Free AI web copilot to create summaries, insights and extended knowledge, download it at here

4741

Abstract

know is if that allows something that shouldn’t be allowed due to a messed up state because…see the next problem.</p><p id="140d"><b>My WiFi device scanning my external Firewall IP</b></p><p id="18e9">Next I noticed that my WiFi IP address was scanning my external firewall IP address using UDP. This all failed due the fact that I have a zero trust network set up and I could easily spot this in my blocked traffic logs once I cleared out the weird blocked Push flag traffic.</p><p id="8089">I don’t think this was happening before allowing the traffic which specific flags — which maybe shouldn’t be allowed because things can be sent out of state. But without those rules the Google WiFi device doesn’t work properly (and I will be eliminating it soon.)</p><p id="03a1">Update — I also thought of another possible reason for that traffic I haven’t had time to go back and validate — what if someone was spoofing an internal IP address to try to get to open ports on my public IP address? Well, they would still need access to the resets to understand if that was successful or not — and it still wouldn’t work on my network in any case.</p><p id="9776"><b>Google WiFi IP range inconsistencies</b></p><p id="8c2a">Now all the traffic for the WiFi device was showing up in the logs with the same IP. It gets a DHCP address and the guest WiFi used to get a different IP address. But although all our TVs were connected to the Guest WiFi they were appearing on the main WiFi IP. Odd.</p><p id="5d17">I asked my housemate to disconnect any devices we didn’t need on the WiFi and we made sure all the TVs were on the Guest WiFi but the traffic still came through on the main Google WiFi IP.</p><p id="d23e">We rebooted all the devices and then the Guest WiFi traffic started appearing on the Guest WiFi IP again. I set up all those push flag rules on the guest wifi and all was well, for a while. By the way, my house mate uses an extender for our upstairs TV because he had so many problems with the Google device he just ditched it a long time ago. So much for mesh.</p><p id="d4a6">All was well until we were watching the downstairs TV later. The DoS problem started happening again. I checked the logs and the Guest WiFi address changed — again. So I setup a new batch of PSH rules for that IP.</p><p id="4763">Next day I’m working and test a laptop with the Google WiFi and BAM. DoS again. I check the logs — the Google WiFi address has changed — AGAIN. I figured that perhaps I can set a /24 for those two IP ranges it seems to be using. I haven’t had time to login and see if I can force it to use a specific IP because I plan to ditch it sooner than later.</p><p id="d320"><b>Lots of scans on Port 53</b></p><p id="3c44">The other thing I noticed was lots of scans on port 53. I didn’t look at the packets as all of this is taking too much time and I have other things I need to be doing. Someone should look into that. Is there a new DNS vulnerability out?</p><p id="0bfc"><b>Google WiFi trying to reach DNS on Port 443</b></p><p id="a905">I told you before how you can use DNS as a simple way to improve your network security here:</p><div id="994c" class="link-block"> <a href="https://readmedium.com/easy-dns-change-to-prevent-attacks-5b6708f287b3"> <div> <div> <h2>Easy DNS Change To Prevent Attacks</h2> <div><h3>1.1.1.2 and 1.1.1.3 for Safer Home and Small Business Networks</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*-h1_PD7dfQQ_hX7fEETPbw.png)"></div> </div> </div> </a> </div><p id="e305">The problem is that Google’s browser bypasses your DNS settings, so you have to create firewall rules to prevent that. I don’t know if this is still happening:</p><div id="f97b" class="link-block"> <a href="https://readmedium.com/google-chrome-dns-security-bypass-9a1e10e02114"> <div> <div> <h2>Google Chrome DNS Security Bypass</h2> <div><h3>Google Chrome overrides system DNS settings in some cases, possibly bypassing third-party security services and tools.</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*-Rg5EbXuIDifiSsezJr1FA.png)"></div> </div> </div> </a> </div><p id="a63f">The other problem is when your IoT devices such as your WiFi router, TV, or whatever you connected to your network don’t have a wa

