Re: Are Fragmentation Attacks Still Used for IDS/IPS Evasion?

[Harry Hoffman <hhoffman () ip-solutions net>]

well, there are a few things to think about...

fragmentation as DOS attacks,
fragmentation as cover for stealth attacks,
incorrectly configured firewalls,
compromised systems on the inside that have a greater level of access 
then on the outside. (internal servers that are separated from Desktops 
from a router and not a firewall... not all that uncommon, unfortunately).

Cheers,
Harry

seclt yuri wrote:
> Yes but this effectively means that fragmentation
> attacks are useless if launched across the 'Net and
> when performing a penetration test without local
> access.
>
> Also, even internal host systems are usually
> segregated from servers and server vlans by a
> firewall, so even then, I can't see how fragmentation
> attacks would be effective.  The only scenario that I
> can think of would be within the same subnet or vlan
> where traffic doesn't pass through a firewall.
>
> Please correct me if I am wrong.  Thank you.
>
> --- Harry Hoffman <hhoffman () ip-solutions net> wrote:
>
> > yep, unfortunately not enough people using host
> > based firewalls and alot 
> > of attacks happen inside of where the firewall
> > protects (i.e. local lan)
> >
> > seclt yuri wrote:
> > > Hi,
> > >   I was just reading up on fragmentation attacks
> > using
> > > fragrouter and fragrouter as a mean of IDS/IPS
> > > evasion.  However, since almost all firewalls both
> > > commercial and free (iptables for examples) now
> > have
> > > support for fragment reassembly, are fragmentation
> > > attacks still effective?  Thanks.
> > >
> > >
> > >        
> ____________________________________________________________________________________
> > > Need a vacation? Get great deals
> > > to amazing places on Yahoo! Travel.
> > > http://travel.yahoo.com/
> ------------------------------------------------------------------------
> > > This list is sponsored by: Cenzic
> > >
> > > Need to secure your web apps NOW?
> > > Cenzic finds more, "real" vulnerabilities fast.
> > > Click to try it, buy it or download a solution
> > FREE today!
> > > http://www.cenzic.com/downloads
> ------------------------------------------------------------------------
> >
> ------------------------------------------------------------------------
> > This list is sponsored by: Cenzic
> >
> > Need to secure your web apps NOW?
> > Cenzic finds more, "real" vulnerabilities fast.
> > Click to try it, buy it or download a solution FREE
> > today!
> >
> > http://www.cenzic.com/downloads
> ------------------------------------------------------------------------
> >
>
>
>
>       ____________________________________________________________________________________
> Fussy? Opinionated? Impossible to please? Perfect.  Join Yahoo!'s user panel and lay it on us. http://surveylink.yahoo.com/gmrs/yahoo_panel_invite.asp?a=7 

------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------