Application-Level Firewall

Application-based proxy firewalls focus on the application layer rather than just the packets.

• Application-level gateways (proxies) can filter packets at the application layer of the OSI model (or the application layer of TCP/IP).
• Incoming and outgoing traffic is restricted to services supported by the proxy; all other service requests are denied.
• The need for an application-level firewall arises from the tremendous amount of voice, video, and collaborative traffic in the data-link layer and network layer, which may be used for unauthorized access to internal and external networks.

Application-level gateways configured as web proxies prohibit FTP, gopher, telnet, or other traffic.

• They examine traffic and filter application-specific commands such as HTTP: POST and GET.
• Traditional firewalls are unable to filter such types of traffic.
• They can inspect, find, and verify malicious traffic that is missed by stateful inspection firewalls to make decisions as to whether to allow access, and they improve the overall security of the application layer.

For example, Worms that send malicious code in legitimate protocols cannot be detected by Stateful Firewalls, as proxy firewalls focus on packet headers in the network layer.

• However, deep packet inspection firewalls can find such attacks with the help of informative signatures added inside packets.

Features of Application-Level Firewalls

• Analyze the application information to make decisions as to whether to permit traffic.
• Being proxy-based, they can permit or deny traffic according to the authenticity of the user or process involved.
• A content-caching proxy optimizes performance by caching frequently accessed information rather than sending new requests to the servers for the same old data.

Modes of Application-Level Firewalls:

• Active Application-Level Firewalls: Examine all incoming requests, including the actual message that is exchanged, against known vulnerabilities such as SQL injection, parameter and cookie tampering, and cross-site scripting.
  • The requests that are deemed genuine are allowed to pass through them.
• Passive Application-Level Firewalls: Work similarly to IDS in that they also check all incoming requests against known vulnerabilities, but they do not actively reject or deny those requests if a potential attack is discovered.

Application-Level Firewalls, also known as Application-Level Gateways (ALGs) or Application-based Proxy Firewalls, are a highly sophisticated type of firewall that provides deep inspection capabilities by operating at the highest layer of the network model.

I. Characteristics and Operating Mechanism

Application-level firewalls focus on the Application Layer (layer-7) of the OSI model or the application layer of TCP/IP.

Core Functions

• Application-Specific Filtering: Application-level firewalls filter traffic based on specific application protocols. They can filter connections based on the services and protocols when acting as a proxy.
• Deep Inspection: Unlike packet filtering firewalls, application-level firewalls examine traffic and filter application-specific commands such as HTTP: post and get. This enables them to inspect, find, and verify malicious traffic that might be missed by stateful inspection firewalls.
• Proxy-Based Operation: Application-level gateways function as proxy servers. They act as an interface between the user workstation and the Internet, separating the enterprise network from the Internet. Being proxy-based, they can permit or deny traffic based on the authenticity of the user or process involved.
• Security: They improve the overall security of the application layer. They restrict incoming and outgoing traffic to services supported by the proxy, denying all other service requests. For example, an FTP proxy will only allow FTP traffic to pass through, blocking all other services and protocols.
• Vulnerability Protection: Application-level firewalls are necessary because traditional firewalls are unable to filter certain types of traffic. Application-level filtering is critical for defending against application-layer vulnerabilities, such as those exploited by SQL injection.

Operating Modes

Application-level firewalls can function in two modes:

1. Active Application-Level Firewalls: These examine all incoming requests, including the actual message exchanged, against known vulnerabilities like SQL injection, parameter and cookie tampering, and cross-site scripting (XSS). Requests deemed genuine are allowed to pass through.
2. Passive Application-Level Firewalls: These work similarly to an Intrusion Detection System (IDS). They check all incoming requests against known vulnerabilities but do not actively reject or deny requests if a potential attack is found.

Key Benefits

• Higher-Level Control: Application layer filtering operates at a higher level than traditional security appliances, allowing decisions based on more than just source/destination IP addresses or ports.
• Content Caching: A content-caching proxy feature can optimize performance by caching frequently accessed information.

II. Deployment as Web Application Firewalls (WAFs)

A specialized and commonly discussed application of the application-level firewall is the Web Application Firewall (WAF).

• Definition: A WAF is a specific form of application firewall that filters, monitors, and blocks HTTP traffic to and from a web service.
• Protection against Application Attacks: WAFs are explicitly designed to prevent attacks exploiting a web application's known vulnerabilities, such as SQL injection, cross-site scripting (XSS), and file inclusion. They provide security for web applications against a wide range of attacks.
• Layer 7 Defense: A WAF is a protocol layer 7 defense in the OSI model.
• Implementation: WAFs inspect HTTP traffic. They are often deployed as an API gateway to control traffic and detect all possible attacks.
• Examples: Examples of WAFs mentioned include Cloudflare Web Application Firewall, Imperva's Web Application Firewall, Qualys WAF, Barracuda Web Application Firewall, NetScaler WAF, and Sucuri WAF.

III. Evasion and Countermeasures

Attackers view application-level proxies and protocol-parsing firewall elements as security measures that they must bypass.

• Evasion Focus: Attackers can attempt to bypass WAFs by fingerprinting the target WAF to identify blacklisted keywords and then create new payloads that use keywords not included in the blacklists. They can also use fuzzing/brute-forcing techniques to identify payloads that evade the WAF.
• Defense Recommendation: To defend against application-level evasion, organizations should implement deep packet inspection at the application layer.