Application Control Bypass for Data Exfiltration, (Tue, Mar 31st)
Source SANS ISC Handlers Diary
Description
In case of a cyber incident, most organizations fear more of data loss (via exfiltration) than regular data encryption because they have a good backup policy in place. If exfiltration happened, it means a total loss of control of the stolen data with all the consequences (PII, CC numbers, …).
Impact
The impact of this threat is significant for organizations relying on next-generation firewalls to prevent unauthorized data exfiltration. Successful exploitation results in loss of confidentiality as sensitive data (e.g., PII, credit card numbers, intellectual property) can be stealthily extracted without triggering firewall blocking. Unlike ransomware or encryption attacks, data exfiltration leads to permanent loss of control over stolen information, potentially resulting in regulatory penalties, reputational damage, and financial losses. The slow, low-bandwidth nature of the exfiltration reduces the likelihood of detection by traditional network monitoring tools focused on large data transfers or unusual bandwidth spikes. Organizations with strong backup policies may feel secure against ransomware but remain vulnerable to this stealthy exfiltration technique. The threat affects any environment using NGFWs with application control features that rely on payload volume for classification, which is common in enterprise networks worldwide. Detection and prevention require more sophisticated monitoring beyond port and protocol filtering, increasing operational complexity and resource requirements.
Defensive guidance
1. Implement network anomaly detection systems that monitor for unusual patterns such as a high number of short-lived TCP connections or frequent small data transfers that may indicate chunked exfiltration attempts. 2. Employ behavioral analytics and machine learning-based intrusion detection to identify deviations from normal network traffic patterns, including beaconing or repetitive connection attempts. 3. Use data loss prevention (DLP) solutions that inspect data content and enforce policies on sensitive information leaving the network, regardless of transport method. 4. Harden firewall policies by combining application control with strict user and device authentication, limiting which systems can initiate outbound connections on non-standard ports. 5. Monitor firewall logs and alerts for repeated connection attempts or partial data transfers that may indicate evasion attempts. 6. Segment networks to restrict access to sensitive data repositories and limit the number of systems that can communicate externally. 7. Regularly audit firewall configurations and conduct penetration testing to identify open ports and potential bypass vectors. 8. Consider deploying endpoint detection and response (EDR) tools to detect suspicious processes or scripts performing chunked data transfers. 9. Educate network administrators and security teams about this evasion technique to improve incident response and forensic capabilities. 10. Collaborate with firewall vendors to understand and apply the latest updates or signatures that may improve detection of such evasive exfiltration methods.
Summary
This threat involves bypassing application control features of next-generation firewalls (NGFWs) to exfiltrate data from a corporate network. NGFWs like Palo Alto Networks' App-ID, Checkpoint's App Control, and Fortinet's Application Control classify network traffic by analyzing application payloads rather than relying solely on port numbers. This allows them to enforce granular security policies and block unauthorized applications or data flows. However, accurate classification requires a minimum volume of data—typically between 5 to 10 KB—to reliably identify the application or protocol. In the demonstrated scenario, a security researcher discovered an open TCP port on a corporate network protected by such a firewall. Initial attempts to exfiltrate data in a single stream were blocked after approximately 5 KB, as the firewall detected and classified the traffic as unauthorized. To circumvent this, the researcher developed a method to split the data into small chunks of about 3 KB and send each chunk over separate short-lived TCP connections with retries. On the attacker-controlled server, a listener script continuously accepts these connections and saves each chunk as a separate file. After all chunks are received, they are concatenated to reconstruct the original file with verified integrity via SHA256 hash matching. This chunked exfiltration approach avoids sending enough data in any single connection to trigger firewall classification and blocking, effectively bypassing the application control mechanism. Although slower and more complex, this method can stealthily exfiltrate sensitive data such as personally identifiable information (PII) or credit card numbers without raising immediate alarms. The technique is a proof-of-concept and may be detected by monitoring for anomalous patterns like numerous small TCP connections or beaconing behavior. It also underscores a fundamental limitation of NGFW application control that relies on payload volume for classification, suggesting the need for complementary detection mechanisms such as behavioral analytics and anomaly detection.