Attack Technique
Traffic mirroring
Traffic mirroring is an important part of network diagnostics — but it also opens the door to data exfiltration. Here’s what you need to know about this attack technique.
Definition
What is traffic mirroring?
Traffic mirroring is an Amazon Virtual Private Cloud (VPC) feature that lets you copy network traffic and send it to another destination, such as an inspection or troubleshooting tool. According to AWS, this technique works by copying inbound and outbound traffic from the network interfaces that are attached to your EC2 instances. You can send this mirrored traffic to a network or gateway load balancer with a UDP listener, or to the network interface of another instance. Components include:
- The traffic mirror source, typically an elastic network interface (ENI)
- Traffic mirroring targets, or security and monitoring appliances
- The traffic mirror session, or the connection between the source and target
The traffic mirror filter, or inbound and outbound rules that determine which traffic to copy and send
How it works
How traffic mirroring works?
Traffic mirroring can be implemented at various points in a network, such as on switches, routers, or dedicated network taps. The mirrored traffic is typically directed to security appliances, intrusion detection systems (IDS), intrusion prevention systems (IPS), or a security information and event management (SIEM) system. The goal is to provide these tools with real-time data without interrupting the flow of the original traffic. Benefits include:
- More visibility: Monitoring traffic in real-time helps cybersecurity teams gain a comprehensive view of network activity. This visibility is crucial for identifying suspicious behavior and potential security incidents.
- Non-intrusive monitoring: Traffic mirroring allows you to passively observe network data, ensuring security measures don’t interfere with normal network operations.
- Enhanced threat detection: Mirrored traffic can be fed into your network detection and response solution, where machine learning and AI detects anomalies, malicious activities, and lateral movement.
- Performance monitoring: Beyond security, traffic mirroring helps network administrators diagnose and resolve issues more efficiently.
- Compliance: Traffic mirroring helps you maintain compliance with regulatory requirements by ensuring continuous monitoring and logging of network activities.
It’s important to note that while traffic mirroring is a fundamental part of network diagnostics, it’s also a way for attackers to exfiltrate your data.
Why attackers use it
Why attackers use traffic mirroring?
Attackers use traffic mirroring to intercept, capture, and analyze network communications without authorization. By duplicating network traffic and directing it to a location they control, attackers can gain access to sensitive information, monitor communications, and exploit vulnerabilities within a network.
Primary reasons why attackers employ traffic mirroring
Interception of sensitive data
- Credential harvesting: Attackers can capture usernames, passwords, and authentication tokens transmitted over the network. This allows unauthorized access to systems, applications, and services.
- Data theft: Sensitive information such as personal data, financial records, intellectual property, and confidential business communications can be intercepted and exfiltrated.
- Session hijacking: By capturing session cookies or tokens, attackers can hijack active user sessions, impersonating legitimate users to gain further access.
Network reconnaissance and surveillance
- Network mapping: Analyzing mirrored traffic helps attackers understand the network topology, identify devices, services, and communication patterns.
- Identifying vulnerabilities: Traffic analysis can reveal outdated software, insecure protocols, misconfigurations, or weak encryption methods that can be exploited.
- Eavesdropping: Attackers can monitor communications to gather intelligence, spy on sensitive conversations, or collect information for future attacks.
Bypassing encryption and security measures
- SSL/TLS interception: If attackers can intercept encrypted traffic before it's encrypted or after it's decrypted, they can access the plaintext data.
- Avoiding detection: By mirroring traffic internally, attackers can bypass perimeter security measures like firewalls and intrusion detection systems that monitor external threats.
Facilitating advanced attacks
- Man-in-the-Middle (MitM) attacks: Traffic mirroring enables attackers to position themselves between communicating parties, allowing them to intercept, modify, or inject malicious data into the communication stream.
- Command and Control (C2) communication: Attackers can establish covert channels within mirrored traffic to control compromised systems without raising suspicion.
- Injection of malware: By manipulating traffic, attackers can deliver malware payloads to targeted systems.
Exfiltration of data
- Stealthy data transfer: Mirrored traffic can be used to exfiltrate large amounts of data over time, reducing the likelihood of detection.
- Data encoding and steganography: Attackers may hide data within legitimate traffic patterns or files, making exfiltration less noticeable.
Methods attackers use to implement traffic mirroring
Compromising network devices
- Routers and switches: Gaining unauthorized access to network infrastructure devices to configure port mirroring or SPAN (Switch Port Analyzer) sessions.
- Network taps: Physically installing devices that intercept network cables to capture traffic without disrupting network operations.
Installing malicious software
- Packet sniffers: Deploying software like Wireshark, tcpdump, or custom sniffers on compromised systems to capture network packets.
- Rootkits and malware: Using advanced malware that operates at the kernel level to intercept network communications invisibly.
Exploiting protocol vulnerabilities
- ARP Spoofing/Poisoning: Manipulating Address Resolution Protocol tables to redirect traffic through the attacker's system.
- DNS Spoofing: Redirecting traffic by corrupting DNS responses to send users to malicious sites.
Compromising wireless networks
- Rogue access points: Setting up unauthorized wireless access points to intercept wireless traffic.
- Evil Twin attacks: Mimicking legitimate Wi-Fi networks to trick users into connecting, allowing attackers to intercept their traffic.
Platform Detections
How to detect malicious traffic mirroring
The only proven way to catch malicious traffic mirroring before it starts is with advanced AI and machine learning. That’s why Vectra AI’s security engineers built an advanced AI-driven detection model specifically for traffic monitoring. Security analysts use it to see when an AWS control-plane API is invoked — the earliest sign of a malicious attempt to leverage traffic mirroring — so you can stop the attacker before they have a chance to create a network traffic session.
