8 ms·

I concede that it's not a panacea, but I really do feel like filtering outbound requests is going to be one of the best defences we have against stuff like this

I concede that it's not a panacea, but I really do feel like filtering outbound requests is going to be one of the best defences we have against stuff like this going forward. It protects you against: - viruses / trojans that try to call out - ad tracking (and ads in general, if you want) - intrusive analytics - suspect consumer devices (TVs that transmit live audio, network cameras that connect to the cloud even though the cloud feature is disabled, content players that try to report your activity) Edit: formatting

utefan001 12y ago
A division in the company I work for makes a product that addresses unwanted outbound traffic,http://www.novetta.com/commercial/novetta-advanced-analytics/cyber-analytics/ http://www.novetta.com/commercial/novetta-advanced-analytics...
justincormack 12y ago
Only if you filter outgoing requests from a different box. If the attacker owns your kernel they can bypass the filtering. A nice OpenBSD box as an outbound filter does make sense though, with a different control mechanism.
- _RPM 12y ago
  What about connecting the suspect device to a switch and filtering all of the outbound requests on that switch. If request is approved, forward it to the internet?
  - justincormack 12y ago
    I think you will find you need a decent packet filter that understands state on that "switch" and most switches wont do that in hardware, so it may as well be an appliance.
SEJeff 12y ago
One kind of neat thing I do is filter outbound traffic based on the user. If you're using s newish distro like centos7/rhel7 or a newer ubuntu, you can filter packets with ip tables based on the user. I force the apps in various docker containers to run as different users (one per major app or major suite of apps), and use up tables to lock those bits down. My wordpress got owned and there was a little perl script attempting to contact the C&C server, which ip tables happily blocked. It isn't a panacea, but security works best in multiple overlapping layers.
- click170 12y ago
  I really like this idea. I'm trying to take it one step further in fact. My filtering is done at the gateway, and I'm hunting for ways of communicating which packets are associated with which users (on Linux and Mac). Probably done by tagging an unused part of the packet with some kind of ID.
  - chronomex 12y ago
    Maybe with VLAN tagging?
    - click170 12y ago
      I like this idea. It does assume that a user can't set the vlan themselves but my switches support this and I think it would be really cool to have segregated networks for different levels of user trust.
      - hahainternet 12y ago
        QinQ
      - mobiplayer 12y ago
        Guys, calm down! This has been applied for ages and it's networking 101. Heck, it's the freaking 'hello world' :-) And actually a user can tag his packets, but the security is applied at the switch level, where you can just strip it and add yours. Too bad that means it is not per user, but per switch port... although you may leverage 802.1x... ok, this is getting complex :-) Easier: Block all outgoing traffic, except for an authenticated proxy where every user/app has to go through in order to reach the internet.
acdha 12y ago
That's been successful enough in the past that there's a strong selective pressure for malware to look more like legitimate traffic. How much time are you going to spend reviewing each HTTPS request made to an EC2 IP address? Similarly, if that works, there's zero chance that a large vendor won't use the same endpoint for software updates, advertising and activity tracking, etc. to make filtering impossible.
- WorldWideWayne 12y ago
  Definitely. And command and control centers can also be hosted at a hacked/badly managed site using something like spammimic [1] for messaging. [1] - http://www.spammimic.com/ http://www.spammimic.com/
  - acdha 12y ago
    Yeah, I'd say this would lead to a cottage industry in selling hacked sites for C&C purposes except that market has been thriving for many years.
- click170 12y ago
  I don't dispute that malware is incentivised to look like legitimate traffic. I wanted to respond to your comment about vendors using one endpoint to inhibit filtering. They have as much freedom to do this as I do to deny them any internet access if they do. If the product does not operate as advertised in light of this, it will be promptly returned to the retailer. Also, good filtering isn't based on an IP address alone but that's splitting hairs. Yes it is time consuming but I argue privacy isn't free, it must be protected and defended, we all have to find the medium we are happy with.
  - acdha 12y ago
    > If the product does not operate as advertised in light of this, it will be promptly returned to the retailer. I support this in principle but it really needs regulatory reform: it's hard or impossible return opened software or a device when the manufacturer changes their policies a year after you bought it. That latter point is becoming more relevant as we increasingly see computers deeply integrated into expensive devices with long service lifetimes. Just wait until a car manufacturer pushes out one of those combined “security fixes and new terms of service / we collect your personal data” patches and you're faced with living with problems, suing, or clicking Accept and hoping you'll have better options in a few years when you're looking for a new car. > Also, good filtering isn't based on an IP address alone but that's splitting hairs. Yes it is time consuming but I argue privacy isn't free, it must be protected and defended, we all have to find the medium we are happy with. That's a worthy sentiment but I think it's a losing game because at its root it's a social problem. It's going to be a tough battle as long as companies have very limited regulation for collecting personal information, the ability to unilaterally change service terms after purchase with no right to compensation, and – particularly critical – no penalty for security failures except in rare cases where an expensive lawsuit succeeds. (That wouldn't directly affect outright malware but corporate responsibility would increase the incentives to take security more seriously than most companies have in the past)
jethro_tell 12y ago
Outbound filtering is great but easily beaten with a mild level of sophistication. The addition of outbound monitoring and analysis is gold. What kind if dns requests am I making how many per hour? how many per page load? how many per domain? What do my flows look like? Do i have DNS flows that last an hour? http connections that serve twice the normal data as my normal page load? http connectionsreturned per domain. Is do i return addresses that are not listed on my servers? Security layers say you should force all your traffic out your neccessary ports then scrutinize your traffic through those limited egressess.
- acqq 12y ago
  "Normal" web page of today makes unbelievable number of connections to different CDN destinations. As soon as you browse the internet "normally" on the same machine, you'd spend maybe an order of magnitude more to analyze the traffic than to consume the content. The solution would be not to browse the internet at all from the computers which aren't in the DMZ, like the military (hopefully) does.
  - jethro_tell 12y ago
    First, you'll do your filtering on a different box. If someone has root, it's really easy to change the firewall on the box. Also trivial to delete your logs before they are scanned. You also don't want to be doing IDS work on your end clients. >"Normal" web page of today makes unbelievable number of connections to different CDN destinations. As soon as you browse the internet "normally" on the same machine, you'd spend maybe an order of magnitude more to analyze the traffic than to consume the content. This is not really true. I'm not advocating Deep Packet Inspection here. I'm talking about taking a look at per flow stats and setting a baseline for your network. In this case, you wouldn't be processing each packet in real time, just looking at the metadata. To be honest I don't really want to know what's in each packet that comes out of my networks. I do want to have a baseline and look for anomalies.
    - acdha 12y ago
      How would you distinguish between e.g. an HTTPS request to a CloudFlare IP for a legitimate blog comment and one for a throwaway blog being used for C&C?

