Re: recommend Linux firewalls for non-profit

From: erik (erik_at_geenspam.vanwesten.net)
Date: 04/27/03 

Date: Sun, 27 Apr 2003 13:39:41 +0200

Ginger Git wrote:

>
> "Dave Thornburgh" <dave-thorn@nodash.adelphia.net> wrote in message
> news:QYHqa.4666$1K5.3684287@news3.news.adelphia.net...
>>
>> "Ginger Git" <gingergit@PleaseRemoveNOSPAM.> wrote in message
>> news:b8dt93$p44$1@titan.btinternet.com...
>>
>> > But as my first comment said, what cannot be seen cannot be hacked!
>> > If
> you
>> > cannot see the transpant Bridge it cannot be hacked, what you are
> stating
>> is
>> > true with any firewall, so what is the relevance to the Transparent
>> Bridge?
>> > I apprieatite what you are saying, but initial statement isn't true
>> > in
> all
>> > cases but it is in the case of a Transparent Bridge, if you cannot
>> > see
> it
>> > you cannot hack it.
>>
>> And the reason for the responses from me and Kasper is that your
>> assertion
>> is WRONG. What cannot be seen CAN be hacked, for the right
>> combinations
> of
>> target and hacker. It's not necessary to see your target, if 1) your
> target
>> has a vulnerability, and 2) if you can ensure that your target will
>> see
> the
>> attack traffic.
>>
>> The first point is NOT trivial. New vulnerabilities are found in
>> hardware
>> and software every day. The second point is very easy. If I want to
>> make sure your bridge sees a particular packet, then all I have to do
>> is send
> it
>> to an address that is behind your bridge.
>>
>> Dave
>>
>>
>
> but if the bridge has no IP address and therefore cannot be accessed
> remotly then there for it is secure! anything behind it is as secure
> as the platform / security in place on it. you could install
> checkpoint FW-1 on Ipso and that is secure for the firewall but the
> devices behind it can still be hacked if the right exploits are used
> on those hosts.
>
> What my point is - "If you cannot see the transpent Bridge you cannot
> attack it / reconfigure it etc" I am not talking about anything else.
> What part of that last line don't u understand??????? Would you like
> me to give you a lesson in Security?
>

Currently the most difficult thing to hack is a well designed firewall,
being it a bridge or ip based. Look for the content. If you run a
webserver _that_ is where vulnerability comes in. The firewall (unless
running http screening like code) cannot do anything about that. It was
legitimate traffic after all. Look at all allowed services this way.

You will find that you do not need to hack or crack a firewall in order
hack or crack anything behind that firewall.

EJ 

-- 
Remove the obvious part (including the dot) for my email address

Relevant Pages

  • Re: Emails using Gateway IP in header instead of router IP number
    ... that shouldn't matter whether the cable modem is bridged or routed. ... Once the SMTP traffic leaves exchange, I could route it through a packet-inspecting firewall, a NAT device, another firewall, through a linux box, through a spam filter appliance, then through an untangle setup, untill it eventually reaches my network edge and onto Comcast's network. ... header sent from server is using the gateway IP number instead of my ... They should instruct or help Sam in setting up the cable modem in Bridge mode so all outbound traffic appears be coming from the internal router. ...
    (microsoft.public.windows.server.sbs)
  • Re: IP access restriction
    ... > Would a 'firewall' like machine with IPTABLES be able to accomplish this, ... Then create a bridge ... then you add ethernet cards to the bridge (you can have multiple cards in ... acknowledges that a bridging firewall is a possibility is fwbuilder, ...
    (Fedora)
  • Re: Wkgrp Network of 3 XP and 1 2K ... CDiag logs - 1 files [1/2] - 1 files [1/2]
    ... >> Fix the Bridge on Gatewayp4, ... >> additional problems will be firewall - see the Error 6118 reference. ... Network Neighborhood while the primary master browser is offline. ...
    (microsoft.public.windowsxp.network_web)
  • PF bridged firewall?
    ... sides of the firewall, with the internal range more often than not a NAT'd ... I usually end up putting a bridge in with and IP address one ... past the point of not having enough IP's for the number of clients, ... I could drop a second firewall in, this one acting as a NAT'd range to the ...
    (comp.unix.bsd.openbsd.misc)
  • Re: Dlink 302g with Linux IPCop firewall
    ... >> to work as a bridge in conjunction with an IPCop firewall? ... It's currently letting the modem negotiate the PPP connection ... > MTU of the PPP interface is at most 1492 bytes. ...
    (comp.os.linux.security)
Quantcast