Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Lets say I have one load balancer (HAProxy) and two web servers one gets hacked. Is the attacker able to make outgoing connections when the web servers have no direct internet access (only ubuntu update servers) and connections to the load balancer?
How about a reverse proxy (nginx)? would this prevent outgoing direct connections? How could they spawn a shell? (I'd disable ICMP and DNS, and I'd check the integrity of the webapp files)
Incoming and outgoing is only about the direction in which the connection is created. Once the connection is established data can flow in both directions. So an incoming connection can be used to transmit information to the outside.
Let me give some examples:
A common security related bug is to store uploaded files in a folder the webserver serves directly and for which script execution was not disabled. So an attacker can upload phpshell (or similar programs written in perl, python, jsp, asp, ...) and simply connect to the shell using a normal http request. Yes, you said you monitor the web application files, but upload folders would be excluded from that monitoring by design.
The attack may be entirely in memory without any files been written to disk; think of an Stackoverflow attack. If it sees some http-requests made to the webserver, the attacker can use them for communication in both directions.
Depending on permissions simliar attacks are possible using SQL injection: The attacker may be able to create a stored procedure with the program code he "uploads" inside the SQL injection attack. The SQL injection vulnerability is then used from the outside to transmit data in any direction.
The classical protocol to tunnel after http(s) is DNS. It is very easy to firewall outbound http connections and make exceptions for connections to the update servers. But dune to the distributed nature of DNS, protocol inspection is required to filter it while still allowing the update servers to be looked up.
The short answer is YES an attacker can still pop a shell despite these conditions.
Using iptables you can deny all incoming but tcp 80 and 443 for http and https respectively. In addition you can deny all outgoing traffic (but you'd want to still allow for updates). But this can only do so much. You want to protect your web application and it would be more beneficial to use a Web Application Firewall (WAF) like mod_security.
In a web application platform you should be more worried about the owasp top 10 and web application exploits. A major concern is that an attacker exploits your system and then installs a backdoor like the C99 shell. In this case iptables doesn't mean anything, you have to allow http/https and that's all the attacker needs.
Blocking access with iptables does make the system more difficult to compromise with a buffer overflow. For instance download+exec shellocde is very common because it's a straightforward attack where the victim downloads and executes a backdoor. However the attacker doesn't need a connection to upload and execute a file. By using an egg-hunter as staging a buffer overflow exploit then the attacker can include a fair amount of complexity in the payload. For instance this would allow the attacker to load his executable in memory and then write it to a file.
The bottom line is Defense in Depth and security in layers. Use the most restrictive firewall rulesets you can.
