Penetration Testing mailing list archives
Re: Question re: load balancers as a security device
From: Justin Ferguson <jnferguson () gmail com>
Date: Tue, 22 Jan 2008 13:09:15 -0700
On Jan 22, 2008, at 8:05 AM, dan.tesch () comcast net wrote:
well wait, please clarify- is VPN access required to access thus network segment?In reviewing our site design I have seen that the VPN between our LAN and the hosting facility permits all IP traffic in both directions - effectively making these public facing servers part of our LAN in my opinion.
well the thing is that at least in theory they're not directly addressable externally, however your load balancer forwards requests on to the boxes, so the attack surface exists and its not like connect back shells are uncommon.[...]because of the load balancers in front of the servers, the world at large is not able to touch the machines and thus the potential for compromise is limited.
Now, depending on how the load balancer works, it may normalize or sanity check protocol data that causes a bug to be unexploitable from that side of the network.
I'd be asking how, exactly, this dev came to this conclusion as it seems like a pretty shaky argument IMHO
Thanks--- ---------------------------------------------------------------------This list is sponsored by: Cenzic Need to secure your web apps NOW? Cenzic finds more, "real" vulnerabilities fast. Click to try it, buy it or download a solution FREE today! http://www.cenzic.com/downloads--- ---------------------------------------------------------------------
------------------------------------------------------------------------ This list is sponsored by: Cenzic Need to secure your web apps NOW? Cenzic finds more, "real" vulnerabilities fast. Click to try it, buy it or download a solution FREE today! http://www.cenzic.com/downloads ------------------------------------------------------------------------
Current thread:
- Question re: load balancers as a security device dan . tesch (Jan 22)
- Re: Question re: load balancers as a security device Matthew Leeds (Jan 23)
- Re: Question re: load balancers as a security device Justin Ferguson (Jan 23)
- Re: Question re: load balancers as a security device kevin horvath (Jan 23)
- Re: Question re: load balancers as a security device Marcos Pitanga (Jan 23)
- Re: Question re: load balancers as a security device bugtraq (Jan 25)
- Re: Question re: load balancers as a security device Marcos Pitanga (Jan 23)
- Re: Question re: load balancers as a security device Roland Dobbins (Jan 23)
- Re: Question re: load balancers as a security device Timothy Shea (Jan 25)
- Re: Question re: load balancers as a security device Roland Dobbins (Jan 28)
- Re: Question re: load balancers as a security device Robert E. Lee (Jan 29)
- Re: Question re: load balancers as a security device Timothy Shea (Jan 25)
- Re: Question re: load balancers as a security device Sanjay R (Jan 23)
- Re: Question re: load balancers as a security device David Howe (Jan 25)
- Re: Question re: load balancers as a security device Dotzero (Jan 25)