RE: [fw-wiz] Application-level Attacks

From: Bill Royds (bill_at_royds.net)
Date: 01/30/05

  • Next message: Crispin Cowan: "Re: [fw-wiz] Application-level Attacks" 
    To: "'Adam Shostack'" <adam@homeport.org>, "'Frederick M Avolio'" <fred@avolio.com>
Date: Sun, 30 Jan 2005 14:02:01 -0500

    Perhaps the distinction is really between data attacks versus protocol attacks,
    no matter what layer the attack occurs.
     In an protocol attack, one attacks the network protocol itself using syntax
    manipulation.
     In a data attack, one wants to access or change the data at the information
    level to attack the business itself by fraud etc.
     
       Past attacks often had the effect of halting computer operations for a
    period, but did not affect the overall enterprise. Nowadays, as business and
    computer networks become intricately linked, attacking the computers and
    networks attacks the main business. This also means the IT security becomes
    fundamental to enterprise security. For many businesses their connection to the
    Internet is as important as their connection to the water and power grids.
      Firewalls have traditionally worked by ensuring that the protocols they
    monitor were valid but did not restrict much the actual information content of
    the data that passed through. They ensured safe syntax. Newer tools like IPS or
    web filters are attempts to handle attacks at message content level by having an
    idea of what is valid in the business context, not just the network protocol
    context. Since each business context is different, they are much harder to tune
    than before. But the need for filters at this level is becoming more and more
    apparent as the attacks shift away from lower level technology to high level
    information.

    -----Original Message-----
    From: firewall-wizards-admin@honor.icsalabs.com
    [mailto:firewall-wizards-admin@honor.icsalabs.com] On Behalf Of Adam Shostack
    Sent: Saturday, January 29, 2005 4:29 PM
    To: Frederick M Avolio
    Cc: Marcus J. Ranum; firewall-wizards@honor.icsalabs.com
    Subject: Re: [fw-wiz] Application-level Attacks

    <snip>

    I think we need a better term than application layer attacks (as this
    conversation shows.) I don't think that we're seeing technically new
    attacks, but rather a re-orientation of the attackers, why they're
    attacking, and what they're after. Unfortunately, analysts are
    talking about this a fair bit, and they're doing so in ways that are
    confusing people.

    Adam

    _______________________________________________
    firewall-wizards mailing list
    firewall-wizards@honor.icsalabs.com
    http://honor.icsalabs.com/mailman/listinfo/firewall-wizards

  • Next message: Crispin Cowan: "Re: [fw-wiz] Application-level Attacks"

    Relevant Pages

    • Re: how to react on ssh attacks?
      ... > I recently checked my log files of my ssh service (so far as I ... these attacks will get more sophisticated as time goes on - the ... Protocol 2,1 line in /etc/ssh/sshd_config to say Protocol 2 and then ... Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org ...
      (Fedora)
    • Re: hash function
      ... > because the PRF security condition does not guarantee security ... > I frequently see protocol designers who are not very clear on what ... > that the hash had better be collision-resistant. ... > against attacks that might not have been anticipated. ...
      (sci.crypt)
    • Re: Lets talk about firewalls - what do we as a group think a firewall should be/have?
      ... attacks. ... firewall for open ports, or to block worms (TCP 1433/1434 as an ... It should be able to filter both inbound or outbound traffic by protocol ... Many NICs, of course, not only two. ...
      (comp.security.firewalls)
    • [REVS] Attacks on Kerberos V in a Windows 2000 Environment
      ... Beyond Security in Canada ... Microsoft introduced Kerberos V as ... which is a protocol used for ... SMB is used as an example in one of the attacks. ...
      (Securiteam)
    • Re: Countering chosen-plaintext attacks
      ... If you assume that attacks ... Those unknown attacks are ... That's not a 'protocol' in my understanding of the word. ... idea I had in my humble design WEAK4-EX. ...
      (sci.crypt)