full-disclosure - A new TCP/IP blind data injection technique?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20031215190525.D45081@dekadens.coredump.cx>
From: lcamtuf at ghettot.org (Michal Zalewski)
Subject: A new TCP/IP blind data injection technique?

On Mon, 15 Dec 2003, Michael Gale wrote:

> Well first of all, one of the industry leading firewalls ( BorderWare
> Firewall Server ) does NOT pass fragmented packets.

What I was asking for, is whether you have any further information about
this? Or is it just the way you have it configured? I would be surprised
if this is a default for commercial production-grade firewalls, as it may
- quite simply - prevent some people from communicating with you in some
situations. Most commercial firewall vendors go as far as disabling PMTUD
just to avoid this.

> I have a rule at the beginning: iptables -A INPUT -f -j DROP

Ok - this is a very specific configuration, then. On most sane firewalls,
it is not necessary to drop fragments (and, quite frankly, not
particularly wise, either) - the firewall will simply reassemble all
traffic before forwarding it any further (this is something you suggested
is going to be implemented for BorderWare, and a functionality present for
long years on systems like Linux)..

Cheers,
-- 
------------------------- bash$ :(){ :|:&};: --
 Michal Zalewski * [http://lcamtuf.coredump.cx]
    Did you know that clones never use mirrors?
--------------------------- 2003-12-15 19:05 --

   http://lcamtuf.coredump.cx/photo/current/