Being asked to open all outbound ports

[TechMonkey]

I'm still confused, how will Dr Evil make a computer on your LAN send data to IPs currently owned by another company? Firstly they'd just send it to an IP they rented from Azure/AWS/GCS that you wouldn't be suspicious of, secondly how did they access your server?

 

I agree that the VOIP company is crap though, I suggest Gamma SIP and running Freepbx locally, I have 1 IP on my end connected to 1 IP on their end

 

We do not know if the IPs are owned by the company or part of a shared cloud computing pot. Are you saying you whitelist all Azure/AWS/GCS IPs as standard? I'm not sure why someone being secure and mindful of their security is such a sticking point when we also have threads regularly on the front page about whole schools taken down through cyber security incidents. Standardisation and having known and limited exposure is a thing in this day and age and should be applauded and strived for.

 

I mean what are we going to question next? Having proper licensing for Office, or entering in keys manually?

[TronXP]

I can see where people are coming from. If the outbound port is open, then the connection has to be made from your LAN, hence Dr Evil must already have infected your LAN to be punching out of it using an outbound open socket.

[psydii]

@tom_newton or @PaddyNewman feel free to correct me, but my understanding is that the initial SIP setup is on known ports and tends to involve a very small number of remote IPs. During the SIP set up for each call the "phone" is told what IP and port to use for the RTSP (the audio) for the call. Thus the phones will only be sending out UDP to IPs the remote PBX has told them to, and the firewall does its magic (sip proxy or otherwise) to ensure the inbound traffic from those IPs flows only in circumstances where a call is starting/in progress.

 

Yes if someone gets hold of your firewall config they can realise that they are free to set up a UDP traffic flow to that range of IPs, but unless they also have a a server in that range they aren't going to be able to do much.

 

To re-iterate: I hate this, but I have to live with it, the risk is relatively low.

 

By the way, unless explicitly encrypted, wireshark can decode and play back sip calls if you captured the packet as they transit your network.

[mavhc]

We do not know if the IPs are owned by the company or part of a shared cloud computing pot. Are you saying you whitelist all Azure/AWS/GCS IPs as standard? I'm not sure why someone being secure and mindful of their security is such a sticking point when we also have threads regularly on the front page about whole schools taken down through cyber security incidents. Standardisation and having known and limited exposure is a thing in this day and age and should be applauded and strived for.

 

I mean what are we going to question next? Having proper licensing for Office, or entering in keys manually?

 

You can tell who owns IP blocks, ask RIPE

 

But what's the sequence of events that causes it to be a security problem.

 

a) someone visits your school, knows the password to reprogram the phone, and sets it connect to one of the other IPs in the /22?

 

or

 

b) someone hacks the voip provider, edits the firmware and uploads a new version? In which case they already hacked the voip provider so easier to just listen in on your calls

 

or

 

c) someone hacks another computer on your LAN and also the IP range and exfiltrates data that way, instead of just making a zip file and uploading it to a gmail account which won't look suspicious?

[snagrat]

You can tell who owns IP blocks, ask RIPE

 

But what's the sequence of events that causes it to be a security problem.

 

a) someone visits your school, knows the password to reprogram the phone, and sets it connect to one of the other IPs in the /22?

 

or

 

b) someone hacks the voip provider, edits the firmware and uploads a new version? In which case they already hacked the voip provider so easier to just listen in on your calls

 

or

 

c) someone hacks another computer on your LAN and also the IP range and exfiltrates data that way, instead of just making a zip file and uploading it to a gmail account which won't look suspicious?

 

Or part of the /20 IP block is sold to another company/country. Phone continues to work, you have no idea what is now being used on the other range.

Then your option c) kicks in. Most ransomware will extract data over a course of days/weeks before becoming known. Not just a few files in a zip uploaded to gmail

[msi_school]

Or part of the /20 IP block is sold to another company/country. Phone continues to work, you have no idea what is now being used on the other range.

Then your option c) kicks in. Most ransomware will extract data over a course of days/weeks before becoming known. Not just a few files in a zip uploaded to gmail

 

I agree that a provider should be limiting the attack serurface on their clients network

 

However, I still dont understand how this is a major threat, initally an attacker has to either know which phone system I use or who uses a given phone system, Then they have to get access to these IPs via a hack or buying them. Then they have to get into my network and seaze the data before sending it to one of these IPs.

 

I would think that an attacket would consider it a win to access the phone provider and then not use their servers to extract data to cover their tracks or access the school and export data in any number of ways, probibly Google Drive or Microsfot Onedrive to keep under the radar.

 

Once the attacker is inside the network they have probibly planted the encryption payload exfiltration is just a bonus. It seems a better use of time to prevent the inital attack.

[dmj]

Most decent companies will publish their ip lists in a json export.

(eg: stripe , https://ip-ranges.atlassian.com/ )

In this case, just add these to your firewall build scripts (which every good engineer will be running daily) and hey presto it automatically updates.

[mavhc]

Or part of the /20 IP block is sold to another company/country. Phone continues to work, you have no idea what is now being used on the other range.

