1

I've been trying to solve a homework question in a beginner infosec class, and I was stumped on an issue and I didn't really know of the right place to ask. If it isn't then please let me know.

Given the following ports,

8080/UDP

6667/TCP

53/TCP

443/TCP

if somebody was developing malware, which would be the most likely to be used by it to bypass the firewall?

I know that 53 and 443 are DNS and HTTPS respectively.

My way of thinking about the problem is that it's likely a firewall would be set up to not drop incoming HTTPS traffic so that would be the best one to develop malware for, but I feel like there's possibly a trick to the question I'm missing. Also it's probably possible to eliminate UDP 8080 because it falls out of the commonly used UDP service range, meaning it's likely to be blocked by default.

Any insight or explanation would be helpful. Thanks!

  • 1
    I think you are right.A malware would want to look like https traffic and would use port 443 – Vipul Nair Oct 2 at 4:42
  • Does the scenario state that there is a firewall? Or is that an assumption? TCP/53 could be used for DNS Tunneling (HTTP(S) over DNS). TCP/6667 is an IRC port, which is often used to control the malware/botnet. – Jeroen Oct 2 at 5:19
  • @Jeroen A firewall is assumed in the problem. I just made that addition, sorry about that. – Carcanken Oct 2 at 5:22
  • @Carcanken I understand your thought process. However, if that information is not given in the scenario would you want to include it? The same applies to: is this from an internal or external perspective? Because if you think about it from an internal perspective there might not be a firewall at all. – Jeroen Oct 2 at 5:25
  • If your firewall can inspect packets and payloads it will find out that inside of these packets is something malicious, because the structure of HTTPS and DNS protocol and method show the normal behavior and known methods they are using. – R1W Oct 2 at 5:48
3

Things don't really work how you assume. A firewall CAN drop all incoming 443 traffic and allow only outgoing connections and then connections that have been initialized from inside the firewalled area towards outside. As for the port numbers:

  • 6667 is used by IRC so it's likely to be blocked anyway.
  • That UDP 8080 may be used for anything, including P2P so it's also likely to be blocked.
  • TCP 53 is mostly used internally for DNS zone file transfers, but it may be needed for zone communications between areas, so it may represent a vulnerability but it will not likely be open by default.
  • In the case of 443, if you host a server that requires authentication it is likely that you will need it open.

So given the limited choices above, it's all about what the target network will use: will it use UDP for P2P transfer, will it use IRC, does it host a secure server or will it use zone transfers ? After determining that the attacker will probably choose the right option for the target. Generally, out of them, assuming all are available I'd focus on 443 because it will have encrypted traffic and you could hide your own traffic there or on the UDP port as secondary because P2P traffic is heavy and infiltration is easier when there's heavy traffic.

  • Thank you for the response. Unfortunately the details that I gave here are all that I've been given. I'm going to go with the general case and assume that 443 is probably the correct answer. – Carcanken Oct 2 at 5:23
  • 1
    Encrypted traffic is certainly preferable to use compared to heavy traffic if you want to hide something. – Overmind Oct 2 at 6:25
1

Given that choice, I'd go for 443. Inbound 53 (dns) and 6667 (irc) would be useful if you're targeting a known vulnerability on a specific known server, both those services are rarely vulnerable simply because the protocols and servers are well-established. Port 8080/UDP? It seems unlikely that anything is listening on that: port 8080/TCP is a common http listener port, but I don't believe 8080/UDP is used for that at all.

On the other hand, web servers listening on 443 are a dime a dozen and given the number of Great Gaping Holes™ in quite a few web applications, that would be a good place to start. What you can do once you've compromised the web server depends on what the compromise is and what the web server has access to. That's a different question, though.

  • The question is not about attacking.The question is about what port you would use for outgoing traffic if you were to infect someone with your malware. – Vipul Nair Oct 3 at 6:15
  • I'm afraid I don't see that at all. The question and its comment are phrased as inbound traffic for the purpose of infecting a machine with malware. The outbound port, the local one, is not likely to be an issue unless you're attacking DNS in which case port 53 is often used as the local port instead of using a random or (on Unix/Linux) a privileged port. – John Haxby Oct 4 at 9:53
0

If it's a school textbook type question, then historically port 53 (DNS) was the one that was most likely to be available for firewall bypass.

That is not necessarily true today as that trick is now quite well known, but not too many years ago it was a favorite method. Under the theory that schools tend to be a little behind the times and rigid, I vote 53.

Let us know.

  • If it were 53/UDP then you would likely be correct. However 53/TCP has often been blocked on firewalls for quite some time. – YLearn Oct 3 at 4:32
  • When it comes to test or homework questions, every question is actually two questions. The implied second question is always, "Guess what I'm thinking?" – user10216038 Oct 3 at 20:11
0

First of all, I consider that this question is about outgoing traffic. The infected machine is connecting to a C&C running on some of those ports.

If the malware was going to listen on one of them, well, unless the machine role was actually being a server for one of those services, they should be blocked by the firewall.

As for the actual port, I consider that the msot likely one to be used will be HTTPS (443/TCP). Most machines need to get into (parts of) the internet in one way or other, so it is likely that there is a rule allowing traffic to *:443

It also has the benefit (when compared to the similar 80/TCP) that communication is encrypted. So the firewall or IDS will not be able to inspect if the content conforms to the protocol (as they could with the DNS option), and couldn't block its contents (such as a second-stage virus that is being installed), even if they had rules for them. You would need to be proxying everything, breaking the TLS tunnel, in order to see what is being exchanged.

user10216038 has a point in that sometimes DNS is used to exchange information in a covert way. However, I think that the fact they list DNS over TCP instead of UDP rules that out, since you would want to be using real DNS queries in that case (probably even through their resolver), and if it was the expected answer, it would list 53/UDP (even though you shall allow TCP access to the DNS servers in addition to UDP, as otherwise you won't be able to handle truncated answers).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.