Thread View: at.mail.firewalls
1 messages
1 total messages
Started by Gordon LaSane
Wed, 15 Apr 1998 00:00
RE: fw-1 stateful inspection vulnerabilities
Author: Gordon LaSane
Date: Wed, 15 Apr 1998 00:00
Date: Wed, 15 Apr 1998 00:00
536 lines
26845 bytes
26845 bytes
This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. ------ =_NextPart_001_01BD6483.EF7D6360 Content-Type: text/plain; charset="iso-8859-1" I found this article from the newsletter published by Secure Computing Corp. to be helpful in comparing stateful inspection and application gateways. Application Gateways vs. Stateful Packet Filters By Dr. Richard E. Smith About the author: Dr. Smith is a principal security architect for Secure Computing Corporation. His recent book, "Internet Cryptography" was published last summer by Addison Wesley. Today's major firewalls are often classified in two major categories: application gateways and stateful packet filters. Secure Computing's firewall products have always been application gateways, which are inherently safer both in theory and in practice. This article provides a brief overview of each of these methods and a comparison of the features offered by both the application gateway firewall and the stateful packet filtering firewall. Background Before comparing the two, it is helpful to have an understanding of the original design concept behind each methodology. Application gateways- the application gateway was designed with the assumption that no traffic should pass between the internal and external networks unless the traffic is specifically allowed. For example, a data packet is not allowed to enter your site unless it is a certain type of traffic you have specifically stated that you want. These devices are called "application gateways" because they incorporate special packages to handle each Internet application protocol. Application gateways recognize messages that belong specifically to that protocol and reject all others. Stateful packet filtering- this technology evolved from basic packet filtering, which is arguably the oldest firewall technique. Packet filtering itself is a very simple technology that is still widely used. It is founded on the notion of looking at individual Internet packets and rejecting any packets that look unacceptable. Products with a "built in firewall" capability often provide a crude packet filtering capability and nothing else. An important strength of packet filtering is in its speed: it is very easy to look at individual packets and pass simple judgement based on specific packet contents. But the packet filter's weakness is in its simplicity: not all security questions about an individual packet can be answered by looking at that specific packet by itself. Stateful packet filtering was developed as a technique to sidestep the problems with basic packet filtering. Unlike a simple packet filter, a stateful filter maintains information about connections and, in some cases, about application level activities. In practice, such devices can provide similar features to circuit filters (a device that passes a connection from a client on one side of the firewall to a server on the other) and some of the features of application gateways. However, stateful filtering generally falls short of application gateways. Feature comparison The following is a comparison of how the features of the application gateway stack up against the features offered by the stateful packet filtering firewall. We believe the results speak for themselves: Feature 1: All messages not belonging to approved Internet applications are rejected. Application gateway - YES The only messages entering or leaving the site are part of an approved application protocol. Spurious, unrecognizable packets are discarded. Stateful packet filter - NO All packet filters, including stateful ones, contain the essential machinery necessary to pass any packet between the inside and outside networks. If an error is made in the filtering rules, either by the manufacturer or by the site, then some unintended messages may pass through. In practice, this technique has proven itself unreliable. Feature 2: All messages that violate applications format requirements are