Given a set of ports is there one that is more likely to bypass a firewall?

Question

I've been trying to solve a homework question in a beginner infosec class, and I was stumped on an issue and I didn't really know of the right place to ask. If it isn't then please let me know.

Given the following ports,

8080/UDP

6667/TCP

53/TCP

443/TCP

if somebody was developing malware, which would be the most likely to be used by it to bypass the firewall?

I know that 53 and 443 are DNS and HTTPS respectively.

My way of thinking about the problem is that it's likely a firewall would be set up to not drop incoming HTTPS traffic so that would be the best one to develop malware for, but I feel like there's possibly a trick to the question I'm missing. Also it's probably possible to eliminate UDP 8080 because it falls out of the commonly used UDP service range, meaning it's likely to be blocked by default.

Any insight or explanation would be helpful. Thanks!

Answer 1

Things don't really work how you assume. A firewall CAN drop all incoming 443 traffic and allow only outgoing connections and then connections that have been initialized from inside the firewalled area towards outside. As for the port numbers:

• 6667 is used by IRC so it's likely to be blocked anyway.
• That UDP 8080 may be used for anything, including P2P so it's also likely to be blocked.
• TCP 53 is mostly used internally for DNS zone file transfers, but it may be needed for zone communications between areas, so it may represent a vulnerability but it will not likely be open by default.
• In the case of 443, if you host a server that requires authentication it is likely that you will need it open.

So given the limited choices above, it's all about what the target network will use: will it use UDP for P2P transfer, will it use IRC, does it host a secure server or will it use zone transfers ? After determining that the attacker will probably choose the right option for the target. Generally, out of them, assuming all are available I'd focus on 443 because it will have encrypted traffic and you could hide your own traffic there or on the UDP port as secondary because P2P traffic is heavy and infiltration is easier when there's heavy traffic.

Answer 2

Given that choice, I'd go for 443. Inbound 53 (dns) and 6667 (irc) would be useful if you're targeting a known vulnerability on a specific known server, both those services are rarely vulnerable simply because the protocols and servers are well-established. Port 8080/UDP? It seems unlikely that anything is listening on that: port 8080/TCP is a common http listener port, but I don't believe 8080/UDP is used for that at all.

On the other hand, web servers listening on 443 are a dime a dozen and given the number of Great Gaping Holes™ in quite a few web applications, that would be a good place to start. What you can do once you've compromised the web server depends on what the compromise is and what the web server has access to. That's a different question, though.

Answer 3

If it's a school textbook type question, then historically port 53 (DNS) was the one that was most likely to be available for firewall bypass.

That is not necessarily true today as that trick is now quite well known, but not too many years ago it was a favorite method. Under the theory that schools tend to be a little behind the times and rigid, I vote 53.

Let us know.

Answer 4

First of all, I consider that this question is about outgoing traffic. The infected machine is connecting to a C&C running on some of those ports.

If the malware was going to listen on one of them, well, unless the machine role was actually being a server for one of those services, they should be blocked by the firewall.

As for the actual port, I consider that the msot likely one to be used will be HTTPS (443/TCP). Most machines need to get into (parts of) the internet in one way or other, so it is likely that there is a rule allowing traffic to *:443

It also has the benefit (when compared to the similar 80/TCP) that communication is encrypted. So the firewall or IDS will not be able to inspect if the content conforms to the protocol (as they could with the DNS option), and couldn't block its contents (such as a second-stage virus that is being installed), even if they had rules for them. You would need to be proxying everything, breaking the TLS tunnel, in order to see what is being exchanged.

user10216038 has a point in that sometimes DNS is used to exchange information in a covert way. However, I think that the fact they list DNS over TCP instead of UDP rules that out, since you would want to be using real DNS queries in that case (probably even through their resolver), and if it was the expected answer, it would list 53/UDP (even though you shall allow TCP access to the DNS servers in addition to UDP, as otherwise you won't be able to handle truncated answers).