Options

y to configure DNS servers or simply don’t abide by your rules. For that I explained how to set up a NAT rule to redirect them.</p><div id="6cca" class="link-block"> <a href="https://readmedium.com/redirect-iot-devices-to-preferred-dns-b0cbaa49aa69"> <div> <div> <h2>Redirect IoT Devices to Preferred DNS</h2> <div><h3>Leveraging PFSense Nat Rules to redirect DNS requests when the device itself won’t let you</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*LJHagEoSNHOLzzxDzyxLAg.png)"></div> </div> </div> </a> </div><p id="05ce">By the way you can do the same with ICMP and NTP requests to ensure that traffic gets to the appropriate places. And…<b>whatever is suddenly trying to reach DNS servers on port 443 instead of port 53</b>. I also redirect Apple DoH and anything else I can find trying to use the wrong DNS servers.</p><p id="97af"><b>Weird port 80 traffic</b></p><p id="5c12">Most traffic on my network uses port 443 but upon fixing various problems above I started getting a DoS via port 80 traffic with all those PSH packets. Instead of adding all the rules for the port 80 traffic as well I simply redirected it to port 443 using a NAT rule. I wasn’t sure if that would break something but most of the time I find that things that go to port 80 also work on port 443, which they should be using in the first place.</p><p id="0be2">Any traffic on port 80 can be intercepted and altered in transit. So perhaps someone was doing something fishy with that port 80 traffic. By redirecting it to port 443 if they were intercept and redirecting traffic on port 80 they never got the response hopefully. It should have been redirected to the correct servers on port 443. Depending on where the attacker is situated on a network, of course.</p><p id="61f1"><b>Two ports, traffic for one device</b></p><p id="39ab">The other thing I just noticed while using Google WiFi is that I’m getting multiple ephemeral ports for traffic from the same device. Pretty much nothing is working anymore. Clearing the ARP table on the firewall fixed that. SIGH</p><p id="6918">Well, that took a lot of time and I have other things to be doing so I hope someone will pick it up from here and figure out what is causing all this nonsense.</p><p id="1c7c">More on network security:</p><div id="3697" class="link-block"> <a href="https://readmedium.com/network-security-68e1f26db9df"> <div> <div> <h2>Network Security</h2> <div><h3>Blog posts, papers, and articles on Network Security by Teri Radichel</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*v_31SwDbGzO2jZk7HfOKEw.png)"></div> </div> </div> </a> </div><p id="f8e1">Follow for updates.</p><p id="4a3a">Teri Radichel | <i>© <a href="https://2ndsightlab.com/?source=post_page---------------------------">2nd Sight Lab</a> 2023</i></p><div id="8b5f"><pre><span class="hljs-section">About Teri Radichel:

⭐️ Author: Cybersecurity Books
⭐️ Presentations: Presentations by Teri Radichel
⭐️ Recognition: SANS Award, AWS Security Hero, IANS Faculty
⭐️ Certifications: SANS ~ GSE 240
⭐️ Education: BA Business, Master of Software Engineering, Master of Infosec
⭐️ Company: Penetration Tests, Assessments, Phone Consulting ~ 2nd Sight Lab</pre></div><div id="caae"><pre><span class="hljs-section">Need Help With Cybersecurity, Cloud, or Application Security?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~</span>
🔒 Request a penetration test or security assessment
🔒 Schedule a consulting call
🔒 Cybersecurity Speaker for Presentation</pre></div><div id="46f6"><pre>Follow <span class="hljs-keyword">for</span> more stories like <span class="hljs-keyword">this</span>:

❤️ Sign Up my Medium Email List ❤️ Twitter: <span class="hljs-meta">@teriradichel</span> ❤️ LinkedIn: https:<span class="hljs-comment">//www.linkedin.com/in/teriradichel</span> ❤️ Mastodon: <span class="hljs-meta">@teriradichel</span><span class="hljs-meta">@infosec</span>.exchange ❤️ Facebook: 2nd Sight Lab ❤️ YouTube: @2ndsightlab</pre></div><figure id="6f68"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*4oxP4LXk8l8c3mpRvO7ejg.png"><figcaption></figcaption></figure></article></body>

Summary of Recent Problems in Network Traffic

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

⚙️ Check out my series on Automating Cybersecurity Metrics | Code.