rejected. Application gateway - YES Application specific software examines the incoming messages and can reject messages in suspicious or improper formats. These blocks a variety of attacks based on improper packet formatting. For example, many types of buffer overrun attacks and email attacks that are based on peculiar address formatting can be blocked. Stateful packet filter - MAYBE Stateful packet filters can collect information from a series of packets, laboriously reconstruct application messages, and make filtering decisions on the result. This is a relatively complicated and error prone process. This technique cannot be used to easily and systematically verify a broad range of application protocol formats. In practice, it has proven itself unreliable. Feature 3: Existing identification information is used in application protocols. Application gateway - YES The gateway software can extract user names embedded in application protocol messages and use those names to make access control decisions. This can reduce the number of separate sign-ons a user must perform and an administrator must maintain. Stateful packet filter - NO Although it may be possible to do this in conjunction with some part of application format checking, this feature is never provided using stateful packet filtering. Typically, stateful packet filters provide user authentication via a separate login client that associates user identity with the client's Internet address. This requires a separate set of authentication services and credentials. Feature 4: Traffic control can be application specific. Application gateway - YES For example, file transfer users can be restricted to only reading or writing files. Web users can be restricted from accessing particular URLs or from downloading specific content types like Java applets. Stateful packet filter - MAYBE Stateful filters can do this in conjunction with application format checking. However, these capabilities suffer the same shortcomings as noted for stateful packet filters in Feature 3 above. Feature 5: Portable, standard packages can be used for application filtering. Application gateway - YES Application gateway software is usually based on the standard "socket" interface available in typical operating systems. This allows gateway products developed for "toolbox" firewalls to be integrated into high-end firewalls like the Borderware firewall and Sidewinder Security Server that are based on customized, high security operating systems. The software packages that handle specific protocols are often called application proxies. Commercial application gateways generally provide an extensive suite of proxies. However, the benefits of application proxies are only available if an application proxy has been produced for the particular Internet protocols that a specific site needs. If a site must use a protocol for which no proxy is available, the site will need to rely on a "generic" proxy capability to pass that protocol through the firewall. A "generic proxy" allows any identifiable protocol to traverse the firewall while still blocking unrecognized packets and undesired protocols. This is usually based in the "circuit filter" technique. A circuit filter is a device that passes a connection from a client on one side of the firewall to a server on the other. For example, a site might need to allow outbound telnet connections, so the circuit filter will accept outbound telnet connection requests to port 23, the Telnet connection port. The circuit filter accepts the connection on the inside and echoes it on the outside, addressing the server selected by the inside client. Traffic flowing in either direction is handled inside the firewall on behalf of the circuit set up for that particular connection. The internal connection is often referred to as a proxy for the external connection. Stateful packet filter - NO Stateful filtering is not based on the standard "socket" interface. Instead, it uses a radically different "event driven" mechanism to collect information and apply filtering rules. Because of this, standard packages for application filtering do not fit directly into a stateful filtering environment. In conclusion As the