1

I'm concerned that in my network some background applications / virus can use my internet connection as malicious backdoor, and then I'm in trouble (i.e. authorities can think that one of my pc has done something illegitimate / illegal) so I've taken the decision to CLOSE all the outgoing connection to the network, except navigation and some other services (skype, email, ecc); but how can I perform this being secure that a virus / backdoor will utilize the ports opened to obtain the above services (ie 80, 483, 25, 143, 587 ecc.)? Should this be made at application level (what for example if a virus simulate to be "outlook.exe" and send an email to the regular port I opened?) What's the best policy for this environment? I would like to setup it in my firewall, and leaving EVERYTHING but the web and other services out. It seems to be a problem bigger than I can handle. Thank you.

1

What you want to achieve is impossible using a simple firewall that just blocks ports, exactly for the reasons you stated. A smart malicious program installed on your machine will use ports you don't block, e.g. 80, 443 or maybe the various ports used for smtp, although these aren't as reliable as 80 and 443. It might also use udp and masquerade as DNS lookups.

To catch such traffic, you'd need a firewall that inspects traffic (deep packet inspection). Or you could use an intrusion detection system; these often work by learning what constitutes "normal" traffic and then alerting you when traffic that gows outside these bounds is detected. This might be as simple as alerting you when a lot of connections to different machines are opened, or detect moee complicated patterns.

If you're a private person trying to secure a home network, I'd say the effort isn't worth the gains. It's different for a company network.

Blocking destination ports you don't need on outgoing traffic is a good first step, though, and doesn't have negative consequences. You can also block specific host names or IP adresses to block specific programs from phoning home.

0

An alternative to doing this at a network level is to use an application whitelisting program. This approach is gradually becoming recognized as one of the few feasible ways of dealing with the flood of malware out there. In this approach, only known good programs are allowed to execute - there is no guessing, signatures, heuristics or anything else, if it isn't on the allowed list, it doesn't run.

It definitely impacts usability, though - it is generally considered suitable for computers that have defined usage patterns. It is more difficult where general purpose computers are concerned, where you are expecting to install programs often (since the white list is only good if you are very, very careful what goes on it).

An option, at least.

  • This is interesting. But this whitelisting should be at execution of program or packet filtering stage? I'd prefer the second. Often you need to use some application you don't trust very much for example because it is requested by a customer / supplier. – il_maniscalco Nov 22 '16 at 11:17
  • To be safe, it should be at program execution time. But, as you say, that's difficult - that's why most people aren't safe. Basically, as far as I'm aware, there are three approaches : 1) signature based. This is broken - malware changes too often. 2) Behaviour based - this program is doing network/system calls that look malware-like. Stop it. 3) Whitelist based - these programs are ok, all others are not. Cylance claims to be doing a fourth (our deep-learning trained ai says this is malware), but most programs are doing some variant of the first 2. I think the 3rd is most reliable. – crovers Nov 22 '16 at 14:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.