Re: Blocking Port scans

From: Chris Moody (chris_at_siliconhotrod.com)
Date: 10/25/05

  • Next message: Chris Buechler: "Re: Default shares & SMS Server" 
    Date: Tue, 25 Oct 2005 13:24:13 -0700
To: BSK <bishan4u@yahoo.co.uk>

    The only way to effectively block SYN packets is to have Access-lists in
    place for all the hosts you are protecting. If you don't allow any
    traffic to a system, you stop the SYN.

    Since a SYN flag is necessary to initiate a valid connection, there is
    no way to mitigate against a SYN connection attempt shy of strict
    filtering of who can contact what.

    While an IPS inline could drop what it detects as a "scan", I'm
    personally not as comfortable relying on a signature based system as I
    am fine grained restricting traffic at layer3. If it's supposed to
    talk, it's allowed...everything else is dropped. I find that this rules
    out the vast majority of cases.

    -Chris

    BSK wrote:
    > Hello Everyone,
    >
    > Just wanted some feedback from you people. I'm doing a
    > Firewall Assessment for a CISCO PIX firewall. The
    > firewall allows SYN, FIN, NULL and XMAS scans but
    > blocks ACK scans (largely means its a stateful
    > firewall).
    >
    > Now what do we do to block the scans that are allowed.
    > I think it should be easy to block FIN, NULL and XMAS
    > scans but how do we block or limit or workaround a SYN
    > scan. 1 way that I think is probably blocking or
    > limiting the packets from the source (using IDS/IPS)
    >
    > Looking ahead to some ideas, thoughts, hints.
    >
    > thns bshan
    >
    >
    >
    >
    > ___________________________________________________________
    > To help you stay safe and secure online, we've developed the all new Yahoo! Security Centre. http://uk.security.yahoo.com
    >
    > ------------------------------------------------------------------------------
    > Audit your website security with Acunetix Web Vulnerability Scanner:
    >
    > Hackers are concentrating their efforts on attacking applications on your
    > website. Up to 75% of cyber attacks are launched on shopping carts, forms,
    > login pages, dynamic content etc. Firewalls, SSL and locked-down servers are
    > futile against web application hacking. Check your website for vulnerabilities
    > to SQL injection, Cross site scripting and other web attacks before hackers do!
    > Download Trial at:
    >
    > http://www.securityfocus.com/sponsor/pen-test_050831
    > -------------------------------------------------------------------------------
    >
    >

    ------------------------------------------------------------------------------
    Audit your website security with Acunetix Web Vulnerability Scanner:

    Hackers are concentrating their efforts on attacking applications on your
    website. Up to 75% of cyber attacks are launched on shopping carts, forms,
    login pages, dynamic content etc. Firewalls, SSL and locked-down servers are
    futile against web application hacking. Check your website for vulnerabilities
    to SQL injection, Cross site scripting and other web attacks before hackers do!
    Download Trial at:

    http://www.securityfocus.com/sponsor/pen-test_050831
    -------------------------------------------------------------------------------

  • Next message: Chris Buechler: "Re: Default shares & SMS Server"

    Relevant Pages

    • RE: Blocking Port scans
      ... I don't think you will successfully shun SYN traffic with the PIX. ... Firewall Assessment for a CISCO PIX firewall. ... Audit your website security with Acunetix Web Vulnerability Scanner: ... Up to 75% of cyber attacks are launched on shopping carts, ...
      (Pen-Test)
    • Re: Hacking to Xp box
      ... I think there was a misunderstanding in the firewall point: ... you need to find some vulnerability that could be exploited to run ... > restricts most of the attacks that use anonymous connections. ... > Audit your website security with Acunetix Web Vulnerability Scanner: ...
      (Pen-Test)
    • Re: Hacking to Xp box
      ... I think there was a misunderstanding in the firewall point: ... you need to find some vulnerability that could be exploited to run ... > restricts most of the attacks that use anonymous connections. ... > Audit your website security with Acunetix Web Vulnerability Scanner: ...
      (Pen-Test)
    • Re: Hacking to Xp box
      ... I think there was a misunderstanding in the firewall point: ... you need to find some vulnerability that could be ... > restricts most of the attacks that use anonymous connections. ... > Audit your website security with Acunetix Web Vulnerability ...
      (Pen-Test)
    • RE: Hacking to Xp box
      ... and an admin with knowledge of their environment would be able ... I think there was a misunderstanding in the firewall point: ... > restricts most of the attacks that use anonymous connections. ... > Audit your website security with Acunetix Web Vulnerability Scanner: ...
      (Pen-Test)
    • Quantcast