Is it possible to make whitelisted software do custom, malicious things?

Question

Let's say there's a keylogger secretly installed in an employee's computer. The keylogger recorded a bunch of information, but the well-configured firewall blocked the keylogger from sending that information to its server.

Attacking the firewall directly might be too difficult, but what about manipulating the software that the firewall allows (either directly or that software uses an allowed port)?

It can be any allowed software that uses the Internet. Say Outlook for example, can the keylogger somehow make Outlook send custom information to a custom server?

Answer 1

Yes, it is. That's how almost every buffer overflow attack happens.

After gaining a foothold, there's lots of ways to exfiltrate data, even with a firewall in the way. One way is to install an extension on the browser that uses it to send data.

If any internet client is whitelisted, the attacker can leverage it for data transfer as well: FTP clients, SSH, email, even internal Windows components. Any software capable of running scripts can be used as well.

Answer 2

Assuming you already have code execution (that is, the keylogger is executing code, not just e.g. a hardware device) then yes, it's nearly impossible to successfully allow only approved software to do something (like access the Internet). A sample of options:

• Directly use an allowed program, e.g. if ssh, curl, ping, or nslookup are allowed, all of those can be used for data exfiltration.
• Indirectly use an allowed program by modifying the data it relies on. For example, if there's a webserver, put your data up for download there. If there's an email service, modify the mailbox to create a ready-to-send email with the data to exfiltrate.
• Remote-control an allowed program. For example, if an email client or browser is permitted, those can be used to transmit data (any software that can intercept keystrokes should be able to inject them too, or you could perhaps directly use accessibility APIs).
• Use debug APIs to directly take over an allowed process, injecting code to send your data. (You may need to launch an instance of the allowed process, rather than attaching to an existing one.)
• Replace a system library (one dynamically linked by the allowed process) with a modified copy that also sends the relevant data; change the library load paths if necessary.
• If any allowed process is installed in a location you can write to, overwrite its file with one that has the same name but sends your data. (If you can get root/admin privileges, you can usually do this for any file.)
• If the allowlist is by process name, create a malicious process that shares an allowed name.
• If the allowlist is by port or protocol rather than process, transmit the data on an allowed port/protocol, e.g. by DNS lookups or direct connections to an email server.
• If your code has/can gain elevated privileges (e.g. because you captured a supervisor password), simply add yourself to the list of allowed processes or disable the blocking entirely (for long enough to exfiltrate data).

---

I thought at first that this question would be about a much trickier situation. When you've gained the ability to start processes but are on a very locked-down machine without the ability to download other software, you need to "live off the land". That can be a fascinating challenge, though it too is often possible (depending on the programs available to you, and your goals on the system). In a situation where you already have arbitrary code execution and just need to get past a firewall... there are a great many options.