2

I have a machine that I use only to browse the Internet. What if I blocked all ports on this machine (inbound and outbound) except for port 80 and port 443, and restricted these two ports to an internet browser executable. Would this make my machine more secure?

  • 1
    You cannot restrict these ports to "an internet brower executable": 80 and 443 are server ports for HTTP/HTTPS, and you have no idea what is making a connection on these ports (curl, metasploit, etc can mimic a Firefox behavior) – Xenos Oct 19 at 11:58
  • "protected" from what? That's the question. – schroeder Oct 19 at 15:51
  • 2
    Blocking ports that don't have a listening service running on them does effectively nothing. – multithr3at3d Oct 19 at 17:37
  • @schroeder protecting from any unauthorized communication with the outer world (i.e. potential spyware that slipped into the machine somehow). – Sisyphus Oct 20 at 19:27
  • @multithr3at3d please explain what do you mean exactly? – Sisyphus Oct 20 at 19:27
6

First, it might make your system slightly more secure but it does not make it fully secure. In the majority of attacks today the victim unknowingly invites the attacker implicitly into the local network. This is for example done when surfing the web: all content you visit is downloaded to your local system and rendered or executed (depending on the content) there. The same is true for emails - any attachments you open will be opened on your local system. And attached Office documents, PDF, archives etc are typical vectors to infect your system. No firewall which just blocks based on ports will protect you against these most common attacks.

Apart from that you should only block incoming ports for data which are not part of an established connection (initiated from the inside). Otherwise you will simply not be able to surf the web anymore. And websites are not only located on port 80 and 443, so restricting outgoing access to these ports will probably result in over-blocking too. Similar you might need access to other ports like 143, 993, 465 ... to retrieve and send mail (unless you use web based mail). And games or whatever applications you use might also need different outgoing ports.

Depending on what system you use it might the best (most security with less side effects) if you use the systems capabilities. For example if you declare your computer to be inside a public network it will already adjust the firewall accordingly to not allow any incoming connections but allow outgoing connections.

  • Assuming the worst case that a spyware has slipped into the machine somehow, either email or an infected USB flash or whatever. Wouldn't blocking communication with the outer world by restricting communications to only web browsing traffic and only to a web browser, keep the machine protected from leaking data to unauthorized remote party rendering the slipped trojan useless to the attacker (assuming a spyware scenario)? – Sisyphus Oct 20 at 19:31
  • 1
    @Sisyphus: Blocking any kind of network activity for applications which are not the web browser might help somewhat. But it will also block various legit and important traffic, like software updates done by the various programs (often each uses its own updater program). Apart from that malware might actually employ the browser itself to communicate with the outside, thus bypassing the block. – Steffen Ullrich Oct 20 at 19:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.