bugtraq - Re: Re[3]: Bypassing ISA Server 2004 with IPv6

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 19 Apr 2006 21:22:29 -0700
From: "Thor (Hammer of God)" <thor@...merofgod.com>
To: Christine Kronberg <seeker@...lla.de>,
	3APA3A <3APA3A@...URITY.NNOV.RU>
Cc: Bugtraq <bugtraq@...urityfocus.com>
Subject: Re: Re[3]: Bypassing ISA Server 2004 with IPv6

RIL:

On 4/15/06 1:23 PM, "Christine Kronberg" <seeker@...lla.de> spoketh to all:

>> IPv6  can  not  be  filtered  by  ISA,  but  it still can be filtered by
>> different  tools,  or  by  it's own means, as IPv6 support network-level
>> security.  Unlike IPv4, IPv6 supports authentication, integrity checking
>> and  encryption  natively.  See ipsec6.exe and descriptions for Security
>> Association Batabase and Security Policy Database.
> 
>    So you state that it is perfectly well for a firewall to allow
>    any traffic through. Per default? And that this firewall does not
>    need to have the interface to configure what traffic is allowed?
>    I disagree.
>    If a firewall supports a protocol, that same firewall should also
>    provide the proper means and interface to configure it. And not blow
>    holes in networks.

Based on your responses to this thread, my guess is that you have never
installed or managed an ISA firewall.  Just a guess...

Regardless, let's try to clear this up one final time.  IPv6 is NOT
installed on ISA by default. BY DEFAULT, EVERYTHING IS BLOCKED.  ISA *does
not* support IPv6.  There are NO holes blown in networks.  This entire
argument is crazy, and based on misinformation.  You don't install or
configure IPv6 through ISA. You have to be an administrator of the host
machine and go into the network properties and explicitly install, bind, and
configure IPv6 for it to work.  You also have to do the same on your border
routers and upstream ISP.  It takes deliberate action on the part of the
admin to do this.  DOING THIS EXPLICITLY ENABLES IPV6.  Duh!  It's like you
people would complain that if the administrator uninstalled ISA, that the
resultant lack of a firewall was a critical Microsoft vulnerability!

Jim Harrison and I are doing a 2-day immersion training for ISA at BlackHat
Vegas.  ISA Server freaking rocks.  If you are really interested in ISA and
want to get the skills needed to build robust firewalls, then take the
course.  If you can honestly tell me that you think ISA is "broken" after
that course, I'll give you back every single penny of your fee personally.
And *that* is a *promise.*

T