Firewall Cracking and Security By: Lukasz Majowicz Dr.

Stefan Robila 12/15/08

What is a firewall? Firewalls are programs that were designed to protect computers from unwanted attacks and intrusions. Wikipedia defines a firewall as an integrated collection of security measures designed to prevent unauthorized electronic access to a networked computer system. It is also a device or set of devices configured to permit, deny, encrypt, decrypt, or proxy all computer traffic between different security domains based upon a set of rules and other criteria. By this definition alone it can be deducted that a firewall is essentially a set of rules that controls the flow of information from a single computer and the outside world. This firewall can be obtained in two different forms. One way is to get it as a software package by either purchasing it or downloading it from the internet. Another way of getting a firewall is simply by purchasing a device with a firewall built into it. Most routers now have a firewall built into it to filter out unwanted or suspicious traffic. (http://www.howstuffworks.com/firewall.htm (All sites from howstuffworks.com/firewall*))

Here is a sample picture of a firewall interface:

The basic use of a firewall is to prevent any traffic that may be malicious or harmful from reaching the computer and making a connection with it. In other words if some source is trying to connect with the computer but the firewall sees the source as a suspicious signal or unknown signal it will either block it from connecting to the computer or it will inform the user that a source with such an id is trying to connect with it and gives the user the option of whether the user wants to allow it to connect or not. In so doing the firewall protects our computer from hackers by blocking their attempt to connect to our computer and cause harm. This is done using a newer system of stateful inspection. This method scans key parts of an outgoing packet and compares it to a trusted database of information. It compares incoming

packets to the same database and this determines whether it is trustworthy or not. (http://www.howstuffworks.com/firewall.htm (All sites from howstuffworks.com/firewall*))

(http://www.howstuffworks.com/firewall.htm)

Since hackers are aware of the existence of firewalls, the main goal for them is to find systems and computers that are not protected by a firewall. In modern times however, just about every operating system has a default firewall built into it so that would make any new system impervious to a hacker attack. This would seem like the perfect way to eliminate all the worries of computer users and ensure perfect security but the truth is that even the system that is supposed to protect us from hackers is susceptible to an attack from them and can be altered in a way so that it can be bypassed and a users system and computer can still be overtaken by a hacker.

Cracking a Firewall Through Programming A firewall is nothing more than a set of rules that is run by software to filter traffic and determine which traffic is acceptable and which is not. As with any software programming, some programming language commands can alter a program. To do such a thing requires a very long and exhaustive process in order to do such alterations. In order to disable a firewall or alter it that way would be too complicated and too time intensive to be of much use in achieving the desired effect. (http://www.bankersonline.com/technology/crackhack1218.html)

In order to do what is mentioned above, one would need to know the programming language that the program was created with. In addition to that, they would also need to know programming pretty well to know the different variable names and functions that could alter the program after it is already compiled and operational. Not only does one have to know that but also has to find a way to run this program while the firewall is doing its job, which also means to sneak this code past the firewall so it can be run. (http://www.nasscom.in/Nasscom/templates/NormalPage.aspx?id=6060)

To do something of that magnitude would be to know the programming of the firewall inside out. The hacker would have to know each function run by

the firewall and how it runs them. Using this information, a hacker can write his or her own code that can use that knowledge to work in its own way. For instance, lets say that the firewall has a function called scan that runs the scanning of the different ports or addresses and the result of that scan is a Boolean called result. Based on whether the result is true or false, the connection may be accepted or rejected. If a hacker knows the programming of the firewall he or she can send a small file with code that for instance can say that if the firewall is performing the scanning function it should accept the communication or if the result of the scan is fail and the connection should be rejected, the sent instructions override the standard rules and still accept the connection.

This is a way to gain control of the firewall and change its rules. This would be ideal if one wanted to gain control of a computer and use it to ones own advantage or leisure. Of course using this would slow down the targeted computer so the user would still be somewhat alerted to the alteration and could be aware that the computer is being controlled. Of course, once the user is aware and takes measures to prevent this, such as reinstalling the firewall or formatting the drive, or even something as simple as disconnecting from the internet will sever the control.

Using this method is however, very time consuming and does not offer any advantages. Another method is simpler and less time consuming than exploring the entire program and finding out all of its niches and kinks.

