View PDF

A firewall acts as the first layer of security against cyberattacks. It is a perimeter security device that is configured to monitor & analyze incoming and outgoing traffic. It either allows or blocks data packets based on the network configuration settings.

Although a firewall is an essential component of cyber security structure for any network, some cyberattacks manage to bypass the firewall and penetrate the network.

So how do hackers succeed in bypassing a firewall?

Let’s first understand how a firewall work.

To begin with, a firewall can be in the form of physical hardware or a configured software that runs on endpoint workstations or servers connected to a network.

1. Firewall has pre-configured rules that are used to differentiate malicious traffic from regular traffic.
2. The configuration rules may include the source of traffic, destination, content of data, permission requirements, etc.
3. All incoming or outgoing traffic is analyzed against the configuration rules.
4. The traffic adhering to set rules is allowed to pass through, while the traffic contradicting the configuration rules is blocked.

Now let’s understand what techniques hackers use to bypass a firewall.

1. Exploiting Older Versions: This method is particularly used to bypass older version firewalls that lack “deep packet inspection” or DPI features. DPI enables the firewall to monitor & analyze the incoming & outgoing data packets for malicious code. However, the lack of DPI features reduces the capability of a firewall to detect & block malicious traffic. Threat actors take advantage of this reduced capability & penetrate the firewall by sending phishing emails with a link to inject malicious code into the system.
2. IoT Devices: Large number of IoT devices connected to a network and difficulty in updating them make IoT devices highly vulnerable. This problem is enhanced by UPnP (Universal Plug and Play) feature of IoT devices that enables them to communicate freely with each other. Threat actors take advantage of the automated protocol implemented by IoT devices which allows them to bypass the firewall & connect to the router. Once the threat actors bypass the firewall, they use this path to deliver malware to the router & other devices connected to the WiFi.
3. Exploiting Outgoing Traffic: If a firewall is configured to monitor incoming traffic only, the threat actors can steal data & send it to their own server unnoticed. Some organizations use selective configuration & set rules that allow only outgoing traffic only via HTTP, HTTPS, & DNS protocols. This limits the problem but doesn’t act as a complete solution. The threat actors can still use DNS to move any data across the firewall, as the data moving out via DNS is not monitored or blocked.
4. Social Engineering Attacks: In a social engineering attack, hackers do not try to bypass the firewall. Instead, they gain legitimate access by posing as an allowed user to trick the employees. The hackers may pose as a system admin, a team member, or an IT support executive to gain remote access to the system and get past the firewall. This can be prevented by enabling multi-factor authentication to verify the identity of the person requesting access.
5. SQL Injection Attacks: Traditional firewalls such as network firewall, generally operates at the network, transport, & session layers. This keeps the application layer unmonitored & exposed to attacks that are designed to target the application layer, such as SQL Injection attacks. Attackers take advantage of application vulnerabilities to inject malicious code into the system & gain access to data such as login credentials, financial details, etc.
6. Misconfiguration: A misconfigured firewall offers an easy passage to hackers. This may happen when an organization makes infrastructure changes or sets highly permissive firewall rules. This lowers the capability of the firewall to identify and block malicious traffic.

To know more about cyber security solutions and how to protect your network from cyberattacks, contact Centex Technologies. You can contact Centex Technologies at Killeen (254) 213 - 4740, Dallas (972) 375 - 9654, Atlanta (404) 994 - 5074, and Austin (512) 956 – 5454.