5 ms·
> Specifically, it hides files and directories beginning with the names “auwd” and “vmware_helper” from directory listings and hides ports 52695 and 52699, wher
by le-mark 3y ago
> Specifically, it hides files and directories beginning with the names “auwd” and “vmware_helper” from directory listings and hides ports 52695 and 52699, where communications to attacker-controlled servers occur.
Do people out there really “allow any” ports on their firewalls? Or are those ports for control inside the firewall only?
- 3np 3y agoOutgoing? You bet. Have you been out there?
- BLKNSLVR 3y agoOutgoing, which I believe this would be, is generally far less restrictive than incoming. I'm playing around with IP address level detecting and blocking using incoming ports as indicators. I'm going to set aside some time to think more about restrictions on outgoing ports as a result of this and your comment. Do some logging of frequently used remote ports over a couple of weeks and create a baseline set of allowed ports, block everything else and see what breaks. I already use the limited Feodo Tracker[0] lists to flag in my firewall logs whether any device on the network has attempted to contact a known C&C IP address. Thanks for push. [0]:https://feodotracker.abuse.ch https://feodotracker.abuse.ch
- BLKNSLVR 3y agoFirst things first, found I've got a bunch of devices doing "internet check" pings to Google's DNS servers once per second! I feel dirty that that's been going on so long. Devices reconfigured to NOT do that at all. Now that's cleared, the log won't be quite so cluttered. Edited to add: Also redirected a whole load of regular NTP queries to remain internal.
- BLKNSLVR 3y agoAlso: time of day restrictions. There's sweet FA traffic that should be going out to the 'net when everyone's asleep. But make sure these rules can be switched on and off in case of emergencies. I had to take my daughter to emergency late one night a few months ago (didn't end up being anything worthy of a story), but got home at 2:30am. My garage door opener gets smart-home-switched-off at 1:00am-ish. At 2:30am, just wanting to go to bed after the stress of an emergnecy room, waiting for that thing to boot up felt like 15 minutes.
- peblos 3y agoLog4shell would have been a much smaller problem if so
- goodpoint 3y agoYes. This is some very basic malware, but real ones will use HTTPS on port 443.
- BLKNSLVR 3y agoOnly allow HTTPS out to FAANG (whatever it is now) + Cloudflare IP address ranges
- Kubuxu 3y agoNothing prevents C&C from being fronted by cloudflare.
- viraptor 3y agoAnd CloudFlare will be extremely happy to let them hide there. They don't care about malware abusing their workers infra. But also "Only allow HTTPS out to FAANG" - ok, so now you're allowing encrypted connections to 2 largest cloud providers. At that point what's the benefit at all?
- jay-barronville 3y ago> They [Cloudflare] don't care about malware abusing their workers infra. This is a serious allegation to make. Do you happen to have some supporting evidence?
- fullspectrumdev 3y agoIt’s widely known and talked about in the infosec community - getting CF to do anything about malicious content on their services is an absolute nightmare. I do understand they don’t want to set any bad precedents internally, but their abuse reporting is abysmal.
- jay-barronville 3y ago
- vitus 3y ago> Or are those ports for control inside the firewall only? It seems so. This traffic likely will not even traverse a firewall -- the article lists the IP addresses used with port 52699, which are all RFC1918 space (172.16.0.0/12).