Re: [Full-disclosure] Sony: No firewall and no patches

[Bruno Cesar Moreira de Souza <bcmsouza@xxxxxxxxxxxx>]

--- On May 11, 2011, Dobbins, Roland <rdobbins@xxxxxxxxx> escreveu:

> On May 11, 2011, at 12:52 AM, Bruno
> Cesar Moreira de Souza wrote:
> 
> > How would you block an ACK tunnel using only a packet
> filter? (http://ntsecurity.nu/papers/acktunneling/) You don't
> need to stop the httpd service to create this kind of
> tunnel, as the packets from the attacker would just be
> ignored by the httpd service, but could be intercepted by
> the malicious code executed on the compromised server (using
> the same approach employed by network sniffers). 
> 
> See my previous response to Thor.  I don't intend to
> keep this thread going forever in the face of
> incomprehension, but this focus on corner-case exfiltration
> techniques which are easily obviated by OS and service/app
> BCPs and appropriate monitoring, 

I don't think it is "incomprehension". Some people just don't agree with the 
incorrect and generic statement that "stateful firewalls are useless to protect 
servers". 

I can agree that in some specific cases, when the availability is the main 
concern for external servers, you may consider to use ACLs instead of a 
stateful firewall. It's an option to be more resilient against DDoS attacks. 
However, I can't agree that it should be a rule for every DMZ and external 
network in the world, because there are other options to prevent DDoS attacks 
(including using clustered firewalls), and also the stateful firewalls have 
value to restrict the action of an attacker after a server compromise.

Also, you are underestimating the skill of some attackers. My experience as a 
penetration tester and security incident investigator shows that it is not 
always so easy (even for organizations with 24x7 monitoring) to detect the 
action of attackers. As said before, a stateful firewall can be a strong layer 
of defense to restrict the damage of an attack, and to avoid backdoors and 
covert channels.

>to the point of
> instantiating unnecessary and harmful state in front of
> servers which makes it trivial to take them down,

I'm not convinced that it is always significantly easier to take down a 
firewall than the web server. In many cases, it can be also trivial to take a 
web server down with a DoS attack (tool example: 
http://ha.ckers.org/slowloris/).

> demonstrates that in general, the infosec community pretty
> much completely ignores the availability leg of the
> confidentiality-integrity-availability triad.

No, the infosec community seeks to balance these three legs. However, to decide 
which leg you are going to give more protection for in each environment (for 
example, a DMZ) and in each organization, it's better to conduct first a risk 
analisys. 

For example, for a bank it can be worse to have an external penetration 
incident into critical database servers allowing modification of financial 
information than an unavailability incident on the Internet Banking web site.

> 
> Which is disappointing, given that availability is in fact
> the most important leg of that triad.

This is a misleading statement. It depends on the information, environment, 
risks, organization etc. For many organizations, the confidentiality and 
integrity of the information stored in critical database servers can be much 
more important than the availability of the public web sites. This is why 
organizations with a minimum information security maturity conduct risk 
analisys before deciding which security mechanisms they will implement.


Bruno Cesar M. de Souza 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/