benefits of application filtering have proven themselves in real world operations, products based on stateful packet filtering have begun to integrate application gateway capabilities. Unfortunately, the underlying packet filtering mechanisms remain, bringing with them inevitable leakage problems. The essential benefit of a strong application gateway is that it only passes the traffic specifically required by the site. There is no other path into the site for the undesired traffic, and there is no underlying weakness in the design concept that may allow low level traffic to sneak through. Gordon LaSane Global Data Systems, Inc. Internet and Intranet Firewalls and Security Group Consulting and Installing Solutions for Your Company's Data Security: Remote User Authentication Internet Access Virtual Private Networks Web Filtering Intranets Firewalls Gordon LaSane 781/740-8818 x13 ph 781/740-8830 fax glasane@gdsconnect.com <mailto:glasane@gdsconnect.com> -----Original Message----- From: Bill Coutinho [mailto:bill@dextra.com.br] Sent: Thursday, April 09, 1998 4:17 PM To: Bennett Todd Cc: firewalls@GreatCircle.COM; alien@netcomuk.co.uk Subject: Re: fw-1 stateful inspection vulnerabilities Bennett Todd <bet@rahul.net> wrote: > ``Stateful inspection'' is an interesting hack. In theory it can do > amazing things. Of course, the difference between theory and practice is > a lot bigger in practice than it is in theory. > [...] At last, one concise, clear and straightforward vision of "stateful inspection" shortcomings. Congratulations! -- Cheers, Bill. _________________________________________________________________ B i l l C o u t i n h o mailto:bill@dextra.com.br PGP Public Key at: http://www.correionet.com.br/~bill/pgpkey.asc ------ =_NextPart_001_01BD6483.EF7D6360 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN"> <HTML> <HEAD> <META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; = charset=3Dus-ascii"> <META NAME=3D"Generator" CONTENT=3D"MS Exchange Server version = 5.0.1460.9"> <TITLE>RE: fw-1 stateful inspection vulnerabilities</TITLE> </HEAD> <BODY> <P><FONT SIZE=3D2 FACE=3D"Arial">I found this article from the = newsletter published by Secure Computing Corp. to be helpful in = comparing stateful inspection and application gateways. </FONT></P> <P><B><FONT SIZE=3D5 FACE=3D"Arial">Application Gateways vs. Stateful = Packet Filters</FONT></B> <BR><I><FONT SIZE=3D2 FACE=3D"Verdana">By Dr. Richard E. = Smith</FONT></I> <BR><B><I><FONT SIZE=3D2 FACE=3D"Arial">About the = author:</FONT></I></B><I><FONT SIZE=3D2 FACE=3D"Arial"> Dr. Smith is a = principal security architect for Secure Computing Corporation. His = recent book, "Internet Cryptography" was published last = summer by Addison Wesley.</FONT></I></P> <P><FONT SIZE=3D2 FACE=3D"Arial">Today's major firewalls are often = classified in two major categories: application gateways and stateful = packet filters. Secure Computing's firewall products have always been = application gateways, which are inherently safer both in theory and in = practice. This article provides a brief overview of each of these = methods and a comparison of the features offered by both the = application gateway firewall and the stateful packet filtering = firewall.</FONT></P> <P><B>Background</B> <BR><FONT SIZE=3D2 FACE=3D"Arial">Before comparing the two, it is = helpful to have an understanding of the original design concept behind = each methodology.</FONT></P> <P><B><FONT SIZE=3D2 FACE=3D"Arial">Application = gateways-</FONT></B><FONT SIZE=3D2 FACE=3D"Arial"> the application = gateway was designed with the assumption that no traffic should pass = between the internal and external networks unless the traffic is = specifically allowed.</FONT><FONT SIZE=3D2 FACE=3D"Arial"></FONT> <FONT = SIZE=3D2 FACE=3D"Arial">For example, a data packet is not allowed to = enter your site unless it is a certain type of traffic you have = specifically stated that you want. These devices are called = "application gateways" because they incorporate special = packages to handle each Internet application protocol. = Application gateways recognize messages that belong specifically to = that protocol and reject all others.