# How phishing negates your firewall

- Link: https://www.agilicus.com/how-phishing-negates-your-firewall/
- Published: 2020-05-03T21:58:34+00:00
- Author: Don Bowman

Your corporate firewall. That invulnerable bastion that lets you fearlessly run 
less-than-secure internal tools like a CRM, a Finance portal. But, is it really 
invulnerable? Or is it a paper wall at best? We look at how Cross-Site-Scripting
vulnerabilities, known session ID cookies or access tokens can allow content from
the world to pierce it as if it were not there. We do this using the weakest link:
you.

How you ask? Assume that internal system contains some session cookie. You have 
access to it in your browser because, well, you logged in and you are you. Now lets
assume it has some weak library. Perhaps an older version of jQuery or Bootstrap.
This is a safe bet, these are two of the most popular libraries going. Now, lets
assume you use some site with user-generated content. Or, I can influence you to
open something in an email. This malware now runs in your browser in another tab,
and boom, it walks sideways. Think it can’t happen to you?

With phishing we are often concerned about the message. Is it trying to get me to
change payment info? To get me to login to some site and steal my info? What if 
all it is trying to do is get you to click? And then make it look as if nothing 
happened? Your browser is inside the firewall, its logged in to that other system.

Let’s take a snippet of HTML and try. Take the below, save it to a file, open in
your browser. This is from a vulnerability discussed in [#20184](https://github.com/twbs/bootstrap/issues/20184).

    ```wp-block-code
    <script src="https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script>
    <script src="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js"></script>
    <button data-toggle="collapse" data-target="<img src=x onerror=alert('You-are-hacked');>">Click Me, I'm Safe</button>
    ```

What can we do about this? Well, introduce a [Web Application Firewall](https://www.agilicus.com/project/hybrid-protection-flow/)
in front of each application you use (including that internal Finance or CRM system).
Make it identity and role aware so that it blocks requests that are inappropriate.
Periodically run campaigns to teach & test your team, perhaps using [Gophish](https://getgophish.com/).
Ensure that all sites you have control over have strong Content-Security-Policies.
I use [Mozilla Observatory](https://observatory.mozilla.org/) to check this. Perhaps
use a tool like [retirejs](https://blog.donbowman.ca/2018/07/05/suffering-sisyphean-security-solutions-make-your-chrome-part-of-the-solution/)
in your browser.