🔒 Related Stories: Bugs | AWS Security | Secure Code | Network Security

💻 Free Content on Jobs in Cybersecurity | ✉️ Sign up for the Email List

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

It all started when the TVs started spinning periodically. I looked in the logs and found a bunch of packets with a push flag added into them.

For some reason those push flags caused PFSense to block the traffic. In the past it only blocked a few packets but something changed recently where it basically resulted in a DoS of our network.

I think this has to do with the Google WiFi devices we are using for the TVs (temporarily). I still think the device may be compromised but I’m watching it to see what it does.

Here are some things I’ve noticed to look out for:

Invalid IMAP Servers

First, I noticed a bunch of blocked IMAP traffic. I have opened up the firewall to the servers specified by the vendors for the services we use. I also know exactly which devices are supposed to be sending and receiving mail and which ones use IMAP. This traffic was very strange and no reason for it to be blocked if it was valid traffic. Upon digging into it I discovered that the traffic was trying to go to the incorrect IMAP servers. I blogged about it and it stopped:

Attempted IMAP connections to wrong GMAIL Server??

Looking into strange traffic on the network ~ Google or CloudFlare DNS issue? Or misconfiguration here?

medium.com

Strange DNS resolution

I also notice that a particular problematic IP goes to an Adobe IP address which my host-based firewall product says resolves to either Amazon or Apple domain names which is kind of strange. There could possibly be a reason for it if those companies use some sort of Adobe CDN but documented it here:

Interesting DNS Results — Apple or Amazon from Adobe DNS?

I noticed some traffic that is not typical on my network so I took a look at the IP address. It says that it’s open on…

medium.com

My Wifi device (Google) sending weird push flag packets

Next I notice that my Google WiFi device was sending a bunch of packets with Push flags that were getting blocked by PFSense. Now in the past, a few of these would be blocked and wouldn’t make much difference. But now these push packets were causing a DoS on our wifi network periodically. At first I thought it was the TVs or some streaming service but as it turns out it happened when I tested with a laptop also — after turning off everything else on that network. The problem is definitely related to the WiFi device or streaming service.

To resolve that problem I had to go in and create rules for each specific flag combination I wanted to allow. Now what I don’t know is if that allows something that shouldn’t be allowed due to a messed up state because…see the next problem.

My WiFi device scanning my external Firewall IP

Next I noticed that my WiFi IP address was scanning my external firewall IP address using UDP. This all failed due the fact that I have a zero trust network set up and I could easily spot this in my blocked traffic logs once I cleared out the weird blocked Push flag traffic.

I don’t think this was happening before allowing the traffic which specific flags — which maybe shouldn’t be allowed because things can be sent out of state. But without those rules the Google WiFi device doesn’t work properly (and I will be eliminating it soon.)

Update — I also thought of another possible reason for that traffic I haven’t had time to go back and validate — what if someone was spoofing an internal IP address to try to get to open ports on my public IP address? Well, they would still need access to the resets to understand if that was successful or not — and it still wouldn’t work on my network in any case.

Google WiFi IP range inconsistencies

Now all the traffic for the WiFi device was showing up in the logs with the same IP. It gets a DHCP address and the guest WiFi used to get a different IP address. But although all our TVs were connected to the Guest WiFi they were appearing on the main WiFi IP. Odd.

I asked my housemate to disconnect any devices we didn’t need on the WiFi and we made sure all the TVs were on the Guest WiFi but the traffic still came through on the main Google WiFi IP.

We rebooted all the devices and then the Guest WiFi traffic started appearing on the Guest WiFi IP again. I set up all those push flag rules on the guest wifi and all was well, for a while. By the way, my house mate uses an extender for our upstairs TV because he had so many problems with the Google device he just ditched it a long time ago. So much for mesh.

