Inside-Out Vulnerabilities, Reverse Shells

Most organizations have some type of perimeter protection that limits access to their internal machines from the Internet [Wilson, 2004]. Even weak perimeter protection schemes, with only ingress filtering on a router or firewall, will stop most external port scans from penetrating into protected systems. However, a reverse shell is a program that has the ability to force a system in a protected network to connect to a system outside that network, subverting the firewall's ingress filters. Once installed, reverse shells can be very difficult to locate, especially if the programs use protocols that are normally allowed out of a protected network. This paper will concentrate on reverse shell programs that demonstrate different covert channels, how they work, and how to defend your network against them. The examples provided could be used by attackers to target your users and systems. Be prepared to stop them.