utefan001 12y ago

A division in the company I work for makes a product that addresses unwanted outbound traffic,http://www.novetta.com/commercial/novetta-advanced-analytics/cyber-analytics/ http://www.novetta.com/commercial/novetta-advanced-analytics...

justincormack 12y ago

Only if you filter outgoing requests from a different box. If the attacker owns your kernel they can bypass the filtering. A nice OpenBSD box as an outbound filter does make sense though, with a different control mechanism.

_RPM 12y ago
What about connecting the suspect device to a switch and filtering all of the outbound requests on that switch. If request is approved, forward it to the internet?
- justincormack 12y ago
  I think you will find you need a decent packet filter that understands state on that "switch" and most switches wont do that in hardware, so it may as well be an appliance.

SEJeff 12y ago

One kind of neat thing I do is filter outbound traffic based on the user. If you're using s newish distro like centos7/rhel7 or a newer ubuntu, you can filter packets with ip tables based on the user. I force the apps in various docker containers to run as different users (one per major app or major suite of apps), and use up tables to lock those bits down. My wordpress got owned and there was a little perl script attempting to contact the C&C server, which ip tables happily blocked. It isn't a panacea, but security works best in multiple overlapping layers.

click170 12y ago
I really like this idea. I'm trying to take it one step further in fact. My filtering is done at the gateway, and I'm hunting for ways of communicating which packets are associated with which users (on Linux and Mac). Probably done by tagging an unused part of the packet with some kind of ID.
- chronomex 12y ago
  Maybe with VLAN tagging?
  - click170 12y ago
    I like this idea. It does assume that a user can't set the vlan themselves but my switches support this and I think it would be really cool to have segregated networks for different levels of user trust.
    - hahainternet 12y ago
      QinQ
    - mobiplayer 12y ago
      Guys, calm down! This has been applied for ages and it's networking 101. Heck, it's the freaking 'hello world' :-) And actually a user can tag his packets, but the security is applied at the switch level, where you can just strip it and add yours. Too bad that means it is not per user, but per switch port... although you may leverage 802.1x... ok, this is getting complex :-) Easier: Block all outgoing traffic, except for an authenticated proxy where every user/app has to go through in order to reach the internet.

acdha 12y ago

That's been successful enough in the past that there's a strong selective pressure for malware to look more like legitimate traffic. How much time are you going to spend reviewing each HTTPS request made to an EC2 IP address? Similarly, if that works, there's zero chance that a large vendor won't use the same endpoint for software updates, advertising and activity tracking, etc. to make filtering impossible.