</FONT></P> <P><B><FONT SIZE=3D2 FACE=3D"Arial">Stateful packet = filtering-</FONT></B><FONT SIZE=3D2 FACE=3D"Arial"> this technology = evolved from basic packet filtering, which is arguably the oldest = firewall technique. Packet filtering itself is a very simple = technology that is still widely used. It is founded on the notion of = looking at individual Internet packets and rejecting any packets that = look unacceptable. Products with a "built in firewall" = capability often provide a crude packet filtering capability and = nothing else. An important strength of packet filtering is in its = speed: it is very easy to look at individual packets and pass simple = judgement based on specific packet contents. But the packet filter's = weakness is in its simplicity: not all security questions about an = individual packet can be answered by looking at that specific packet by = itself. Stateful packet filtering was developed as a technique to = sidestep the problems with basic packet filtering. Unlike a simple = packet filter, a stateful filter maintains information about = connections and, in some cases, about application level activities. In = practice, such devices can provide similar features to circuit filters = (a device that passes a connection from a client on one side of the = firewall to a server on the other) and some of the features of = application gateways. However, stateful filtering generally falls short = of application gateways.</FONT></P> <P><B>Feature comparison</B> <BR><FONT SIZE=3D2 FACE=3D"Arial">The following is a comparison of how = the features of the application gateway stack up against the features = offered by the stateful packet filtering firewall. We believe the = results speak for themselves:</FONT></P> <P><B><FONT SIZE=3D2 FACE=3D"Arial">Feature 1: All messages not = belonging to approved Internet applications are rejected.</FONT></B> <BR><B><FONT SIZE=3D4>Application gateway - YES</FONT></B> <BR><FONT SIZE=3D2 FACE=3D"Arial">The only messages entering or leaving = the site are part of an approved application protocol. Spurious, = </FONT><A NAME=3D"_Hlt410726318"></A><FONT SIZE=3D2 = FACE=3D"Arial">unrecognizable packets are discarded.</FONT></P> <P><B><FONT SIZE=3D4>Stateful packet filter - NO</FONT></B> <BR><FONT SIZE=3D2 FACE=3D"Arial">All packet filters, including = stateful ones, contain the essential machinery necessary to pass any = packet between the inside and outside networks. If an error is made in = the filtering rules, either by the manufacturer or by the site, then = some unintended messages may pass through. In practice, this technique = has proven itself unreliable.</FONT></P> <BR> <P><B><FONT SIZE=3D2 FACE=3D"Arial">Feature 2: All messages that = violate applications format requirements are rejected.</FONT></B> <BR><B><FONT SIZE=3D4>Application gateway - YES</FONT></B> <BR><FONT SIZE=3D2 FACE=3D"Arial">Application specific software = examines the incoming messages and can reject messages in suspicious or = improper formats. These blocks a variety of attacks based on improper = packet formatting. For example, many types of buffer overrun attacks = and email attacks that are based on peculiar address formatting can be = blocked.</FONT></P> <P><B><FONT SIZE=3D4>Stateful packet filter - MAYBE</FONT></B> <BR><FONT SIZE=3D2 FACE=3D"Arial">Stateful packet filters can collect = information from a series of packets, laboriously reconstruct = application messages, and make filtering decisions on the result. This = is a relatively complicated and error prone process. This technique = cannot be used to easily and systematically verify a broad range of = application protocol formats. In practice, it has proven itself = unreliable.</FONT></P> <BR> <P><B><FONT SIZE=3D2 FACE=3D"Arial">Feature 3: Existing identification = information is used in application protocols.</FONT></B> <BR><B><FONT SIZE=3D4>Application gateway - YES</FONT></B> <BR><FONT SIZE=3D2 FACE=3D"Arial">The gateway software can extract user = names embedded in application protocol messages and use those names to = make access control decisions. This can reduce the number of separate = sign-ons a user must perform and an administrator must = maintain.