Re: DMZ config question

[Adam Shostack <adam () homeport org>]

Eric Vyncke wrote:
| Adam,
| 
| Thanks for your valuable comments, anyway:
| 
| 1) switches are usually inside your network and mostly not 
| reachable from the outside (else you are in deep trouble anyway!).
| And, attacks from your network can usually be traced and acted
| upon (e.g. firing the hacker, ...)

A.      If you're worried about people sniffing the traffic, which was
the previous justification, you need to worry about people attacking
the switch.  Worse, they can attack with things that you thought were
ok, since you block them at the firewall.  (SNMP, anyone?)

B.      Historically, most attackers are internal.  I believe that
with the internet, this has changed somewhat, but what has also
changed is the easy availability of hacker tools.  (Ask altavista if
you don't believe me.)

| 2) IPsec is very nice and I'm very happy to use it to provide
| confidentiality/integrity but it is not a silver bullet. IPsec
| does not solve all problems :-(

        Absolutely correct.  But it does block sniffing, and with
proper keying, provides for authentication.

        For those of you who are not cryptographers, the phrase 'with
proper keying' is roughly equivallent to the phrase 'a miracle happens
here' in the Far Side cartoons. :)


Adam

| It will be interesting how the switch industry will react on
| the new threat from the inside. And I do fear that a lot
| of them have unsecured configurations.
| 
| Which frighten me since Ethernet switch are commonly used to
| segregate a single cabling system into separate LAN.
| 
| Wait and see
| 
| -eric
| 
| At 08:56 10/04/98 -0400, Adam Shostack wrote:
| >     I hate to spread FUD, but last summer at Black Hat Briefings,
| >I asked a panel which included Mudge, route, Artimage, and a number of
| >other smart hackers about the next big type of attack, now that buffer
| >overflows and misconfigurations are commonplace.
| >
| >     There were a couple of confident replies that switching
| >technology only works until you subject it to malicious attack, and
| >then all sorts of interesting things can be made to happen.
| >
| >     This jibes with my experience, which is that technologies not
| >designed for security don't provide security, and that technologies
| >not designed to resist malicious attacks don't resist malicious
| >attacks.
| >
| >     So, if you choose to rely on a switch, ask your vendor for
| >their test results from when they maliciously attacked it.  Adjust
| >your trust levels accordingly.  And deploy IPsec.
| >
| >Adam
| >
| >
| >Eric Vyncke wrote:
| >| At 22:26 7/04/98 -0500, Chris Lonvick wrote:
| >| >Hi,
| >| >
| >| >Some random thoughts:
| >| >
| >| >Use a switch - If any one system on the DMZ is compromised, then an
| >| >  attacker may be able to set up tcpdump (or similar) to capture
| >| >  usernames and passwords.  With a switch, the attacker will only
| >
| >| And even be more paranoid, use a switch with static mapping
| >| between MAC address and port. The physical port cannot be change
| >| from a remote site while the MAC address could possibly be changed.

-- 
Just be thankful that Microsoft does not manufacture pharmaceuticals.