[Full-disclosure] Sony: No firewall and no patches
Thor (Hammer of God)
thor at hammerofgod.com
Tue May 10 16:45:14 BST 2011
> On May 10, 2011, at 4:42 PM, Pete Smith wrote:
> > if an attacker initiates a connection dest port higher than 2048 (to some
> other server the attacker controls) and source port of 80 that will pass
> through an ACL without issues, this would not be so on a stateful firewall.
> If the attacker's in a position to generate an outbound connection sourced
> from a well-known port (which presumably is supposed to have an httpd
> attached to it), there's nothing a stateful firewall can do to improve matters.
You can if you require authentication, which I do even here at the HoG labs. Well, except for rules specifically created for other devices such as, ironically, my PS3. :)
Mike Kaeo's presentation is interesting, and certainly has merit where it applies - but saying "stateful firewalls have no place in front of servers" is far too generic of a statement. There are any number of topological deployment scenarios where firewalls certainly provide security in depth and added security, irrespective of what Mr. Kaeo's opinion on the matter is. If one can design a secure access model using router ACLs then right on, but that doesn't mean that other models don't work.
I'm unclear as what you mean by "no state to inspect in the first place" in regard to firewalls in front of servers - my TMG box most certainly inspects state when I access assets via the firewall. I think I know what you really meant by that statement, but can you explain your point a bit more? I want to make sure I'm not missing something.
Full-Disclosure is hosted and sponsored by Secunia.