Re: Req: info on IP range popup ad software supposedly called "Extreme Marketing"

From: Todd Knarr (tknarr@silverglass.org)
Date: 12/31/02 

From: Todd Knarr <tknarr@silverglass.org>
Date: Tue, 31 Dec 2002 02:00:23 GMT

In comp.security.misc <pan.2002.12.31.01.05.40.224115@forme.com> Joe Schmoe <nomail@forme.com> wrote:
> Why would it be inbound? I'm talking about generating a valid IP that
> exists within your own subnet that will pass an outbound filter. The
> machine generating the packet AND the spoofed IP are both on the same
> subnet controlled by the same router.

It'd depend on the filtering. I'd probably implement rules that would
prevent both scenarios. Examples:

1. Dial-up. The controller in the modem racks knows which IP address was
   assigned to each dial-in line. Ingress filtering is applied to each
   line prohibiting any packets sourced from an IP address not associated
   with that line.
2. Ethernet. I'd pick a switch that could filter on MAC and IP addresses,
   and configure it to drop all packets on a port not from an address that
   should be hooked up to that port. Depending on hubs and unmanaged switches
   there may be a range of addresses usable on a given managed port, but it
   should be small. For maximum paranoia, associate MAC addresses with ports
   and filter on that. That makes it impossible to impersonate another NIC at
   a cost in troubleshooting when people change NICs or equipment.
3. Cable modems. The CMTS knows the IP address assigned to a given cable
   modem, and it's a bitch to forge the CM serial number. Configure the
   CMTS to kill any modem sourcing packets from anything other than the
   addresses properly assigned to it.

What this amounts to is basic ingress filtering, but on the other side
of the ISP's network (customer->ISP instead of Internet->ISP). The worst
of the lot is the Ethernet one if you've got a deep or wide hub tree, so
each port on the switch has a lot of machines hanging off it. You get a
lot of performance/collision issues in that case too, so from both a
security and a performance standpoint it'd be better to install more
managed switches and trim down the unmanaged subtrees to a manageable
size. 

-- 
If you are going to kill me then do so. Otherwise, I have considerable
work to do.
                                -- Lennier

Relevant Pages

  • Re: Fax configuration assistance required
    ... from my DSL modem feeds into one side and the line from my fax modem ... in my bedroom to filter out the noise from the DSL and/or fax connection. ... Firewall and 4 Port Switch is connected to the Modem port on the DSL filter ...
    (microsoft.public.windowsxp.print_fax)
  • Re: HELP: BizTalk 2004 Direct Port to Message Box - Delivered not consumed
    ... Have to tighten up the filter expression - because once i subscribe to ... Message box direct bound ports, as its name implies, allows you to drop ... bound port set the 'Partner Orchestration Port' property to ... an activating receive shape the subscription will be the message type ...
    (microsoft.public.biztalk.general)
  • Re: Scanning--more then one side to the argument
    ... PORT STATE SERVICE VERSION ... Filtered means that a firewall, filter, or other network obstacle ... >> I would say that any open port POTENTIALLY could be a security issue ... just being networked could be a risk. ...
    (Security-Basics)
  • Re: Microsoft Strategic Technology Protection Program
    ... the default setting when specifying a filter in the 'IP ... outbound TCP *sessions*. ... This would mean that the web server cannot use port ... if you set up a mirrored filter in IPSec, ...
    (NT-Bugtraq)
  • RE: Possible DoS Attack?
    ... > was compromised they'd have simply turned off the filter, ... system accepts to turn the firewall off? ... wrote regarding RE: Possible DoS Attack?: ... What your firewall dropped was the result of a port ...
    (Incidents)