full-disclosure - Re: Sony: No firewall and no patches

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Tue, 10 May 2011 06:53:42 -0700 (PDT)
From: Bruno Cesar Moreira de Souza <bcmsouza@...oo.com.br>
To: "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>,
	RolandDobbins <rdobbins@...or.net>
Subject: Re: Sony: No firewall and no patches

On May 10, 2011, Dobbins, Roland <rdobbins@...or.net> wrote:
On May 10, 2011, at 1:40 PM, Tracy Reed wrote:

> If you have traffic going out to a high numbered port and you are not keeping state how do you know if that is a
> reply packet to an existing inbound connection or if it is an unauthorized outbound connection?

>> You use stateless ACLs to filter outbound traffic as well, only allowing traffic 
>> originating from required well-known ports to ephemeral high ports.  

--------------------------------

The stateless ACLs would not prevent ACK tunneling (http://ntsecurity.nu/papers/acktunneling/). 

Although your infrastructure would be stronger against DDoS attacks, your environment would be more susceptible to covert channels and backdoors. If the organization security concern is mainly availability, I could agree in deploying a packet filter to protect external servers. However, if an external intrusion or sensitive data leakage would cause more damage to the organization's business or reputation, I would not recommend it. Additionally, the organization may have different DMZ's or external networks with different security levels. 

Regards,

Bruno Cesar M. de Souza

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/