0

Assuming the following:

  1. a computer is compromised and connected to a network where a simple wireless router or modem is the only form of firewall security

  2. all incoming connections are blocked by the router.

Is there any way the attacker would be able to host services (receiving incoming connections) on that machine without direct access to the router?

Are there any work arounds I might be forgetting?

Improve this question

2 Answers 2

Reset to default
1

Yes, one of you main concerns will be to disable UPnP (Universal Plug 'n Play).

UPnP could allow a malicious program to bypass the firewall entirely, allowing other computers to directly contact a network service hosted on the compromised machine.

UPnP assumes local programs are trustworthy and allows them to forward ports. If malware not being able to forward ports is important to you, you’ll want to disable it.

Improve this answer
2
  • 1
    Exactly the answer I was looking for! Please upvote J.A.K. for the prompt and helpful response 👏🏽
    – king9x
    Commented Feb 26, 2017 at 23:51
  • Hahahaha thanks, that's very kind :) By the way, welcome to Information Security SE and to the stackexchange community in general
    – J.A.K.
    Commented Feb 26, 2017 at 23:54
2

Yes, since any technology not dependant on port fowarding will still work. Tor, VPN-based networks (you can get a dedicated WAN IP on the endpoint), certain distributed systems like torrent and DHT, gnutella or even IRC-based methods. STUN and TURN can be abused and used as well.

Improve this answer
3
  • I'd also consider something like this: Compromised machine regularly pings an attacker-controlled server. That server receives connection requests on the behalf of the compromised machine, and if it has any waiting, the compromised machine connects to the requester. Basically a reverse shell with something telling it where to go.
    – etherealflux
    Commented Feb 27, 2017 at 4:29
  • I may be mistaken but I thought port forwarding was required to run a TOR relay. Reverse proxies are certainly something to look out for though.
    – king9x
    Commented Feb 27, 2017 at 15:11
  • Well, with TOR, you can also host hidden services without being a relay as far as I know.
    – John Keates
    Commented Feb 27, 2017 at 15:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .