Re: [Full-disclosure] Sony: No firewall and no patches

[phocean <0x90@xxxxxxxxxxx>]

Le mercredi 11 mai 2011 à 16:49 +0000, Dobbins, Roland a écrit :
> On May 11, 2011, at 10:03 PM, phocean wrote:
> 
> >  - DDoS : anyway, a firewall isn't more susceptible to DoS than the server 
> > it protects. If you look at the hardware performance of modern 
> > firewalls, if an attacker has the ability to DoS it, then only a 
> > considerable server farm that very few companies can afford will be able to 
> > sustain it.
> 
> My operational experience, including that acquired during my tenure working 
> for the world's largest manufacturer of firewalls by units shipped, 
> contradicts this statement.

Can you develop? I still don't see how the hell the typical web server
will handle as much traffic as one of these Checkpoint, Cisco or
whatever monsters.

> 
> >  - stateless scales badly on large networks, because it requires much more 
> > complex and lengthy rules if you are serious with security.
> 
> This is a) untrue and b) a near non-sequitur.  In general state is much more 
> harmful on larger networks than on smaller ones; and there's no correlation 
> at all between the size of a network and the complexity of network access 
> policies.

I was talking about complexity correlation between using stateful or
stateless. Maybe it does not make any difference on a frontal firewall
with a few servers behind. But on a large network with inter-vlan
filtering, it matters a lot. Believe me, this one is based on my
operational experience.

> 
> > Another advantage of stateful is that there is a first sanity check of the 
> > sessions on a specialized hardware rather than on a generic TCP/IP 
> > stack of a bloated server OS.
> 
> Marketing aside, those 'sanity checks' take place in software, not in 
> hardware; and they actually constitute a greatly broadened attack surface 
> (look at the multiple vulnerability notices/patch notices for any commercial 
> stateful firewall you can name, as well as for open-source stateful firewall 
> packages).

I still trust more the network stack of a Linux/BSD/IOS dedicated box
than the one of a Windows Server. And it means a crafted packet has to
go through mixed devices.

> 
> > For instance, the network stack of Windows is probably much more prone to 
> > bug/crash due to poor handling of crafted packets than a dedicated 
> > firewall (Checkpoint, Cisco, Fortinet...) may be.
> 
> Sadly, this is also not borne out by experience.  Quite the opposite, 
> actually.

Well maybe. I have no certitude on this point, but if you have facts,
it's welcome.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/