Re: Microsoft Strategic Technology Protection Program

From: Tony Chow (tchow@BLUETENTACLE.COM)
Date: 10/11/01 

Message-ID:  <50B30C640EC48648ABAA34F00D737A96CDAA@leto.bluetentacle.local>
Date:         Thu, 11 Oct 2001 11:04:54 -0700
From: Tony Chow <tchow@BLUETENTACLE.COM>
Subject:      Re: Microsoft Strategic Technology Protection Program
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM

> AFAIK, IPsec filters can distinguish incoming and outgoing trafic.
> However, the default setting when specifying a filter in the 'IP
> Security Policies' plugin in the MMC is 'Mirrored'
> (equivalent to a '+'
> instead of '=' when specifying rule via ipsecpol), whose immediate
> effect is to effectively produce two rules, for incoming and outgoing
> trafic. You can uncheck this option and specify different rules for
> inbound and outbound trafic.

Perhaps I should have been more clear. I'm talking about inbound and
outbound TCP *sessions*. In a firewall you can configure, say, port 80
on a local web server address to only accept client-initiated *sessions*
(inbound sessions). This would mean that the web server cannot use port
80 on its end to initiate sessions and request service from the client
side. Conversely, you can specify on a firewall, to allow clients
inside the firewall to initiate sessions with port 80 of outside
webservers, so that they may browse the web (outbound sessions). The
outside web server cannot initiate a session on its 80 with ports on the
client side.

This is known as stateful packet inspection, and most modern firewalls
provide it. Such firewalls treat inbound and outbound TCP sessions
differently, even though they are both bidirectional in the raw IP
sense.

IPSec, on the otherhand, does not provide stateful inspection of
packets, and consequently does not distinguish between inbound and
outbound sessions. It only notes port numbers on the end points. So,
if you set up a mirrored filter in IPSec, specifying that any random
port on the local computer can communicate with the port 80 of any
outside computer, just like you would do in a true firewall, remote
hackers can then scan and attack all of your open local ports as long as
they are working from port 80.

It is worth keeping in mind this limitation of IPSec while implementing
filtering solutions with it.

> On the other hand, if you need to filter on ICMP messages (type and
> code), you can use the packet filtering possibilites of the RRAS
> service.

That is an option.

======================================
Delivery co-sponsored by Trend Micro, Inc.
======================================
BEST-OF-BREED ANTIVIRUS SOLUTION FOR MICROSOFT EXCHANGE 2000
Earn 5% rebate on licenses purchased for Trend Micro ScanMail for
Microsoft Exchange 2000 between October 1 and November 16. ScanMail
ensures 100% scanning of inbound and outbound traffic and provides
remote software management. For program details or to download your
30-day FREE evaluation copy:
http://www.antivirus.com/banners/tracking.asp?siS&BI;$5&UL;=http://www.ant
ivirus.com/smex2000_rebate

Relevant Pages

  • Re: HELP: BizTalk 2004 Direct Port to Message Box - Delivered not consumed
    ... Have to tighten up the filter expression - because once i subscribe to ... Message box direct bound ports, as its name implies, allows you to drop ... bound port set the 'Partner Orchestration Port' property to ... an activating receive shape the subscription will be the message type ...
    (microsoft.public.biztalk.general)
  • Re: Scanning--more then one side to the argument
    ... PORT STATE SERVICE VERSION ... Filtered means that a firewall, filter, or other network obstacle ... >> I would say that any open port POTENTIALLY could be a security issue ... just being networked could be a risk. ...
    (Security-Basics)
  • RE: Possible DoS Attack?
    ... > was compromised they'd have simply turned off the filter, ... system accepts to turn the firewall off? ... wrote regarding RE: Possible DoS Attack?: ... What your firewall dropped was the result of a port ...
    (Incidents)
  • RE: VBscript Error on SBS2k3
    ... The Remote Web Workplace page for my client is accessible ... I Agree that there is an issue with the traffic passing through Port 4125 ... The filter settings are as follows: ... > This newsgroup only focuses on SBS technical issues. ...
    (microsoft.public.windows.server.sbs)
  • Re: Filtering records with combo box
    ... objective is to filter records based on a combo box ... >>training sessions each year. ... >>Employees table, a Sessions table, and an Attendance ...
    (microsoft.public.access.forms)