Re: Question: FTP via alternate port

[Packet Man <packetman () altsec info>]

Niels Taylor wrote:

> Hello list, I hope this question is not too "newbie," and I am sure if it is
> I will find out quickly.  I am interested in ways an attacker could
> circumvent outbound FTP restrictions on a FW.  I have researched this a bit
> but the information I am seeing is ambiguous, so I thought I'd take it
> straight to the experts.
>  
While the stock ftp.exe that is on my Win2K box does not provide for 
changing the port used, that doesn't prevent other applications from 
doing so.  Since it is a common security practice to run such things as 
sshd on non-standard ports, there's every reason for a trojan, worm, or 
virus to use the same technique to avoid the usual roadblocks or 
detection techniques based on port.

And, don't think for a moment that malware would be restricted to ftp 
for transfer of files.  Any good programmer could choose among the many 
suitable protocols for communicating, or even invent one.  Then, it 
would be a simple matter for the infected host to just keep trying 
outbound ports until it finds an opening.  For example, how many 
firewall configurations block a connection from a high port on the 
originating host to port 80 on a distant server?  Very few, right?

Over and above all the information security hardware, sometimes 
detection simply boils down to a technique that beat cops have used 
since the beginnings of professional security, and that is "suspicious 
behavior".

And, regarding your SQL server on the internal net; you might consider 
blocking ALL traffic from it to the outside world.  Vulnerable, 
high-value systems should be tightly insulated, firewalled, and proxied 
well away from any threat.

I hope this answers your question.

Good luck.

Mark Stingley

--
Excellence in InfoSec and Linux
http://www.altsec.info


------------------------------------------------------------------------------
Audit your website security with Acunetix Web Vulnerability Scanner: 

Hackers are concentrating their efforts on attacking applications on your 
website. Up to 75% of cyber attacks are launched on shopping carts, forms, 
login pages, dynamic content etc. Firewalls, SSL and locked-down servers are 
futile against web application hacking. Check your website for vulnerabilities 
to SQL injection, Cross site scripting and other web attacks before hackers do! 
Download Trial at:

http://www.securityfocus.com/sponsor/pen-test_050831
-------------------------------------------------------------------------------