1

I'm trying to figure out how secure a host firewall is, hence the question in the title. I read that many firewalls allow outbound connections to port 80 to allow browsing, would that be enough for the malware to communicate to the controller? would it be possible with tunneling? This would allow me to carry with HTTP a second protocol that used alone would be disallowed by firewall policy.

1 Answer 1

0

No, a firewall won't block the malware from communicating with the controller. There are too many ways to exfiltrate data, and blocking every single one is not possible without blocking almost every legitimate connection too.

Some people advise about using whitelisting to allow communication only with pre-defined addresses or domains, but that would be very cumbersome to maintain, while still allowing creative malware creators to use legitimate sites to communicate with the controllers (Domain Fronting, posting encoded comments on social media, DNS tunneling).

2
  • 2
    Technically, a firewall can, but most measures can be defeated by simply making the traffic look legitimate.
    – schroeder
    Oct 5 at 14:45
  • I would go even further. yes you can controle what data leaves your node / machine (especially if you controle the outgoing connections of your ISP link)… however almost nobody sets there system up like that since you need to adjust config for every new IP you connect with….
    – LvB
    Oct 5 at 16:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.