RE: basic stateful inspection question

From: Hiemstra, Brenno (brenno.hiemstra@ignite.nl)
Date: 02/08/02 

From: "Hiemstra, Brenno" <brenno.hiemstra@ignite.nl>
To: "'leon'" <leon@inyc.com>, security-basics@security-focus.com
Date: Fri, 8 Feb 2002 09:08:58 +0100

Leon,

What you are talking about is checking the packets if they are REAL http if
they
are going thru port 80 then you will be dissapointed.

What you can do on Checkpoint (dont know if pix can do it) is authenticate
on
http connections and point to somesort of CVP server that checks traffic
going
to the internet from the internal network. This way the CVP server can check

IP packets for all kind of stuff (depends on the CVP server ofcourse) and
may
deny packets that arent http packets

This makes it more difficult to use port 80 through firewalls but if you can
do some
serious firewall piercing you may find an other port that is open and
connect thru
that port to the internet with netcat.

Basically it depends if they use plain and simple stateful inspection or
does some
more application filtering of traffic. A normal Checkpoint or PIX firewall
allowing
port 80 is vulnerable, if they use somekind of proxy or CVP its not so easy
to
connect with netcat to the ourside.

What I also advice to network admins is only allow http traffic outbound by
the
proxy (if you use one what I would advice to always use anyway) only...
dont allow http traffic originating from the clients out !

Regards,

Brenno

> -----Original Message-----
> From: leon [SMTP:leon@inyc.com]
> Sent: donderdag 7 februari 2002 3:20
> To: security-basics@security-focus.com
> Subject: basic stateful inspection question
>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> It seems to me that a lot of people use either nat or pat and that
> these types of firewalls
> by default drop unsolicited connection attempts (meaning packets that
> arrive with the syn bit set).
> Any packet that leaves the network is put in the state table so that
> the return packets can come back in.
> My question is this; if I were to exploit a client-side buffer
> overflow and I got the system to make a
> connection to me via netcat with a destination port of 80, would I
> circumvent a majority of the stateful
> inspection firewalls? It seems that these firewalls trust that ALL
> connections originating from the
> inside are good. Now I know we could block off destination ports of
> services we don't want to allow
> access to (say no port 23 traffic leaves the network because we don't
> allow telnet) but I am wondering
> if either of these firewalls have a method of filtering based on
> protocol (for example allow 80 to be
> a destination port but only http traffic can cross it. No netcat, no
> aim, no limewire just http.
>
> I have seen a ton of networks where I came in and I found people
> using things like aim even though
> the firewall specifically only permitted port 80 traffic out
> (obviously these people switched the port
> from 5190 to 80).
>

Relevant Pages

  • Re: What does a firewall do?
    ... Forward packets not for H, ... > to node Y (from port P to port Q?) and a reject comes back to H, ... >> Firewalls also provide very good logging capabilities these days, ... >> firewalling appliances inside the network stack. ...
    (comp.security.firewalls)
  • Re: [Full-disclosure] [inbox] Re: [ Capture Skype trafic ]
    ... conforming HTTP to travel along on port 80. ... you can't be a moron and have every other port under the sun open ... When Skype uses port 80, the protocol used is still Skype's ... if the SSL controls are installed these packets ...
    (Full-Disclosure)
  • RE: Routers, Switches, and Firewall testing
    ... We have been using the ISIC tool suite. ... random packets of the target protocol. ... specify the source and destination port along with the IP. ... While the test above is not "realistic" as firewalls generally do not recive ...
    (Pen-Test)
  • Re: Dos attacks
    ... would include a certain amount of "probing" by other systems... ... and samples of the packets. ... A ping followed immediately by a port ... HTTP requests could be someone looking for unknown web sites, ...
    (comp.security.firewalls)
  • Re: Etherreal not capturing calls to localhost
    ... no packets are being seen or captured. ... I think the MS SOAP toolkit has a tracing utility where you set up a local proxy to which you direct your requests which are then traced and forwarded to the real address so you could e.g. set up that proxy for HTTP on port 8080 and have the normal web services for HTTP on port 80. ...
    (microsoft.public.dotnet.xml)