2

Assuming the following:

  1. a computer is compromised and connected to a network where a simple wireless router or modem is the only form of firewall security

  2. all incoming connections are blocked by the router.

Is there any way the attacker would be able to host services (receiving incoming connections) on that machine without direct access to the router?

Are there any work arounds I might be forgetting?

3

Yes, one of you main concerns will be to disable UPnP (Universal Plug 'n Play).

UPnP could allow a malicious program to bypass the firewall entirely, allowing other computers to directly contact a network service hosted on the compromised machine.

UPnP assumes local programs are trustworthy and allows them to forward ports. If malware not being able to forward ports is important to you, you’ll want to disable it.

  • 1
    Exactly the answer I was looking for! Please upvote J.A.K. for the prompt and helpful response 👏🏽 – Nathan Taylor Feb 26 '17 at 23:51
  • Hahahaha thanks, that's very kind :) By the way, welcome to Information Security SE and to the stackexchange community in general – J.A.K. Feb 26 '17 at 23:54
2

Yes, since any technology not dependant on port fowarding will still work. Tor, VPN-based networks (you can get a dedicated WAN IP on the endpoint), certain distributed systems like torrent and DHT, gnutella or even IRC-based methods. STUN and TURN can be abused and used as well.

  • I'd also consider something like this: Compromised machine regularly pings an attacker-controlled server. That server receives connection requests on the behalf of the compromised machine, and if it has any waiting, the compromised machine connects to the requester. Basically a reverse shell with something telling it where to go. – etherealflux Feb 27 '17 at 4:29
  • I may be mistaken but I thought port forwarding was required to run a TOR relay. Reverse proxies are certainly something to look out for though. – Nathan Taylor Feb 27 '17 at 15:11
  • Well, with TOR, you can also host hidden services without being a relay as far as I know. – John Keates Feb 27 '17 at 15:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.