Re: Scan of TCP 552-554

From: Rodrigo Barbosa (rodrigob_at_suespammers.org)
Date: 07/28/03

  • Next message: Shafik Yaghmour: "Re: "access_log?hello" ?" 
    Date: Mon, 28 Jul 2003 18:47:06 -0300
To: Frank Knobbe <fknobbe@knobbeits.com>

    On Mon, Jul 28, 2003 at 03:49:26PM -0500, Frank Knobbe wrote:
    > On Mon, 2003-07-28 at 12:54, Rodrigo Barbosa wrote:
    > > My reasoning is that you have to trust your firewall. Sooner or later, the
    > > atacker will bruteforce it. So, the longer it takes for the
    > > attacker to understand there is a firewall there, the better. That is
    > > why I'm considering using tcp-reset. This way, the attacker will hit
    > > the traps faster. Maybe even same traps that will block his attack
    > > entirely.
    >
    > Sure, everything can be figured out over time. To answer your question,
    > personally I drop everything silently on the firewall (like Russel) on
    > the outside interface. On the inside interface I prefer to send a
    > TCP-Reset so that internal devices get on with their business and don't
    > hang in timeout states. Keep in mind that my policy (just like yours I
    > hope) takes a "deny all, allow required" stance. Firewalls that allow
    > all and filter out certain port ranges may be better off with TCP-RST
    > while deny-all firewalls may be better off with silent drops.

    People who deploy "allow all, filter selected" firewalls are bettor off
    with brain surgery, if you ask my opinion.

    And I do agree we hide nothing forever. Just the same, we delay nothing
    forever. So, where lies the optimum point ? Your host-unreachable below
    is along the lines of the adm-forbidden I sugested before. Anyone else
    care to contribute thoughts on this matter ?

    > I don't think you will always be able to completely hide a system though
    > (especially when it serves a purpose, like email ;)
    > However, a thought just came to mind. Would it be better (from a
    > cover-up point of view) to have the firewall send a spoofed
    > ICMP-Host-Unreachable packet with the routers IP address? :)

    That is interesting. You mean spoofing with the address of the hop
    just before the firewall ? That would be nice, considering you have control
    of that router, which is not always the case. Or if the firewall is the
    target host. If it is just another "router", we can just send a plain
    host-unreachable, and be done with it. 

    -- 
Rodrigo Barbosa <rodrigob@suespammers.org>
"Be excellent to each other ..." - Bill & Ted (The Wild Stallions)

  • Next message: Shafik Yaghmour: "Re: "access_log?hello" ?"

    Relevant Pages

    • Re: Just venting (totally OT)
      ... the ame router to get access to the net! ... I'm paranoid about opening up my firewall "just in case..." ... not visiting dodgy Websites. ... The protection that it does supply is also provided by ...
      (uk.people.support.depression)
    • Re: Just venting (totally OT)
      ... how long it plays for because it's all been ripped on to hard disc ... the ame router to get access to the net! ... I'm paranoid about opening up my firewall "just in case..." ... The protection that it does supply is also provided by ...
      (uk.people.support.depression)
    • Re: What is broken:McAfeee firewall or my router ????? Urgent, ple
      ... your computer regardless of what McAfee firewall said. ... If your router is ... warned about those ports being available right away if you had any of those ...
      (microsoft.public.security)
    • Re: What is broken:McAfeee firewall or my router ????? Urgent, ple
      ... your computer regardless of what McAfee firewall said. ... If your router is ... warned about those ports being available right away if you had any of those ...
      (microsoft.public.security)
    • Re: Just venting (totally OT)
      ... long it plays for because it's all been ripped on to hard disc so it ... I'm paranoid about opening up my firewall "just in case..." ... having the protection of a router, not opening dodgy emails, and not ... The protection that it does supply is also provided by your router ...
      (uk.people.support.depression)