Full Disclosure mailing list archives
Re: A new TCP/IP blind data injection technique?
From: Michal Zalewski <lcamtuf () ghettot org>
Date: Mon, 15 Dec 2003 19:17:54 +0100 (CET)
On Mon, 15 Dec 2003, Michael Gale wrote:
Well first of all, one of the industry leading firewalls ( BorderWare Firewall Server ) does NOT pass fragmented packets.
What I was asking for, is whether you have any further information about this? Or is it just the way you have it configured? I would be surprised if this is a default for commercial production-grade firewalls, as it may - quite simply - prevent some people from communicating with you in some situations. Most commercial firewall vendors go as far as disabling PMTUD just to avoid this.
I have a rule at the beginning: iptables -A INPUT -f -j DROP
Ok - this is a very specific configuration, then. On most sane firewalls, it is not necessary to drop fragments (and, quite frankly, not particularly wise, either) - the firewall will simply reassemble all traffic before forwarding it any further (this is something you suggested is going to be implemented for BorderWare, and a functionality present for long years on systems like Linux).. Cheers, -- ------------------------- bash$ :(){ :|:&};: -- Michal Zalewski * [http://lcamtuf.coredump.cx] Did you know that clones never use mirrors? --------------------------- 2003-12-15 19:05 -- http://lcamtuf.coredump.cx/photo/current/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Re: A new TCP/IP blind data injection technique?, (continued)
- Re: A new TCP/IP blind data injection technique? Jeff Kell (Dec 12)
- Re: A new TCP/IP blind data injection technique? Valdis . Kletnieks (Dec 11)
- Re: A new TCP/IP blind data injection technique? Mikael Abrahamsson (Dec 11)
- RE: A new TCP/IP blind data injection technique? David Gillett (Dec 11)
- Re: A new TCP/IP blind data injection technique? Michael Gale (Dec 13)
- Re: A new TCP/IP blind data injection technique? Michal Zalewski (Dec 13)
- Re: A new TCP/IP blind data injection technique? Valdis . Kletnieks (Dec 13)
- Re: A new TCP/IP blind data injection technique? Michael Gale (Dec 13)
- Re: A new TCP/IP blind data injection technique? Michal Zalewski (Dec 14)
- Re: A new TCP/IP blind data injection technique? Michael Gale (Dec 15)
- Re: A new TCP/IP blind data injection technique? Michal Zalewski (Dec 15)
- Re: A new TCP/IP blind data injection technique? Michael Gale (Dec 15)
- Breaking the checksum (a new TCP/IP blind data injection technique) Michal Zalewski (Dec 14)