Cracking a Firewall Using Ports Another way of cracking a firewall is to learn about the firewalls themselves. One can always download all the free firewall software that people may use and get a hold of software that might already be on a computer. This is simpler than studying code and trying to alter it. Once one gets familiar with firewalls and knows how they operate, the next step would be to familiarize oneself with the different security holes and back doors of the firewalls. (http://www.textfiles.com/piracy/CRACKING/howtoa.txt)

Every piece of software ever created will have some bugs and security holes. There is no such thing as a perfect program. Knowing this, it certainly means that no firewall will be perfect and run exactly the way it was supposed to and will have its own security issues such as gaps in security or bugs. Even updates that fix these bugs or close up security holes do not eliminate all of them. They do manage to fix some but never all of them, so some areas of firewalls are still vulnerable and open to attack. The main idea of this way of cracking is to explore these loopholes and exploring them.

A way for a firewall to have vulnerabilities and back doors is through different services that connect through the firewall such as remotely accessing a computer or web services such as http or ftp need to connect using ports on the firewall. These ports are used to directly connect through the firewall and link with their needed address. If these services are used often, then it would be a good idea to keep them open. However, if they are not used at all, then they are just open ports that can be used to bypass the firewall and get into the system.

This is not to say that as long as there is traffic going through that port, the firewall will not let any other traffic through. Traffic is traffic and what type of traffic passes through is monitored but through some ports it is not monitored as well as through other ports. Saying this, it means that any open port on a firewall is open to access from the outside. The only thing that can determine if traffic passes through a particular port is the address from where the traffic is coming from.

Whenever a port is open and traffic flows through, not only is the traffic monitored for suspicious content but also where it is coming from. If the content is coming from a trusted source, the information is then checked for any malicious code. If it is coming from an unknown source, a notification

appears and a user is notified of this attempt and has the choice of accepting the connection or rejecting it. Once rejected, any attempts at connection from that address are automatically rejected and discarded.

If a hacker wants to learn to crack firewalls, he or she needs to tests these vulnerabilities on a home network first to make sure that they can efficiently crack the firewall because if they try this on the internet right away, they could be easily detected and caught. (http://www.textfiles.com/piracy/CRACKING/howtoa.txt)

The Steps To Cracking To crack through a firewall, the hacker needs to do some other things first. The first among them is to find a way to connect to the machine that he or she wants to crack. In order to accomplish this, a hacker will need to scan all available communication ports in order to find a way to communicate with the desired machine. Most of the computers usually use a router so to get to a target machine or network, they have to first get through a router.

To do this, a hacker needs to scan all communication ports in order to find a port that is open to communication and a signal can be sent through. Once communication is established, the hacker can then attempt to try to find a hole through the firewall. This may sound easier than it is done. This is

because, as mentioned above, the traffic is also monitoring addresses from which signals are sent.

To bypass this feature, a hacker will have to mask his IP signature or use some domain to carry out the hack because it could be traced back to him. Of course another problem with this is if the signal(IP address) is unrecognized it could still be blocked so a person hacking the firewall would have to clone the IP address of a trusted source that can go through the firewall ports and use it as its own IP address to try to make the connection. (http://sorry.google.com/sorry/?continue=http://books.google.com/books% 3Fid%3D1yj97C_K_zAC%26pg%3DPA190%26lpg%3DPA190%26dq%3Dbyp assing%2Ba%2Bfirewall%2Bhackers%26source%3Dweb%26ots%3DozkH6C M2SW%26sig%3DxzQbjUGvuoCFqCITk5Iyf_uvIQ%26hl%3Den%26sa%3DX%26oi%3Dbook_result%26resnum% 3D9%26ct%3Dresult)

In this way, the hacker is now disguised as a trusted source and the communication attempt can be accepted if the disguise holds. In this way, the hacker can now have a direct contact with the firewall and try to work his or her way around it or through it. Working through it means to just find

a port that allows traffic with your disguised IP address through and work through it to access the internal network behind the firewall.

Working around the firewall would mean finding a hole that the firewall does not cover and leaves a path right around it without it detecting any activity. This is the least likely of the two as the firewalls of this day and age usually cover most of the loopholes that could be found and control just about all traffic running to and from the computer.