All was well until we were watching the downstairs TV later. The DoS problem started happening again. I checked the logs and the Guest WiFi address changed — again. So I setup a new batch of PSH rules for that IP.

Next day I’m working and test a laptop with the Google WiFi and BAM. DoS again. I check the logs — the Google WiFi address has changed — AGAIN. I figured that perhaps I can set a /24 for those two IP ranges it seems to be using. I haven’t had time to login and see if I can force it to use a specific IP because I plan to ditch it sooner than later.

Lots of scans on Port 53

The other thing I noticed was lots of scans on port 53. I didn’t look at the packets as all of this is taking too much time and I have other things I need to be doing. Someone should look into that. Is there a new DNS vulnerability out?

Google WiFi trying to reach DNS on Port 443

I told you before how you can use DNS as a simple way to improve your network security here:

Easy DNS Change To Prevent Attacks

1.1.1.2 and 1.1.1.3 for Safer Home and Small Business Networks

medium.com

The problem is that Google’s browser bypasses your DNS settings, so you have to create firewall rules to prevent that. I don’t know if this is still happening:

Google Chrome DNS Security Bypass

Google Chrome overrides system DNS settings in some cases, possibly bypassing third-party security services and tools.

medium.com

The other problem is when your IoT devices such as your WiFi router, TV, or whatever you connected to your network don’t have a way to configure DNS servers or simply don’t abide by your rules. For that I explained how to set up a NAT rule to redirect them.

Redirect IoT Devices to Preferred DNS

Leveraging PFSense Nat Rules to redirect DNS requests when the device itself won’t let you

medium.com

By the way you can do the same with ICMP and NTP requests to ensure that traffic gets to the appropriate places. And…whatever is suddenly trying to reach DNS servers on port 443 instead of port 53. I also redirect Apple DoH and anything else I can find trying to use the wrong DNS servers.

Weird port 80 traffic

Most traffic on my network uses port 443 but upon fixing various problems above I started getting a DoS via port 80 traffic with all those PSH packets. Instead of adding all the rules for the port 80 traffic as well I simply redirected it to port 443 using a NAT rule. I wasn’t sure if that would break something but most of the time I find that things that go to port 80 also work on port 443, which they should be using in the first place.

Any traffic on port 80 can be intercepted and altered in transit. So perhaps someone was doing something fishy with that port 80 traffic. By redirecting it to port 443 if they were intercept and redirecting traffic on port 80 they never got the response hopefully. It should have been redirected to the correct servers on port 443. Depending on where the attacker is situated on a network, of course.

Two ports, traffic for one device

The other thing I just noticed while using Google WiFi is that I’m getting multiple ephemeral ports for traffic from the same device. Pretty much nothing is working anymore. Clearing the ARP table on the firewall fixed that. *SIGH*

Well, that took a lot of time and I have other things to be doing so I hope someone will pick it up from here and figure out what is causing all this nonsense.

Network Security

Blog posts, papers, and articles on Network Security by Teri Radichel

medium.com

Follow for updates.

About Teri Radichel:
~~~~~~~~~~~~~~~~~~~~
⭐️ Author: Cybersecurity Books
⭐️ Presentations: Presentations by Teri Radichel
⭐️ Recognition: SANS Award, AWS Security Hero, IANS Faculty
⭐️ Certifications: SANS ~ GSE 240
⭐️ Education: BA Business, Master of Software Engineering, Master of Infosec
⭐️ Company: Penetration Tests, Assessments, Phone Consulting ~ 2nd Sight Lab

Need Help With Cybersecurity, Cloud, or Application Security?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
🔒 Request a penetration test or security assessment
🔒 Schedule a consulting call
🔒 Cybersecurity Speaker for Presentation

Follow for more stories like this:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
❤️ Sign Up my Medium Email List
❤️ Twitter: @teriradichel
❤️ LinkedIn: https://www.linkedin.com/in/teriradichel
❤️ Mastodon: @teriradichel@infosec.exchange
❤️ Facebook: 2nd Sight Lab
❤️ YouTube: @2ndsightlab