Cybersecurity loves exciting metaphors.
Sometimes, those metaphors may feel a bit over-the-top for the attacks they are applied to.
Warhead for any deliberate side-effect of malware, for example; detonation for the moment at which the malware is used; and the military designations of red team and blue team for pretend intruders and actual defenders.
But most of us are willing to accept such dramatic terminology, even if there are no armed invasions or actual explosions, because cyberattacks can be devastating and costly, as ransomware criminals remind us every time we read of a new intrusion.
That’s why we chose three dramatic metaphors for our headline:
Network firewalls have been known by many names over the past few decades, each name generally reflecting a different degree of redoubtability.
Plain old routers, which pass packets between different networks based on the source and destination data in their headers, can nevertheless provide a degree of firewall-style protection by applying simple rules that go beyond just knowing which networks are on each side of the router.
For example, the router can be programmed not merely to marshal packets to and from the ‘outside’ or ‘inside’, but also to divert some traffic to ‘nowhere,’ quietly protecting internal data from leaking out where it shouldn’t, and blocking external data from known bad sites being used to probe or attack internal targets.
Secure routers, or secure gateways, do more than just look at packet headers, perhaps analyzing the content of individual packets for potentially dangerous content.
Stateful inspection gateways go further still, for example by identifying packets that set up a connection, and then tracking and analyzing future packets based on knowing which connection they belong to.
This opens the way to a firewall that can make decisions at a connection level, for example by sending back “shutdown” packets to close risky connections individually, instead of only being able to react by blocking all traffic from an entire network, even those that are both safe and important.
Firewalls can also act as so-called proxies, so that connections into and out of the network terminate at the firewall itself, which then decides whether it is prepared to create a separate but onward connection to the true destination.
By shuttling traffic between two independent connections, a proxy can store up, or buffer, a whole sequence of packets, or even a full network request, before passing on the first part of it, an approach that lends itself to much more thorough security filtering techniques.
For email traffic, for instance, a proxy-capable firewall could tell prospective email senders to treat the firewall as the “end of the line,” instead of the true email server that the sender wishes to talk to, and therefore receive those emails in their entirety first.
A mail proxy can therefore take its time to examine each message in full before deciding what to do with it, rather than letting a message start going through because the subject line and headers look innocent, only to find a rogue attachment right at the end that means it would have been better to block the whole thing.
Proxy protection can loosely be divided into two classes: explicit, where apps that want to use a service must be individually configured to connect directly to the proxy, and transparent, where any connections to a specific service are invisibly re-routed by the firewall to a security-filtering version of that service before they’re allowed any further.
Firewalls unavoidably act as traffic concentrators and inspectors that end up knowing an awful lot about the users in your network, what they generally get up to, where they go to do it, when they do it, and much more.
That makes firewalls attractive targets for cybercriminals.
Metaphorically put, an infiltrated firewall turns from a redoubt that is supposed to repel eavesdroppers and attackers into a beachhead. (That is not a typo for breachhead, which is not a real word, even though perhaps it should be.)
Compromised firewalls become jumping-off points from which remote criminals can initiate attacks, map your network, conduct surveillance, inject malware, extract passwords, and much more.
Trickily, many firewalls, all the way from home and small business routers to top-end servers, are sold as physical or virtual appliances.
You’re not meant to take charge of them directly in the same way that you might manage, say, a Windows or a Linux server.
In some cases you can’t log in at all, even just to “look around” via a non-administrative account.
Instead, you’re limited to a web-based interface or API (application programming interface) that allows you to control only those settings and configuration details that the vendor chooses to expose.
Your firewall may have threat-hunting features that can identify compromised devices elsewhere on your network, but may itself be off-limits to third-party threat analysts or threat detection and response tools.
For example, scanning your firewall with a malware detector of your choice, in case unwanted software has been implanted on it, may be as good as impossible.
And if you suspect a compromise, then extracting suspicious files and other artifacts for threat researchers to analyze may be more difficult still.
As you can imagine, this opens up a rather wide range of snooping opportunities for rogue software implants, and those implants may be significantly harder to detect and remediate than they would be on a traditional server.
For example, firewall malware could inject itself directly into the traffic filtering and scanning process, including any stages where encrypted data is deliberately unwrapped for security analysis.
Or rogue firewall code could snoop on the memory used by the existing filters and scanners in the system (a trick known in the jargon as RAM scraping), looking out passwords or authentication tokens, yet never showing up in the regular list of firewall processes at all.
Additionally, although firewalls are meant to stop external network connections from reaching most or all internal devices to protect them from direct probes and attacks, they are often open to external connections themselves, in order to provide a range of useful services, such as:
Misconfiguration of any of these services, or exploitable bugs in them, could leave the way open for attackers to implant malware they can come back to later.
Exploitable firewall bugs could also allow criminals to leap right into the network in one step, for example by setting up rogue VPN connections, or sneaking through the registration process and becoming “new users” themselves.
It’s also important to remember that compromised firewalls are often used not to snoop on or to attack your own internal network, but simply as a launching point for attacks on other people and other companies, leaving you to take the initial blame if those attacks are spotted and investigated.
Criminals who can silently implant firewall malware that doesn’t affect your own connections from inside the network may be able to send and receive traffic on the internet side your firewall only for weeks, months, or even years.
Some attackers do this so they can operate an unauthorized proxy server (essentially an unofficial VPN) that they “rent out” to other criminals, essentially reselling your network bandwidth, and more importantly your network address and identity, as online cover for a wide range of cybercrimes.
Also, criminals who have control over malware on thousands or even hundreds of thousands of network-edge devices at the same time can generate traffic that has direct access to the internet without giving themselves away visibly on the inside of your network.
Many home networks run at 1 gigabit per second these days, and even entry-level internet connections typically provide 20 megabit per second or more of outbound connectivity, so that 10,000 infected devices can provide hundreds of gigabits per second, or even terabits per second, of “instant-on” bandwidth, distributed apparently innocently throughout the world.
Cybercrimes conducted with a large collection of devices like this, known as a botnet (bot is short for software robot, and net for network), can cost other internet users dearly, for example due to:
Of course, if those blocklists are subsequently updated in an attempt to mitigate the attack, then it is you who will be blocklisted, not the true criminals.
Learn more about our mobile security solution that goes beyond traditional MDM (mobile device management) software, and offers active on-device protection that’s more like the EDR (endpoint detection and response) tools you are used to on laptops, desktops and servers:
Paul Ducklin is a respected expert with more than 30 years of experience as a programmer, reverser, researcher and educator in the cybersecurity industry. Duck, as he is known, is also a globally respected writer, presenter and podcaster with an unmatched knack for explaining even the most complex technical issues in plain English. Read, learn, enjoy!
Featured image of brick wall by Dave Webb via Unsplash.
By subscribing you agree to our Privacy Policy and provide consent to receive updates from our company.