</FONT></P> <P><B><FONT SIZE=3D4>Stateful packet filter - NO</FONT></B> <BR><FONT SIZE=3D2 FACE=3D"Arial">Although it may be possible to do = this in conjunction with some part of application format checking, this = feature is never provided using stateful packet filtering. Typically, = stateful packet filters provide user authentication via a separate = login client that associates user identity with the client's Internet = address. This requires a separate set of authentication services and = credentials.</FONT></P> <BR> <P><B><FONT SIZE=3D2 FACE=3D"Arial">Feature 4: Traffic control can be = application specific.</FONT></B> <BR><B><FONT SIZE=3D4>Application gateway - YES</FONT></B> <BR><FONT SIZE=3D2 FACE=3D"Arial">For example, file transfer users can = be restricted to only reading or writing files. Web users can be = restricted from accessing particular URLs or from downloading specific = content types like Java applets.</FONT></P> <P><B><FONT SIZE=3D4>Stateful packet filter - MAYBE</FONT></B> <BR><FONT SIZE=3D2 FACE=3D"Arial">Stateful filters can do this in = conjunction with application format checking. However, these = capabilities suffer the same shortcomings as noted for stateful packet = filters in Feature 3 above.</FONT></P> <BR> <BR> <BR> <BR> <BR> <BR> <P><B><FONT SIZE=3D2 FACE=3D"Arial">Feature 5: Portable, standard = packages can be used for application filtering.</FONT></B> <BR><B><FONT SIZE=3D4>Application gateway - YES</FONT></B> <BR><FONT SIZE=3D2 FACE=3D"Arial">Application gateway software is = usually based on the standard "socket" interface available in = typical operating systems. This allows gateway products developed for = "toolbox" firewalls to be integrated into high-end firewalls = like the Borderware firewall and Sidewinder Security Server that are = based on customized, high security operating systems. The = software packages that handle specific protocols are often called = application proxies. Commercial application gateways generally provide = an extensive suite of proxies. However, the benefits of application = proxies are only available if an application proxy has been produced = for the particular Internet protocols that a specific site needs. If a = site must use a protocol for which no proxy is available, the site will = need to rely on a "generic" proxy capability to pass that = protocol through the firewall. A "generic proxy" allows any = identifiable protocol to traverse the firewall while still blocking = unrecognized packets and undesired protocols. This is usually based in = the "circuit filter" technique. A circuit filter is a device = that passes a connection from a client on one side of the firewall to a = server on the other. For example, a site might need to allow outbound = telnet connections, so the circuit filter will accept outbound telnet = connection requests to port 23, the Telnet connection port. The circuit = filter accepts the connection on the inside and echoes it on the = outside, addressing the server selected by the inside client. Traffic = flowing in either direction is handled inside the firewall on behalf of = the circuit set up for that particular connection. The internal = connection is often referred to as a proxy for the external = connection.</FONT></P> <P><B><FONT SIZE=3D4>Stateful packet filter - NO</FONT></B> <BR><FONT SIZE=3D2 FACE=3D"Arial">Stateful filtering is not based on = the standard "socket" interface. Instead, it uses a radically = different "event driven" mechanism to collect information and = apply filtering rules. Because of this, standard packages for = application filtering do not fit directly into a stateful filtering = environment.</FONT></P> <P><B>In conclusion</B> <BR><FONT SIZE=3D2 FACE=3D"Arial">As the benefits of application = filtering have proven themselves in real world operations, products = based on stateful packet filtering have begun to integrate application = gateway capabilities. Unfortunately, the underlying packet filtering = mechanisms remain, bringing with them inevitable leakage = problems.