and integrity of communications, from end to end, at all time, for the whole device, over an inherently insecure network.” In this blog post, we will outline the critical role of Transport Layer Security, its vulnerabilities when poorly implemented and explain some steps to ensure you’re not undone when others get it wrong.

Vulnerabilities are not restricted to Wi-Fi networks

When we speak of insecure networks, the first thing that most of us think of is public Wi-Fi. And there are a number of reasons why Wi-Fi networks are particularly vulnerable. When you connect to a wireless hotspot which doesn’t require a password, you leave your data open to being intercepted as it travels through the air. Both the content of your unencrypted traffic and your browsing destinations are made visible to third parties. Such interception doesn’t require specialized hardware or advanced knowledge: many laptops have built-in wireless diagnostics tools which support sniffing Wi-Fi traffic in their vicinity.  

However, even if you can’t have your traffic intercepted as it travels through the air, there are still multiple risks which impact any network, wired or wireless, that can be accessed by third parties. The most obvious is when our device is tricked into connecting not to the legitimate network but to a fake, rogue or compromised access point under the control of malicious actors. 

The operators of coffee shops, restaurants, airports and libraries are not, in the first instance, concerned with security. Instead, they are concerned with providing a service which will make their locations more attractive to customers. In these circumstances, it is trivial for a malicious actor to introduce compromised equipment into the network. It can be as simple as placing a rogue access point in the location and then tricking users into connecting to the access point. And this is not as far-fetched as it seems: cybercriminals targeting you are not beyond visiting your local coffee shop.  

But even if the infrastructure we are connecting to has not been compromised, the mere fact that we are sharing a network, wired or wireless, with third parties leaves us exposed. Networking tools can use promiscuous mode to capture traffic from devices connected to the same network segment. A technique known as ARP spoofing can redirect your traffic from its intended destination to one under the control of the bad guys. This latter technique can then be used to launch an Adversary-in-the-Middle attack. 

In its classic form, the device traffic is redirected to an imposter site (say, when you are attempting to access email). The attacker can then capture critical data such as username, passwords and 2FA codes. More recently, we have seen such attacks capture authentication cookies by introducing a proxy between the device and the legitimate site. 

But it’s not all bad news. 

Today 81% of websites encrypt traffic using https. According to Google, 97% of Chrome traffic in the US was secured in this way. And Corrata’s internal statistics show these percentages are higher still for employee devices. So, we have successfully transitioned from an ear that relied on securing the network to one which relies on strong end-to-end encryption between endpoints.  

Nonetheless, we need to take into account the ways in which Transport Layer Security (the protocol underlying https) can be compromised. The most obvious is the use of out-of-date or obsolete ciphers, cipher suites or underlying protocols that are no longer secure. Attackers can intercept such poorly encrypted traffic and, with relative ease, uncover its secrets. It’s the digital equivalent of hiding a key to your home under the welcome mat. This kind of poor cybersecurity hygiene is outside your control, and it can’t be taken for granted that all website operators are diligent.

A second area of concern is poor coding practice leading to sensitive data being sent over http rather than https. At Corrata, we have uncovered a number of examples where data is posted by mobile devices to websites in unencrypted form.  

The third way in which TLS can be broken is via the Adversary-in-the-Middle attacks described above. Specifically, your device can be tricked into accepting a fake TLS certificate (the digital document which confirms that a website is authentic). Today most apps address this issue using a technique called ‘cert pinning.’ With cert pinning, the app itself will check that the cert presented by the website is precisely the one expected. However, cert pinning isn’t implemented by all apps and is almost impossible to implement in mobile browsers. For this reason, devices remain vulnerable to this type of attack.

What is to be done?

At Corrata, we’ve found that these risks can be addressed via a number of controls implemented by security software deployed on the mobile device. 

Specifically, it is possible to check for sensitive transactions being sent without encryption and for websites that are using weak encryption and/or invalid certificates. When these circumstances are encountered, enterprise data is protected by blocking transmission to or from the device to the impacted domains. This approach aligns with the increasingly prevalent zero-trust architecture being adopted by many organizations.

Famously, Ronald Reagan, when negotiating with his Soviet counterparts, used the Russian proverb’ trust, but verify.’ Today this strikes us as an excellent summary of Corrata’s approach to the security of internet communications. Despite regular reports of the threat that quantum computing poses to the Transport Layer Security protocol, it will remain an absolutely foundational element of the internet security architecture for the foreseeable future. And one that we should continue to trust, but not blindly.

The post Don’t Get Undone By The Wrongs Of Others appeared first on Corrata.

As an IT leader in a legal firm, you don’t need to be told about how important Information Security is to your sector. Legal firms face unique challenges. They not alone handle client funds but also handle sensitive and highly confidential information. Handling of sensitive information is not the exception in legal firms, it’s the rule.

The range of potential attackers targeting legal firms is comparable to that facing governmental organizations, including nation-states, serious organized crime gangs, and hacktivists. Attackers are motivated not just by financial gain but also by political, ideological, and nation-state concerns. Incidents such as the release of the Panama and Paradise papers send a chill through the bones of legal firm Information Security staff everywhere. 

Risks are particularly acute for firms whose clients are in sensitive or controversial sectors such as energy, life sciences, capital markets, and high technology.  