If this is a one-time hacking then all the hacker needs to do is just go with the flow of traffic and do what they desire once the firewall is vulnerable and the hackers signal is disguised as a genuine signal. If the hacker decides to hack this computer more than once or use the computer as a remote location to attack other places, he or she can place a Trojan or just modify the firewall so that it leaves a back door for the hacker to revisit the system and use it at will without going through getting past the firewall again. (http://www.nasscom.in/Nasscom/templates/NormalPage.aspx?id=6060)

Cracking a Firewall Is Not Easy But Possible This just shows that a firewall is just a piece of software that monitors and controls traffic going from and to a computer or local network, a piece of software that just like any other software has bugs and loopholes in it that

could cause it to fail or be vulnerable to attack. Even though this piece of software was specifically designed to protect a system or network from such attacks, it is itself still vulnerable.

This is not to say that cracking a firewall and getting past its defenses is easy and has little consequences if the crack fails. It is just the opposite. Trying to crack through a firewall requires a lot of experience and time and resources to do. One would also have to keep up with all the updates of a given firewall that they are trying to crack and finding out about which loopholes are still available to use.

In addition to that, if a hacker does not disguise his or her signal efficiently enough, they could be exposed and tracked down. Also if a hacker tries to communicate through a port that is not available, they will be denied access and could be exposed so there is a lot of risk involved.

A system is quite secure with a firewall, but one has to know how to set it up and how to maintain it. To keep a system at its utmost secure, one needs to know which services one will be using and close down all the other services that are unnecessary and close down all the ports associated with those services. A user will also need to monitor the traffic going in and out of the

system or network to ensure that the traffic is legitimate and should be going on in the first place.

As another measure of security, one can also find testing programs online that test a firewall to see how vulnerable it is to such attacks. One such site that a person can use is (http://www.security-hacks.com/2007/04/24/howto-test-your-firewall). On this site there are several programs and tests that test out the security of a firewall. There are also provided the ways in which a firewall will be tested and the significance of the test performed.

In Conclusion In conclusion, a firewall can be cracked and bypassed just like any other piece of software. It is vulnerable because of bugs and loopholes in the software but because it is a software that monitors traffic and prevents hacking it is more secure than a traditional piece of software, such as an operating system or an application. It is difficult and risky in trying to crack a firewall, which makes it a good first line of defense but ultimately, the effectiveness of the firewall is dependent on the user and how the user operates the firewall.

Works Cited (1)How Firewalls Work. Howstuffworks. December 15, 2008 <http://www.howstuffworks.com/firewall.htm> (2)What Firewall Software Does. Howstuffworks. December 15, 2008 <http://computer.howstuffworks.com/firewall1.htm> (3)Firewall Configuration. Howstuffworks. December 15, 2008 <http://computer.howstuffworks.com/firewall3.htm> (4)Why Firewall Security?. Howstuffworks. December 15, 2008 <http://computer.howstuffworks.com/firewall2.htm> (5)Firewall. Wikipedia. December 15, 2008 <http://en.wikipedia.org/wiki/Firewall> (6)How To Crack, by +ORC, A Tutorial. December 15, 2008 <http://www.textfiles.com/piracy/CRACKING/howtoa.txt> (7)Firewall. Ask A Scientist. December 15, 2008 <http://www.newton.dep.anl.gov/askasci/comp99/CS058.htm> (8) An Insight into Weak Corporate Security - Firewall Bypass Reverse Connecting Trojans. NASSCOM. December 15, 2008 <http://www.nasscom.in/Nasscom/templates/NormalPage.aspx?id=6060> (9) CEH: Official Certified Ethical Hacker Review Guide. Google Books. December 15, 2008 <http://sorry.google.com/sorry/?continue=http://books.google.com/books %3Fid%3D1yj97C_K_zAC%26pg%3DPA190%26lpg%3DPA190%26dq%3Db ypassing%2Ba%2Bfirewall%2Bhackers%26source%3Dweb%26ots%3DozkH 6CM2SW%26sig%3DxzQbjUGvuoCFqCITk5Iyf_uvIQ%26hl%3Den%26sa%3DX%26oi%3Dbook_result%26resnum% 3D9%26ct%3Dresult> (10)How To Test Your Firewall. Security Hacks. December 15, 2008 <http://www.security-hacks.com/2007/04/24/how-to-test-your-firewall> (11)Cracking and Hacking: Are you doing enough for your network security?. Bankersonline.com. December 15, 2008 <http://www.bankersonline.com/technology/crackhack1218.html>