Then your option c) kicks in. Most ransomware will extract data over a course of days/weeks before becoming known. Not just a few files in a zip uploaded to gmail

 

Isn't that the same for every online service ever though?

 

Surely this high security network that only opens outgoing ports to specific IPs and specific ports should have bandwidth monitoring to detect unusual activity.

 

The gmail example was just something that you wouldn't block, you can upload a million zip files to gmail, doesn't have to be a few, or onedrive, can you tell which onedrive account files are being synced to?

[TechMonkey]

Ok, you tell me who owns the IPs in question? And reassure me that the owner will never change.

If I knew all the exfiltration possibilities for a compromised network I'm pretty sure would not be working in a school. But I'll play along.

 

1) Laptop comes in and it is already compromised. From your network it dials home to the command-and-control server, which just happens to reside on the same cloud server as the provider, and from there sets up a connection to start trying lateral movement to other devices to take over the network. Using a zero-day exploit gets on to your servers and encrypts them.

2) As the provider is shown to be lax about security, they could be compromised and used as forwarder for compromised systems, using the open ports to setup communication.

3) A compromised system on your network floods any ports it can on any IPs it knows or can find. The provider has an IDS system and spots your floods, blacklisting your IP. You now have no phone system.

 

I imagine what you are getting at is that it would take a massive coincidence for any security breach to happen, but I be the majority of security breaches are a mix of the right circumstances at the right (wrong?) time. Why risk it?

 

Let's flip this round. Why would you want to leave all ports open on a massive range that you don't need? Do you feel you should just follow instructions from an external third party who has no interest or need to have your system secure? Do you feel questioning external parties about security is not part of your role? Where do you draw the line of what is worth securing and what is too much trouble? If you can secure something that is proven to help, why wouldn't you?

[Dipa]

Cover.

 

Your.

 

A**.

 

London Rules (Slow Horses fans will already know this)

[mavhc]

1) Laptop comes in and it is already compromised. From your network it dials home to the command-and-control server, which just happens to reside on the same cloud server as the provider, and from there sets up a connection to start trying lateral movement to other devices to take over the network. Using a zero-day exploit gets on to your servers and encrypts them.

 

Or it resides on AWS and uses https so it's going to work everywhere. Why is the guest laptop not on guest network though?

 

2) As the provider is shown to be lax about security, they could be compromised and used as forwarder for compromised systems, using the open ports to setup communication.

 

Then all your phone calls are already being intercepted and that one 2FA you left enabled over voice/sms is now compromised. How are they going to use the open ports though?

 

3) A compromised system on your network floods any ports it can on any IPs it knows or can find. The provider has an IDS system and spots your floods, blacklisting your IP. You now have no phone system.

 

Your phone company bans you because the IPs they provided where contacted? That's their problem, as I already said, switch to a better provider.

 

> Let's flip this round. Why would you want to leave all ports open on a massive range that you don't need?

 

I'm not leaving any ports open, the phone company is leaving ports open. It's their security that is the issue, not yours

 

> Do you feel you should just follow instructions from an external third party who has no interest or need to have your system secure?

 

No, switch to a better provider who's not an idiot and probably has an insecure network.

 

> Do you feel questioning external parties about security is not part of your role?

 

Just switch to a non idiot provider

 

> Where do you draw the line of what is worth securing and what is too much trouble? If you can secure something that is proven to help, why wouldn't you?

 

When it's my things, I will. This is the provider's network.

[PaddyNewman]

@tom_newton or @PaddyNewman feel free to correct me, but my understanding is that the initial SIP setup is on known ports and tends to involve a very small number of remote IPs. During the SIP set up for each call the "phone" is told what IP and port to use for the RTSP (the audio) for the call. Thus the phones will only be sending out UDP to IPs the remote PBX has told them to, and the firewall does its magic (sip proxy or otherwise) to ensure the inbound traffic from those IPs flows only in circumstances where a call is starting/in progress.

 

Yes if someone gets hold of your firewall config they can realise that they are free to set up a UDP traffic flow to that range of IPs, but unless they also have a a server in that range they aren't going to be able to do much.

 

To re-iterate: I hate this, but I have to live with it, the risk is relatively low.

 

By the way, unless explicitly encrypted, wireshark can decode and play back sip calls if you captured the packet as they transit your network.

Yes, pretty much. SIP goes to an endpoint on a specific port, then RTSP is through a variety of UDP ports.

 

For me, personally, I don't mind opening to a /20 on a load of ports. There's no need, but I would if asked.

 

Security wise though, I do want to keep things tight but you can't always win. Never in a million years would I want to allow anything free reign outbound, I'd want a destination, or at least a few and finite port list. This would be for horrible IoT though. For VoIP, a set range going to a set endpoint of a /20 and specific ports, sure.

 

Host may move, host may get compromised, that's a risk. Do a risk assessment on every rule. You can lookup the owner of said IPs on whois tools, RIPE, anything.

I imagine some schools here use fortigates and use the ISDB on them and allow random garbage like 8080, which I feel is far more risky than a source range to a /20 on a stack of UDP. I'd never do all ports though, never.