WorldWideWayne 12y ago
Definitely. And command and control centers can also be hosted at a hacked/badly managed site using something like spammimic [1] for messaging. [1] - http://www.spammimic.com/ http://www.spammimic.com/
- acdha 12y ago
  Yeah, I'd say this would lead to a cottage industry in selling hacked sites for C&C purposes except that market has been thriving for many years.
click170 12y ago
I don't dispute that malware is incentivised to look like legitimate traffic. I wanted to respond to your comment about vendors using one endpoint to inhibit filtering. They have as much freedom to do this as I do to deny them any internet access if they do. If the product does not operate as advertised in light of this, it will be promptly returned to the retailer. Also, good filtering isn't based on an IP address alone but that's splitting hairs. Yes it is time consuming but I argue privacy isn't free, it must be protected and defended, we all have to find the medium we are happy with.
- acdha 12y ago
  > If the product does not operate as advertised in light of this, it will be promptly returned to the retailer. I support this in principle but it really needs regulatory reform: it's hard or impossible return opened software or a device when the manufacturer changes their policies a year after you bought it. That latter point is becoming more relevant as we increasingly see computers deeply integrated into expensive devices with long service lifetimes. Just wait until a car manufacturer pushes out one of those combined “security fixes and new terms of service / we collect your personal data” patches and you're faced with living with problems, suing, or clicking Accept and hoping you'll have better options in a few years when you're looking for a new car. > Also, good filtering isn't based on an IP address alone but that's splitting hairs. Yes it is time consuming but I argue privacy isn't free, it must be protected and defended, we all have to find the medium we are happy with. That's a worthy sentiment but I think it's a losing game because at its root it's a social problem. It's going to be a tough battle as long as companies have very limited regulation for collecting personal information, the ability to unilaterally change service terms after purchase with no right to compensation, and – particularly critical – no penalty for security failures except in rare cases where an expensive lawsuit succeeds. (That wouldn't directly affect outright malware but corporate responsibility would increase the incentives to take security more seriously than most companies have in the past)

jethro_tell 12y ago

Outbound filtering is great but easily beaten with a mild level of sophistication. The addition of outbound monitoring and analysis is gold. What kind if dns requests am I making how many per hour? how many per page load? how many per domain? What do my flows look like? Do i have DNS flows that last an hour? http connections that serve twice the normal data as my normal page load? http connectionsreturned per domain. Is do i return addresses that are not listed on my servers? Security layers say you should force all your traffic out your neccessary ports then scrutinize your traffic through those limited egressess.

acqq 12y ago
"Normal" web page of today makes unbelievable number of connections to different CDN destinations. As soon as you browse the internet "normally" on the same machine, you'd spend maybe an order of magnitude more to analyze the traffic than to consume the content. The solution would be not to browse the internet at all from the computers which aren't in the DMZ, like the military (hopefully) does.
- jethro_tell 12y ago
  First, you'll do your filtering on a different box. If someone has root, it's really easy to change the firewall on the box. Also trivial to delete your logs before they are scanned. You also don't want to be doing IDS work on your end clients. >"Normal" web page of today makes unbelievable number of connections to different CDN destinations. As soon as you browse the internet "normally" on the same machine, you'd spend maybe an order of magnitude more to analyze the traffic than to consume the content. This is not really true. I'm not advocating Deep Packet Inspection here. I'm talking about taking a look at per flow stats and setting a baseline for your network. In this case, you wouldn't be processing each packet in real time, just looking at the metadata. To be honest I don't really want to know what's in each packet that comes out of my networks. I do want to have a baseline and look for anomalies.
  - acdha 12y ago
    How would you distinguish between e.g. an HTTPS request to a CloudFlare IP for a legitimate blog comment and one for a throwaway blog being used for C&C?