1

If I block application A.exe on my firewall, but it dynamically generates B.exe and runs it automatically. Would B.exe also be blocked on my firewall?

  • 1
    Why not do a little test and find out? – Bill_Stewart Feb 14 '17 at 21:10
0

When you create the rule for A.exe, if you create the rule spefically for that executable then no, B.exe will not be blocked (unless B.exe is loaded into A.exe's process) as it is seen as an independent executable. However, if you create the rule using a port number instead, then if A.exe & B.exe both use the same port number's to send / receive data on then yes, B.exe will also be blocked as the firewall does not care about the application layer at that point. It just see's a packet being sent / received under port x and executes the rule regardless of what is listening / connected to that port.

Alternatively, to achieve what you're asking, you can configure the firewall to block all connections unless there is a rule allowing said application and thus you can allow A.exe by default and anything else, regardless of where it came from, will be blocked (until you create a rule allowing it).

  • I'm a bit confused by this. If a process spawns another process, won't it always be in the same 'context' as the parent, like a child process? Isn't there such a protection that only users can launch parent processess? It seems a bit useless to me to even use a firewall if it is so easily bypassed by spawning another executable and running it. – raphadko Mar 11 at 16:14
  • 1
    Windows doesn't decide how an application should be executed or what process it should be executed under thus the firewall has no way of knowing where a process originates from or if it should be blocked. You definitely should use a firewall and I have suggested a way you can do what you are asking (by blocking all applications by default and white listing applications that you trust.). If its security you seek then there are many other variables that you can also consider, i.e isolated execution (VM / sandbox), only allowing signed code to be executed etc. – Kieran Devlin Mar 11 at 16:19
1

It depends on the methodology you choose to allow access. You may choose to allow access to applications you want to and create a "cleanup" or "block everything else rule" wherein besides what you've explicitly allowed everything else I'll be blocked. So in your case since you haven't allowed A.exe or B.exe they won't get network access. You can further lock this down using checksums (if your firewall permits). Meaning you can state allow Firefox.exe with checksum xxxxx to access port 80,443 outbound. I know Symantec Endpoint Protection has this feature. You may look this up on your firewall. This is useful since the malicious program may spawn a process with a whitelisted executable filename.

0

It all depends on the firewall technology you are using and how 'blocking' is really handled. However, in general, no probably not. If you are dealing with an app which is sophisticated enough to dynamically spawn another app to try and get around firewall blocks, it probably also makes other dynamic changes designed to avoid/bypass common filtering approaches.

These days, the term firewall tends to mean a lot of different things to different people and there is a wide range of different technologies used at the 'firewall', such as various intrusion detection or intrusion prevention (IDS/IPS) solutions, deep packet inspection etc.

Blocking of content at the firewall level is frequently based on either some form of deep packet inspection, data 'signatures', dynamic and/or virtual machine based analysis, protocol or basic IP or port source/destination information. There is a time/resource trade-off aspect i.e. ability to perform analysis and make a decision such that the process does not have unacceptable impact on performance and then, just to make life interesting, you can throw in the complexities introduced with data encryption and the impact it has on the firewall's ability to analyse the data.

Without knowing exactly how you are blocking the application, we cannot really answer this question. If you are blocking based on source/destination IP/port and the app B.exe uses the same ports, then yes, it will likely also be blocked. If your blocking based on protocol signatures and the app is using the same protocol, then yes, probably. If you are blocking based on some other 'signature' in the data communication, maybe or maybe not, depending on whether the new/dynamic app uses the same signature. It may also depend on whether your talking about a program which dynamically spawns new processes/apps to deliberately subvert firewall blocks or simply because of some other justifiable architecture decision i.e. malicious intent vs innocent design.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.