</FONT><FONT SIZE=3D2 FACE=3D"Arial"></FONT> <FONT SIZE=3D2 = FACE=3D"Arial">The essential benefit of a strong application gateway is = that it only passes the traffic specifically required by the site. = There is no other path into the site for the undesired traffic, and = there is no underlying weakness in the design concept that may allow = low level traffic to sneak through. </FONT></P> <BR> <UL> <P><FONT SIZE=3D2 FACE=3D"Arial">Gordon LaSane</FONT> </P> <P><B><U><FONT SIZE=3D2 FACE=3D"Arial">Global Data Systems, = Inc</FONT></U></B><FONT SIZE=3D2 FACE=3D"Arial">.</FONT> <BR><B><FONT SIZE=3D2 FACE=3D"Times New Roman">Internet and Intranet = Firewalls and Security Group</FONT></B> <BR><B><I><FONT SIZE=3D2 FACE=3D"Times New Roman">Consulting and = Installing Solutions for Your Company's Data = Security</FONT></I></B><B><I></I></B><B><I><FONT SIZE=3D2 FACE=3D"Times = New Roman">:</FONT></I></B> <BR><B><I><FONT SIZE=3D2 FACE=3D"Times New Roman">Remote User = Authentication</FONT></I></B> <BR><B><I><FONT SIZE=3D2 FACE=3D"Times New Roman">Internet = Access</FONT></I></B> <BR><B><I><FONT SIZE=3D2 FACE=3D"Times New Roman">Virtual Private = Networks</FONT></I></B> <BR><B><I><FONT SIZE=3D2 FACE=3D"Times New Roman">Web = Filtering</FONT></I></B> <BR><B><I><FONT SIZE=3D2 FACE=3D"Times New = Roman">Intranets</FONT></I></B> <BR><B><I><FONT SIZE=3D2 FACE=3D"Times New = Roman">Firewalls</FONT></I></B> =20 <BR> =20 <BR><B><FONT SIZE=3D2 FACE=3D"Arial">Gordon LaSane</FONT></B> <BR><B><FONT SIZE=3D2 FACE=3D"Arial">781/740-8818 x13 ph</FONT></B> <BR><B><FONT SIZE=3D2 FACE=3D"Arial">781/740-8830 fax</FONT></B> </P> <P><A HREF=3D"mailto:glasane@gdsconnect.com"><U><FONT COLOR=3D"#0000FF" = SIZE=3D2 FACE=3D"Arial">glasane@gdsconnect.com</FONT></U></A> </P> <BR> <BR> <BR> <UL> <P><A NAME=3D"_MailData"><FONT SIZE=3D2 FACE=3D"Arial">-----Original = Message-----</FONT></A> <BR><B><FONT SIZE=3D2 FACE=3D"Arial">From: Bill Coutinho = [<A HREF=3D"mailto:bill@dextra.com.br" = TARGET=3D"_blank">mailto:bill@dextra.com.br</A>]</FONT></B> <BR><B><FONT SIZE=3D2 FACE=3D"Arial">Sent: </FONT></B> <FONT = SIZE=3D2 FACE=3D"Arial">Thursday, April 09, 1998 4:17 PM</FONT> <BR><B><FONT SIZE=3D2 = FACE=3D"Arial">To: </FONT></B> <FONT SIZE=3D2 = FACE=3D"Arial">Bennett Todd</FONT> <BR><B><FONT SIZE=3D2 = FACE=3D"Arial">Cc: </FONT></B> <FONT SIZE=3D2 = FACE=3D"Arial">firewalls@GreatCircle.COM; alien@netcomuk.co.uk</FONT> <BR><B><FONT SIZE=3D2 = FACE=3D"Arial">Subject: </FONT>= </B> <FONT SIZE=3D2 FACE=3D"Arial">Re: fw-1 stateful inspection = vulnerabilities</FONT> </P> <P><FONT SIZE=3D2 FACE=3D"Arial">Bennett Todd <bet@rahul.net> = wrote:</FONT> </P> <P><FONT SIZE=3D2 FACE=3D"Arial">> ``Stateful inspection'' is an = interesting hack. In theory it can do</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial">> amazing things. Of course, the = difference between theory and practice is</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial">> a lot bigger in practice than it = is in theory.</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial">> [...]</FONT> </P> <P><FONT SIZE=3D2 FACE=3D"Arial">At last, one concise, clear and = straightforward vision of "stateful</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial">inspection" shortcomings. = Congratulations!</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial">-- </FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial">Cheers,</FONT> <BR><FONT SIZE=3D2 FACE=3D"Arial">Bill.</FONT> <BR><FONT SIZE=3D2 = FACE=3D"Arial">_________________________________________________________= ________</FONT> <BR><FONT SIZE=3D2 = FACE=3D"Arial"> &nb= sp; &nb= sp; &nb= sp; B i l l C o u t i n h = o</FONT> <BR><FONT SIZE=3D2 = FACE=3D"Arial"> &nb= sp; &nb= sp; &nb= sp; <A HREF=3D"mailto:bill@dextra.com.br" = TARGET=3D"_blank">mailto:bill@dextra.com.br</A></FONT> </P> <P><FONT SIZE=3D2 FACE=3D"Arial">PGP Public Key at: <A = HREF=3D"http://www.correionet.com.br/~bill/pgpkey.asc" = TARGET=3D"_blank">http://www.correionet.com.br/~bill/pgpkey.asc</A></FON= T> </P> </UL></UL> </BODY> </HTML> ------ =_NextPart_001_01BD6483.EF7D6360--
Thread Navigation
This is a paginated view of messages in the thread with full content displayed inline.
Messages are displayed in chronological order, with the original post highlighted in green.
Use pagination controls to navigate through all messages in large threads.
Back to All Threads