CMM7XX

Malware Detection & Firewalls

Session 8: Perimeter Defense

James Williams

jwilliams@staff.newman.ac.uk

Learning Objectives

  • Deconstruct advanced malware architectures (Polymorphism, Rootkits).
  • Analyze execution techniques like Reflective DLL Injection.
  • Map Advanced Persistent Threat (APT) behaviors using the MITRE ATT&CK framework.
  • Evaluate Next-Generation Firewalls (NGFW) and Deep Packet Inspection (DPI).
  • Formulate evasion strategies against Web Application Firewalls (WAF).

Next-Generation Firewalls (NGFW)

Traditional firewalls (Layer 3/4) only look at IP addresses and ports. NGFWs operate up to Layer 7.

  • Deep Packet Inspection (DPI): Examining the actual data payload of the packet to identify the application (e.g., distinguishing BitTorrent traffic from HTTP traffic, even if both use Port 80).
  • TLS/SSL Inspection: Acting as a trusted Man-in-the-Middle to decrypt, inspect, and re-encrypt outbound traffic, catching malware hiding in encrypted tunnels.
  • Identity Awareness: Linking network traffic to specific AD users, not just IP addresses.
Practical Resource: Sikorski & Honig: Practical Malware Analysis

Web Application Firewalls (WAF)

Specifically designed to protect web applications by inspecting HTTP traffic for common web exploits (SQLi, XSS, Path Traversal).

  • Operates as a reverse proxy, sitting in front of the web server.
  • Relies heavily on Regular Expressions (Regex) and heuristic signatures to detect malicious patterns (e.g., blocking requests containing UNION SELECT).
  • Susceptible to bypasses if the regex is poorly written or fails to account for protocol edge cases.
Practical Resource: Saltzer & Schroeder: Protection of Information in Computer Systems

WAF Evasion Techniques

Attackers craft payloads that the WAF ignores, but the backend server executes.

  • Encoding: Using URL encoding, Base64, or Hex encoding to mask the payload. If the WAF doesn't decode it deeply enough, it bypasses the filter.
  • Polyglots: A payload valid in multiple contexts (e.g., both valid JavaScript and valid HTML), designed to confuse the parser.
  • HTTP Parameter Pollution: Sending the same parameter twice. The WAF might check the first one, but the backend server might process the second one.
Practical Resource: Saltzer & Schroeder: Protection of Information in Computer Systems

Introduction to Task 2

WAFs are not a silver bullet. Relying purely on WAFs without fixing the underlying vulnerable code is a dangerous anti-pattern.

We will act as the red team, attempting to craft a payload that slips past a strict, regex-based WAF filter.
Practical Resource: OWASP ModSecurity Core Rule Set

Task 2: WAF Evasion Simulation

Timing: 50 minutes

A target web application is protected by a WAF that strictly blocks any HTTP request containing the strings <script>, alert, or UNION.

  1. Craft an XSS payload that achieves execution without using the blocked strings (e.g., using SVG elements, onload events, and String.fromCharCode).
  2. Craft an SQL Injection payload that bypasses the UNION block by utilizing SQL comment obfuscation (e.g., UN/**/ION).
  3. Discussion: Discuss why parameterized queries (Prepared Statements) are fundamentally superior to WAF filtering for preventing SQLi.
Practical Resource: OWASP ModSecurity Core Rule Set

Summary & Next Steps

  • Malware has evolved beyond static binaries; Living off the Land techniques require behavioral monitoring rather than signature matching.
  • NGFWs provide deep visibility, but must be configured with TLS inspection to be effective against modern threats.
Next Week: Intrusion Detection Systems (Monitoring and Alerts)
Practical Resource: MITRE ATT&CK Framework