Re: NYT Article this morning

[perry () imsi com (Perry E. Metzger)]

Rick Busdiecker says:
>     Even that is insufficient, actually. If you see a packet going by, you
>     can still try to jam the works up and steal the connection anyway. The
>     only permanent solution is a cryptographic security protocol for the
>     net -- one is actually in the works now in the IETF.
>
> Morris' paper concludes with this sentence:
>
>   A workable solution might be to only trust hosts on the same
>   physical network, and modify gateways to reject packets that claim
>   to, but do not in fact, come from directly connected networks.
>
> Your statement as to the ``only permanent solution'' suggests that you
> disagree with Morris' hypothesis.

Yes.

> Do you believe that it's possible to use the techniques that are being
> discussed to get past a ``two wire'' firewall which ignores internal
> packets originating from the external wire?

Yes.

This won't impact people that don't allow specially authenticated
logins via their firewall, but sites using S/Key and similar methods
for authenticated firewall traversing logins can be hit. The victim
can log in to the firewall from the outside and have his session
stolen -- this is the equivalent of an ATM thief waiting for someone
to enter their PIN at a machine and then knocking them cold.

Perry