RE: how to block connections running on non-default ports

From: Roger A. Grimes (roger_at_banneretcs.com)
Date: 08/18/05

  • Next message: Kelly Martin: "SF new column announcement: It's only a matter of time... by Jason Miller" 
    Date: Thu, 18 Aug 2005 07:50:16 -0400
To: "Niranjan S Patil" <niranjan.patil@gmail.com>, <security-basics@securityfocus.com>

    This is a common issue and a proxy device is needed. By definition a
    proxy firewall, with a service proxy, would review and strip out all
    "malformed" data from a communication's stream. Unfortunately, because
    443 is normally encrypted, I'm not sure how accurate any 443 proxy
    firewall service would be...but many firewalls let you build your own
    proxy filters and I'm sure you could be fairly accurate with a little
    research.

    Also, many network traffic analyzers, like Ethereal, can sometimes not
    the correct traffic type even when running on non-default ports. It
    depends on the sniffer and the protocol.

    Roger

    ************************************************************************
    ***
    *Roger A. Grimes, Banneret Computer Security, Computer Security
    Consultant
    *CPA, CISSP, MCSE: Security (NT/2000/2003/MVP), CNE (3/4), CEH, CHFI
    *email: roger@banneretcs.com
    *cell: 757-615-3355
    *Author of Malicious Mobile Code: Virus Protection for Windows by
    O'Reilly
    *http://www.oreilly.com/catalog/malmobcode
    *Author of Honeypots for Windows (Apress)
    *http://www.apress.com/book/bookDisplay.html?bID=281
    ************************************************************************
    ****

     

    -----Original Message-----
    From: Niranjan S Patil [mailto:niranjan.patil@gmail.com]
    Sent: Monday, August 15, 2005 11:36 AM
    To: security-basics@securityfocus.com
    Subject: how to block connections running on non-default ports

    Hi list,

    I recently noticed that our corporate IDS could not block some of
    connections that are seemingly unauthorised.

    I launched a telnet connection to a remote server on Internet on port
    23 and it was successfully blocked by our firewall. I change the
    listening port of the telnet server to 443 and launched another telnet
    connection on port 443. Neither our firewall or IDS was able to block
    this connection.

    Aren't IDS supposed to block such masqueraded connections, i.e.,
    protocols with non-default ports.

    I have less knowledge on IDS, but isn't it simple for them to check
    packet headers and block/filter if they are not on right protocol/port?

    Is this normal with all IDS?

    Any help is appreciated. 

    --
Regards,
Niranjan S Patil
  • Next message: Kelly Martin: "SF new column announcement: It's only a matter of time... by Jason Miller"

    Relevant Pages

    • Re: Port 135
      ... The patch doesn't disable DCOM / RPC, so connections can still be made. ... That's why you need a firewall. ... the patch is not the thing to control ... control over your TCP/IP ports and services, ...
      (microsoft.public.security)
    • Re: Got Active Ports, now what?
      ... have services running and ports open does not in ANY way shape or form mean ... vulnerabilities and links to plenty of other ... Why do I need 23 connections to the ... > You should get a 'Application' Filtering Firewall for your XP box. ...
      (comp.security.firewalls)
    • Re: File sharing
      ... Instead of creating exceptions for individual ports for FPS I suggest that you try Group Policy and configuring the exemption for file and print sharing and probably the remote administration exemption. ... If there are do domain level Group Policies being applied to these computers currently for Windows Firewall, which you could verify by running rsop.msc on the client computer, you could try using local Group Policy to see if it does what you want. ... So then I went back and put in a custom setting to accept connections on the local subnet plus connections from my subnet, ...
      (microsoft.public.windowsxp.security_admin)
    • Re: Blocking IM servers
      ... it needs tcp and udp over all the dynamic ports. ... However, it can be configured to use "blind" proxy, i.e. specifying http ... proxy behind my linksys firewall router so that it doesn't want the other ... Like MSN Messenger, it can be configured to use "blind" http proxy, see ...
      (comp.security.firewalls)
    • Re: On passwords, securtiy and real -sweat, blook and tears- life
      ... given that all ports are closed to external contact through a physical allbeit consumer oriented firewall, just means I am safe for port-scanners. ... connections reduces the risk a lot. ... you can boot in single user mode and change the password. ...
      (Fedora)