{"id":10,"date":"2019-06-14T17:21:00","date_gmt":"2019-06-14T16:21:00","guid":{"rendered":"https:\/\/increasec.com\/?p=10"},"modified":"2022-07-20T14:29:19","modified_gmt":"2022-07-20T18:29:19","slug":"outbound-filtering","status":"publish","type":"post","link":"https:\/\/increasec.com\/?p=10","title":{"rendered":"Outbound Filtering"},"content":{"rendered":"\n

Outbound Port filtering is a simple method to prevent users from accidentally giving away their credentials.<\/p>\n\n\n\n

Scenario:
BadGuy sends a phishing email including a link to an internet server owned by BadGuy.
User in your network is fooled into clicking on the link which is in the format \\\\server.LooksLikeMyDomain.NotReally\\ShareName
the users computer gladly reaches outside your network, onto the internet and tries to authenticate
BadServerSays: I need to authenticate you, whats your password
TrustingComputerSays: This is my password, Am I authenticated?
BadServerSays: Why yes, thanks for giving me your password, SUCKER!<\/p>\n\n\n\n

Someone is going to “correct” me and say that its a password HASH that gets sent, but since the BadGuy controls the server he can ask the user to hash an empty string.<\/p>\n\n\n\n

The easy solution is to block the ports that make this possible. This won’t affect internal authentication as that doesn’t go through a firewall. <\/p>\n\n\n\n

You can test if you are vulnerable by clicking the links below. (this is a test only and doesn’t give away any credentials) If you are vulnerable a webpage will be displayed titled “Outgoing port tester”
http:\/\/portquiz.net:135\/<\/a>
http:\/\/portquiz.net:137\/<\/a>
http:\/\/portquiz.net:139\/<\/a><\/p>\n\n\n\n

The browser test is blocked in Firefox, Partially in Chrome
But works great in M$ Edge or IE (you’re not still using IE, right?)
The portquiz page gives some alternate methods of testing.<\/p>\n\n\n\n

How to fix; put a rule in your firewall that blocks tcp ports 135-139 outbound. This process will be different for each manufacturer. Pfsense process is here <\/a><\/p>\n\n\n\n

<\/p>\n\n\n\n

DNS port 53 is also commonly used to ex-filtrate data out of a compromised network. I recommend filtering UDP 53 and only allowing a pre-defined list of DNS servers. <\/p>\n\n\n\n

I manage a lot of Fortigate firewalls so i have some rules I paste into the CLI<\/p>\n\n\n\n

config firewall address
edit “DNS_Fortinet1”
set subnet 96.45.45.45 255.255.255.255
next
edit “DNS_Fortinet2”
set subnet 96.45.46.46 255.255.255.255
next
edit “DNS_Cisco1”
set subnet 208.67.222.222 255.255.255.255
next
edit “DNS_Cisco2”
set subnet 208.67.220.220 255.255.255.255
next
edit “DNS_Cloudflare1”
set subnet 1.1.1.1 255.255.255.255
next
edit “DNS_Cloudflare2”
set subnet 1.0.0.1 255.255.255.255
next
edit “DNS_Google2”
set subnet 8.8.4.4 255.255.255.255
next
edit “DNS_Google1”
set subnet 8.8.8.8 255.255.255.255
next
edit “DNS_Quad91”
set subnet 9.9.9.9 255.255.255.255
next
edit “DNS_Quad92”
set subnet 149.112.112.112 255.255.255.255
next
edit “DNS_cira1”
set subnet 149.112.121.20 255.255.255.255
next
edit “DNS_cira2”
set subnet 149.112.122.20 255.255.255.255
next
edit “DNS_8x8_1”
set subnet 8.28.0.9 255.255.255.255
next
edit “DNS_8x8_2”
set subnet 192.84.18.11 255.255.255.255
next<\/p>\n\n\n\n

edit “DNS_Approved”
set member “DNS_Cisco1” “DNS_Cisco2” “DNS_Cloudflare1” “DNS_Cloudflare2” “DNS_Fortinet1” “DNS_Fortinet2” “DNS_Google1” “DNS_Google2” “DNS_Quad91” “DNS_Quad92” “DNS_cira1” “DNS_cira2” “DNS_8x8_1” “DNS_8x8_2”
set color 3
next<\/p>\n","protected":false},"excerpt":{"rendered":"

Outbound Port filtering is a simple method to prevent users from accidentally giving away their credentials. Scenario: BadGuy sends a phishing email including a link to an internet server owned…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[4,3],"class_list":["post-10","post","type-post","status-publish","format-standard","hentry","category-uncategorised","tag-security","tag-smb"],"_links":{"self":[{"href":"https:\/\/increasec.com\/index.php?rest_route=\/wp\/v2\/posts\/10","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/increasec.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/increasec.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/increasec.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/increasec.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=10"}],"version-history":[{"count":5,"href":"https:\/\/increasec.com\/index.php?rest_route=\/wp\/v2\/posts\/10\/revisions"}],"predecessor-version":[{"id":2127,"href":"https:\/\/increasec.com\/index.php?rest_route=\/wp\/v2\/posts\/10\/revisions\/2127"}],"wp:attachment":[{"href":"https:\/\/increasec.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=10"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/increasec.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=10"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/increasec.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=10"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}