Re: Sony: No firewall and no patches

["Thor (Hammer of God)" <thor () hammerofgod com>]

> On May 10, 2011, at 4:42 PM, Pete Smith wrote:
>
> >  if an attacker initiates a connection dest port higher than 2048 (to some
> other server the attacker controls) and source port of 80 that will pass
> through an ACL without issues, this would not be so on a stateful firewall.
>
>
> If the attacker's in a position to generate an outbound connection sourced
> from a well-known port (which presumably is supposed to have an httpd
> attached to it), there's nothing a stateful firewall can do to improve matters.

You can if you require authentication, which I do even here at the HoG labs.  Well, except for rules specifically 
created for other devices such as, ironically, my PS3. :)

Mike Kaeo's presentation is interesting, and certainly has merit where it applies - but saying "stateful firewalls have 
no place in front of servers" is far too generic of a statement.   There are any number of topological deployment 
scenarios where firewalls certainly provide security in depth and added security, irrespective of what Mr. Kaeo's 
opinion on the matter is.  If one can design a secure access model using router ACLs then right on, but that doesn't 
mean that other models don't work.

I'm unclear as what you mean by "no state to inspect in the first place" in regard to firewalls in front of servers - 
my TMG box most certainly inspects state when I access assets via the firewall.   I think I know what you really meant 
by that statement, but can you explain your point a bit more?  I want to make sure I'm not missing something.

t



_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/