Re: [fw-wiz] how prevelant

From: Kevin Sheldrake (kev_at_electriccat.co.uk)
Date: 10/12/04

  • Next message: Kevin Sheldrake: "Re: [fw-wiz] VM system for firewall use" 
    To: "Jason Lewis" <jlewis@packetnexus.com>, "R. DuFresne" <dufresne@sysinfo.com>
Date: Tue, 12 Oct 2004 08:22:11 +0100

    Hello

    Due to the rapid development of exploits against Windows OS (often all
    over the same few ports), and the tendency of script kiddies to run
    Windows attack tools, I tend to suggest that if you open your firewall up
    to allow the 'Windows' ports, then you probably aren't getting much
    benefit from the firewall. An example attack would be the automated
    attack tools that simply port scan for the Windows ports and then unleash
    all tools available against the box, leaving a shell behind if they work,
    and then simply moving on. If you have the Windows ports exposed then it
    should only be a matter of time (and a function of probability) until your
    box gets hit. If it's not patched up-to-date then it will probably get
    owned by the bad guys.

    I accept that there can be lots of other benefits a firewall can provide,
    but if you have a Windows domain, an untrusted domain, and a firewall
    between them, one has to question any security policy that allows those
    ports through. Even if you are at the forefront of patch management, I
    don't believe it is possible to patch a system where patches are simply
    not available (as is often the case).

    Of course, Samba on *nix is just as dangerous if you give everyone free
    reign.

    As an aside, providing Windows port access internal to large organisations
    is a risk that often has to be managed; internal hacks are common and
    these ports often suffice. Do you really want to increase that risk by
    giving the same level of access to everyone on the Internet?

    Kev

    > I had a job interview a while back and during the interview they were
    > explaining the network configuration to me. When the interviewer was
    > done, he asked why I had such a stunned look on my face. I said I found
    > it amazing they were passing domain information across the internet. His
    > response was that they had a firewall, so it was ok.
    >
    > I explained that firewalls are worthless if you are passing your
    > important information across the internet without some kind of
    > encryption.
    >
    > I ended up not taking the job, because they actually argued with my free
    > advice on how to immediately fix the problem. (Setup an IPSEC tunnel
    > between the sites.)
    >
    > I think it is VERY common, because there is a lack of understanding.
    >
    > You say tightfisted, I say intelligent.
    >
    > jas
    >
    > R. DuFresne wrote:
    >> how common is it for a company to have it's NT domain and novell
    >> athentication pass openly across the internet, and have this be the
    >> requirement to access VPN tunnel rights from outside into the company?
    >> The firewalls I manage keep all windows related protocols in the
    >> 135-139,
    >> 445 and 5000 ports arenas internal only, none f this traffic passes
    >> outside the firewalls, none is allowedto pass outside, unltess tunneled.
    >> Is this not a standard practise with any org with half a clue of
    >> security,
    >> or am I being more tightfisted with access and control then is the norm?
    >> Thanks,
    >> Ron DuFresne
    > _______________________________________________
    > firewall-wizards mailing list
    > firewall-wizards@honor.icsalabs.com
    > http://honor.icsalabs.com/mailman/listinfo/firewall-wizards
    >
    > 

    -- 
Kevin Sheldrake MEng MIEE CEng CISSP
Electric Cat (Bournemouth) Ltd
_______________________________________________
firewall-wizards mailing list
firewall-wizards@honor.icsalabs.com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards
  • Next message: Kevin Sheldrake: "Re: [fw-wiz] VM system for firewall use"

    Relevant Pages

    • Re: Guide to secure installtion of IIS 5
      ... don't forget a well-configured firewall. ... Do not put the computer onto the network or the Internet until after the ... Follow the instructions for hardening Windows and IIS at ... Install all service packs and security fixes from Microsoft and otherwise ...
      (microsoft.public.inetserver.iis.security)
    • Re: login attempts
      ... > Every day i have on my win2000 iternet server a lots of wrong login ... Windows by default allows ... You also need a firewall. ... the internet, except for those ports you know you're using. ...
      (microsoft.public.win2000.security)
    • Re: SP2 problem connecting to web after instal
      ... > I've just installed SP2 after downloading all Windows updates first. ... > installed from CD after checking with Microsoft that I didn't have any ... > As soon as it finished installing, I disabled their firewall, as I ... > I've checked my Internet settings which seem OK. ...
      (microsoft.public.windowsxp.general)
    • Re: password protection
      ... and cable] and should really consider Windows 2000 / XP. ... sure you're also running antivirus and firewall, ... Internet] to bypass this security. ...
      (microsoft.public.security)
    • Re: Will computers ever be as simple and reliable as a refrigerator?
      ... The problem is that a refrigerator does ONE thing.. ... Your computer is not connected to the Internet. ... using Windows XP "prettifications". ... Why you should use a computer firewall.. ...
      (microsoft.public.windowsxp.help_and_support)