RE: Are Fragmentation Attacks Still Used for IDS/IPS Evasion?

["Shenk, Jerry A" <jshenk () decommunications com>]

Well, like almost any security vulnerability, attacks against it are
useless unless it works!  There are all kinds of "old attacks" that end
up being valid attack vectors all the time.  You have no idea if people
have designed the network you are testing correctly or not.

One other point here - fragmentation attacks and what can get as a
result is something that you might want to test in your lab.  If you
test it in a controlled environment, you will be better able to know if
it's working and what you can expect to gain when you use it in the
field.

-----Original Message-----
From: listbounce () securityfocus com [mailto:listbounce () securityfocus com]
On Behalf Of seclt yuri
Sent: Tuesday, September 25, 2007 10:29 PM
To: Harry Hoffman
Cc: pen-test () securityfocus com
Subject: Re: Are Fragmentation Attacks Still Used for IDS/IPS Evasion?

Yes but this effectively means that fragmentation
attacks are useless if launched across the 'Net and
when performing a penetration test without local
access.

Also, even internal host systems are usually
segregated from servers and server vlans by a
firewall, so even then, I can't see how fragmentation
attacks would be effective.  The only scenario that I
can think of would be within the same subnet or vlan
where traffic doesn't pass through a firewall.

Please correct me if I am wrong.  Thank you.

--- Harry Hoffman <hhoffman () ip-solutions net> wrote:

> yep, unfortunately not enough people using host
> based firewalls and alot 
> of attacks happen inside of where the firewall
> protects (i.e. local lan)
>
> seclt yuri wrote:
> > Hi,
> >   I was just reading up on fragmentation attacks
> using
> > fragrouter and fragrouter as a mean of IDS/IPS
> > evasion.  However, since almost all firewalls both
> > commercial and free (iptables for examples) now
> have
> > support for fragment reassembly, are fragmentation
> > attacks still effective?  Thanks.
> >
> >
> >        
________________________________________________________________________
____________
> > Need a vacation? Get great deals
> > to amazing places on Yahoo! Travel.
> > http://travel.yahoo.com/
------------------------------------------------------------------------
> > This list is sponsored by: Cenzic
> >
> > Need to secure your web apps NOW?
> > Cenzic finds more, "real" vulnerabilities fast.
> > Click to try it, buy it or download a solution
> FREE today!
> > http://www.cenzic.com/downloads
------------------------------------------------------------------------
> >
------------------------------------------------------------------------
> This list is sponsored by: Cenzic
>
> Need to secure your web apps NOW?
> Cenzic finds more, "real" vulnerabilities fast.
> Click to try it, buy it or download a solution FREE
> today!
>
> http://www.cenzic.com/downloads
------------------------------------------------------------------------
>



 
________________________________________________________________________
____________
Fussy? Opinionated? Impossible to please? Perfect.  Join Yahoo!'s user
panel and lay it on us.
http://surveylink.yahoo.com/gmrs/yahoo_panel_invite.asp?a=7 



------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------



**DISCLAIMER
This e-mail message and any files transmitted with it are intended for the use of the individual or entity to which 
they are addressed and may contain information that is privileged, proprietary and confidential. If you are not the 
intended recipient, you may not use, copy or disclose to anyone the message or any information contained in the 
message. If you have received this communication in error, please notify the sender and delete this e-mail message. The 
contents do not represent the opinion of D&E except to the extent that it relates to their official business.


------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------