full-disclosure - Re: Sony: No firewall and no patches

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <58DB1B68E62B9F448DF1A276B0886DF1720CA37F@EX2010.hammerofgod.com>
Date: Tue, 10 May 2011 23:51:51 +0000
From: "Thor (Hammer of God)" <thor@...merofgod.com>
To: "Dobbins, Roland" <rdobbins@...or.net>,
	"full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Subject: Re: Sony: No firewall and no patches

I'll reply in kind combining threads, but sans insulting statements like "in the face of incomprehension."  You make grand assumptions about what you can do, and what is "trivial" as if you think all vulnerabilities automatically give you administrative access or something.   You thinking that just because you owned my web server, it is "trivial" to bypass outbound rule enforcement - this is not only assumptive, but incorrect.   Most attacks or breached do not, in fact, result in that level of access.  

You apparently live and work in a world of absolutes where you assume you can send traffic to my web server and just alter the response as you see fit.  You've also apparently had a *very* different incident response history than I have.   But, at Arbor, I would also expect that you in a world very different than most and interact with a much different traffic model.  My experience is quite different, and I have personally seen too many instances to count where the use of firewalls has, without question, been what has saved a company.  But I'm glad it works for you, which is really what this conversation is about: what actually works for people. 

Feel free to argue all you wish about how firewalls are ineffective and a waste, but I have empirical evidence that shows otherwise.  I'm glad your ops experience serves you, but I would never count on ACLs alone to secure my infrastructure, particularly when it requires one to have wide open outbound ACLs.  And actually, I would do both (and normally do in production networks).  

So, to wrap up my input in this regard, people should use what works for them assuming they know what problems they are trying to solve and how they are solving them.   But just because people don't automatically embrace your opts processes doesn't mean we can't "comprehend" it.  It's really not rocket science you know...

> -----Original Message-----
> From: full-disclosure-bounces@...ts.grok.org.uk [mailto:full-disclosure-
> bounces@...ts.grok.org.uk] On Behalf Of Dobbins, Roland
> Sent: Tuesday, May 10, 2011 4:33 PM
> To: full-disclosure@...ts.grok.org.uk
> Subject: Re: [Full-disclosure] Sony: No firewall and no patches
> 
> On May 11, 2011, at 12:52 AM, Bruno Cesar Moreira de Souza wrote:
> 
> > How would you block an ACK tunnel using only a packet filter?
> (http://ntsecurity.nu/papers/acktunneling/) You don't need to stop the
> httpd service to create this kind of tunnel, as the packets from the attacker
> would just be ignored by the httpd service, but could be intercepted by the
> malicious code executed on the compromised server (using the same
> approach employed by network sniffers).
> 
> See my previous response to Thor.  I don't intend to keep this thread going
> forever in the face of incomprehension, but this focus on corner-case
> exfiltration techniques which are easily obviated by OS and service/app BCPs
> and appropriate monitoring, to the point of instantiating unnecessary and
> harmful state in front of servers which makes it trivial to take them down,
> demonstrates that in general, the infosec community pretty much
> completely ignores the availability leg of the confidentiality-integrity-
> availability triad.
> 
> Which is disappointing, given that availability is in fact the most important leg
> of that triad.
> 
> But, I guess if availability is nil, one has achieved perfect confidentiality and
> integrity, since the applications and services and data are completely
> inaccessible, so perhaps that's a big win for confidentiality and integrity, after
> all.
> 
> ;>
> 
> -----------------------------------------------------------------------
> Roland Dobbins <rdobbins@...or.net> //
> <http://www.arbornetworks.com>
> 
> 		The basis of optimism is sheer terror.
> 
> 			  -- Oscar Wilde
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/