[mavhc]

Why is port 8080 risky? Either you're sending everything via a TLS intercepting proxy (with exceptions for specific things like ping, sip) or you're not and have no idea what's being sent to a shared IP on port 443 on AWS.

 

If you're trying to stop data exfiltration you need to proxy everything anyway, so port shouldn't matter

Same with a reverse shell/vpn, which will try to use 443 as that's the least likely to be blocked

 

So for full security 802.1x the devices that need direct internet connection, and vlan them off. Everything else has to go via a proxy where you can check it.

 

Then let your phone calls go unencrypted onto the phone network which has been compromised by 1000s of orgs. Why aren't we actually using sip-sip calls over TLS?

[PaddyNewman]

I'll be up front, we won't get on as my attitude to things is very different and I'm sure I may be reading you wrong, but you are fairly aggressive in postings and I tend to not argue with people.

 

8080 is absolutely diabolical. Most filters are 80/443 for HTTP/HTTPS. Not going to see 8080 bound traffic to a remote proxy.

 

Not everyone proxies everything. Firewall is your last line of defence, any holes a goal when it comes to exploits. There are obviously many ways to skin this beast, but the perimeter is where everything is hard locked, by default we allow HTTPS/HTTPS via in lines, DNS to specific endpoints only and basic education endpoints, the rest is hard closed without requests. It's rare we have problems opening stuff, but allowing anything to anywhere to me, and well against your viewpoint, is utterly disgusting behaviour and shows a distinct lack of care for the network you are protecting. Again, not aimed at you in particular, but to that specific viewpoint.

 

Apologies if it sounds like it's towards yourself as a person, not intended, just having to deal with the carnage and seeing things implode through lack of care and thought really sticks with you.

 

However we are straying off topic, encrypt everything, never use the internet, safer.

[mavhc]

Anything to go anywhere as long as it's through the proxy, and then filtered as such anyway.

 

All our data is outside the lan anyway, so no need to hack the lan to steal it, just steal a random user's phone and thumb.

 

The VLANs with data on are secure because I'm the only one with admin rights, so no software is running without me approving it, and I don't approve malware. Other vlans don't have internet access much, phones don't, printers don't, cctv has 1 ip.

 

But my point is opening ports to a set of IPs for your phones is less likely to cause problems than allowing port 443 for onedrive if you're not inspecting everything and automatically flagging anything weird

[Davit2005]

Personally I'd be a bit more cautious too. It only takes the perfect set of coincidences or clever social engineering with poor practices, look at the LastPass incident.

 

If a 3rd party cannot be specific about the ports needed you have got to wonder about their knowledge of the product, an open policy looks like they do not know. We get this occasionally from app teams because the supplier does not know the product.

Edited January 31, 2025 by Davit2005

[psydii]

SIP and RTSP are *old*. Here is an exerpt from Building Internet Firewalls 2nd Edition (2000) "Protocols for distributing audio and video tend to be based on UDP becasue people are more tolerant of having small amounts of data loss than hof having pauses. With TCP, if a packet is lost, there will be a wait for retransmission, which is much more annoying than just going on the the next packet. Audio and video protocols also tend to use multiple ports in order to maximise efficiency. Becasue of these characteristics, these protocols tend to be difficult to support through firewalls"

 

The customer base for cloud PBX's skews more to non-technical and having a network engineer on staff is unlikely, as is having anyone in the procurement chain to advocate for the more expensive options (like a gateway product, or one with limited UDP ranges or encryption). It is also a buisness decision on the providers part - they cannot support (i.e. basically re-design and troubleshoot) all thier non-technical customer's networks; they need to keep it simple so it works under basically all circumstances. If the customer wants better security, the customer should have paid for better security.

 

I'm technical. I don't like it, but here we are.

[Davit2005]

The delays with TCP due to it's method means that most voice is UDP.

 

But there should be no reason to open up RDP, SSH, DNS, HTTP, etc. If you have a application based firewall it would be easy to do. But opening up all ports still seems risky to me. That is like opening up all ports to a DC internally, yep there is user control too but you still have the port open.

[PaddyNewman]

Exactly that. Open all ports to this /20. 'Trust me bro' vibes.

 

You should segment the phones off anyway, but the point remains, why should you open everything.

[mavhc]

because you can run all of those over https anyway, so they're already effectively open.

 

Random google results https://trofi.github.io/posts/295-ssh-over-https.html

https://en.wikipedia.org/wiki/DNS_over_HTTPS

https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/clients/remote-desktop-web-client-admin

 

They're still idiots for requesting all ports to 1022 IPs. I'd ask them about ipv6 while you're finding a better host

[SBB_Mark]

Did they give specific reasons why all the ports needed opening?

[ibpalle]

Just port 8443 as I understand it. Since we do not support reverse DNS lookup for firewall policies, the IPs have to be used, as you correctly say. An alert can be configured, use the DNS name resolution alert in the health monitor. It will tell you if the IPs have changed and you can then add the new ones to the address object if they have. Keep the old ones in there in case they revert possibly.