full-disclosure - Re: Sony: No firewall and no patches

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <58DB1B68E62B9F448DF1A276B0886DF1720C9D5D@EX2010.hammerofgod.com>
Date: Tue, 10 May 2011 15:45:14 +0000
From: "Thor (Hammer of God)" <thor@...merofgod.com>
To: "Dobbins, Roland" <rdobbins@...or.net>,
	"full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Subject: Re: Sony: No firewall and no patches

> On May 10, 2011, at 4:42 PM, Pete Smith wrote:
> 
> >  if an attacker initiates a connection dest port higher than 2048 (to some
> other server the attacker controls) and source port of 80 that will pass
> through an ACL without issues, this would not be so on a stateful firewall.
> 
> 
> If the attacker's in a position to generate an outbound connection sourced
> from a well-known port (which presumably is supposed to have an httpd
> attached to it), there's nothing a stateful firewall can do to improve matters.

You can if you require authentication, which I do even here at the HoG labs.  Well, except for rules specifically created for other devices such as, ironically, my PS3. :)

Mike Kaeo's presentation is interesting, and certainly has merit where it applies - but saying "stateful firewalls have no place in front of servers" is far too generic of a statement.   There are any number of topological deployment scenarios where firewalls certainly provide security in depth and added security, irrespective of what Mr. Kaeo's opinion on the matter is.  If one can design a secure access model using router ACLs then right on, but that doesn't mean that other models don't work.

I'm unclear as what you mean by "no state to inspect in the first place" in regard to firewalls in front of servers - my TMG box most certainly inspects state when I access assets via the firewall.   I think I know what you really meant by that statement, but can you explain your point a bit more?  I want to make sure I'm not missing something.

t

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/