RE: External Penetration Question

["David Gillett" <gillettdavid () fhda edu>]

> say by visiting a malicious website. 

  The unfounded assumption is that users have some way, a
priori, of guessing what constitutes a malicious website.
Perhaps their favourite kiddie-safe site got defaced over
night, and is this morning loaded with boobytraps....

David Gillett



> -----Original Message-----
> From: anonymous () abc com [mailto:anonymous () abc com] 
> Sent: Tuesday, August 08, 2006 2:12 PM
> To: security-basics () securityfocus com
> Subject: Re: External Penetration Question
>
> In the scenario you describe, the only way an exploit would 
> work would be to have the computer behind the NAT and 
> firewall to connect to the exploiter, say by visiting a 
> malicious website. Once the connection is established from 
> behind the NAT/firewall, the exploit can be carried out, 
> because NATs and firewalls (most of the time) only block 
> incoming connections, not data transfers over existing 
> connections. This is also why social engineering is such a 
> big issue, because if a malicious individual can get someone 
> to visit a particular website or download a particular file, 
> then the connection can be established from the inside out. 
> This is not to say that by visiting any old website you are 
> immediately vulnerable to exploit; the website would have to 
> contain malicious code.
>
> --------------------------------------------------------------
> -------------
> This list is sponsored by: Norwich University
>
> EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE 
> The NSA has designated Norwich University a center of 
> Academic Excellence in Information Security. Our program 
> offers unparalleled Infosec management education and the case 
> study affords you unmatched consulting experience. 
> Using interactive e-Learning technology, you can earn this 
> esteemed degree, without disrupting your career or home life.
>
> http://www.msia.norwich.edu/secfocus
> --------------------------------------------------------------
> -------------


---------------------------------------------------------------------------
This list is sponsored by: Norwich University

EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The NSA has designated Norwich University a center of Academic Excellence 
in Information Security. Our program offers unparalleled Infosec management 
education and the case study affords you unmatched consulting experience. 
Using interactive e-Learning technology, you can earn this esteemed degree, 
without disrupting your career or home life.

http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------