Recent trends

Experts point to a range of recent trends which are heightening the risk profile of the legal industry:

• Clients challenge the technical capabilities of firms insisting that they support their preferred collaboration and data storage systems.
• The legal supply chain is becoming more complex: outsourcing, disaggregation of the delivery of legal services, and the increased use of specialist firms. Not alone must legal firms collaborate securely with their clients, but they must also do so with a range of other legal providers.
• Remote working has become the norm, and with it, the requirement that documents and systems be accessible from anywhere at any time in a manner which delivers both security and ease of use.
• Complex and often conflicting privacy regulations. For example, firms working with US clients may well need to take growing state-level privacy laws into account in their operations.

Supply chain attacks have raised awareness across all sectors that your data is only secure when the third-party suppliers you rely on have effective information security management systems. Clients demand insight into their legal service providers’ cybersecurity controls, processes, and procedures. They are acutely aware that the information they share with their lawyers is highly sensitive and need reassurance that it is being handled and protected appropriately. Firms need to credibly answer clients’ requests about their cyber security practices and their information security management system. Increasingly clients demand certifications such as ISO 27001 and SOC 2.

All of these factors point to the unique importance of information security to the reputation of legal firms. Partners are only too aware that a single incident can destroy a reputation carefully built up over countless years, and there are plenty of ready, willing, and able competitors just waiting for an incumbent to slip.

Information security leaders within legal firms are not complacent, and neither are their management. PWC UK’s Annual Law Firm Survey revealed that the top 100 firms have increased their spending on cybersecurity by an average of 39% in the last year.

The rise of mobile risk

But what if that spend is not properly allocated? Today many legal firms have no protection in place against the rising threats facing mobile users, even though we are now seeing a 50/50% split between mobile and desktop traffic – a significant change from the 25/75 split in 2015. As the profession embraces cloud computing, the exposure that mobile represents begins to align with the exposure with traditional domain-joined devices.  

Today, the vast majority of medium and large legal firms have mobile device management systems in place. In fact, many have had these systems in place for many years. However, the clue is in the name: these are management systems, not security systems. They don’t defend against the three principal risks facing mobile users today. 

The first of these is the risk of credential theft either via phishing attacks or malicious applications. 77% of leading law firms reported experiencing a phishing incident in 2022. These attacks are widespread and increasingly sophisticated. Not alone can they steal usernames and passwords but also authentication cookies and codes. MFA is not a panacea.

Advanced spyware is the second significant risk facing law firms, particularly those dealing with clients in sensitive sectors. Multiple scandals have raised awareness of security agencies’ use of the Pegasus iOS spyware to mount targeted surveillance on politicians and civil rights activists. Today there is mounting concern that similar sophisticated technology is being deployed more widely. Such malware bypasses the in-built security protections in iOS and Android and cannot be detected by anti-virus software. But the threat is real and can lead to a fundamental compromise of any data on the phone and create a gateway to all of the data in the organization.

The third risk is from intercepted communications. Lawyers use their smartphones and tablets continuously on networks which are not under their organization’s control. This can be anything from a home network to the free Wi-Fi provided in hotels or coffee shops or, indeed, the cellular network itself.  Without robust and continuous encryption, these communications are at risk of interception by determined adversaries.

A better set of solutions

It is, unfortunately, true that the first generation of mobile security solutions promised more than they delivered. Many were designed and based on replicating the limited features found in traditional anti-virus solutions. They failed to take into account the unique benefits (for example, sandboxing and the app store distribution model) and challenges (for example, smishing and user privacy expectations) of the mobile environment.

The good news is that there are easy-to-deploy, privacy-sensitive solutions available today. Mobile Threat Defence technology has moved on since the term was first coined by Gardiner back in 2016. Today leading-edge mobile threat defense solutions protect against SMS and other mobile-specific phishing attacks, are able to detect sophisticated malware and against communications which are inadequately encrypted. And what’s more, the leading solutions can do all of this without the need to collect privacy-sensitive information such as location or the contents of files on the device.

In Conclusion

I would urge legal firm IT leaders to carefully consider the benefits of deploying MTD. If you’ve previously looked at mobile endpoint security solutions, now is a good time to look again and if not, then take a look for the first time. You’ll be pleasantly surprised by the protections available, the positive user experience provided, and the ease of management and deployment. And you never know, but your partners might even thank you! 

The post Courts, Contracts, Cloud And Collaboration appeared first on Corrata.

And that is exactly what happened. We are always on the lookout for security issues so we can help companies minimize their financial losses. We recently discovered a security issue with the German news site, www.bild.de. This site gets approximately 200 million visits per month and is one of the most visited sites in the world!

So, what was the security issue?

The website contained some misconfigured security settings which resulted in 3DES being used on multiple pages, including the user login page which puts iPhone users at risk. The readers’ connection was encrypted using outdated technology putting them at risk of a man-in-the-middle attack. 

Why is this dangerous?

We’ve all been warned to watch for the padlock in your web browser as that meant you were visiting a secure site. In reality, not all padlocks are created equally. Websites with a padlock may still be using outdated cipher suites (like Bild) allowing your password and other sensitive data to be stolen. 

Even with the latest flagship phones and software updates, your device is still vulnerable. A mobile/tablet needs network protection to prevent potential man-in-the-middle attacks. Corrata instantly detects and blocks risky resources. The bild.de login page was automatically blocked by our software, which led to our discovery of this major security misconfiguration. We reported this issue to Bild.de and they are resolving it. 

No business has the capability to individually monitor every website visited by their employees, that’s why Corrata is the perfect solution for you. We constantly protect your devices from threats your employees encounter every day without even knowing it!

The post How secure are the news sites your employees visit on their mobile devices? appeared first on Corrata.