RE: Linux vs Windows Firewalls

It is an interesting feature you are talking about, but
I wonder about how logic of this comment actually support 
the usefulness of this feature.

>Is it possible that the only reason this exploit 
>as not yet taken off is that Linux does not have enough market 
>share to be *worth* attacking in bulk, but that someday it possibly 
>might (if you took out 1% of the world's computers, would anyone 
>even notice)?

While Linux may be 1% of the total worlds computing resources,
(according to Netcraft) Apache (normally run on Linux) is at least 60%
of the publicly available web servers on the Internet. From this I believe we can draw the following conclusions:

>(if you took out 1% of the world's computers, would anyone 
>even notice)?
1) Yes, when at least 60% of all the web servers on the Internet are down, then
then would be something to the news media. 
http://news.netcraft.com/archives/web_server_survey.html
Also the following web sites are on Linux as per Netcraft:
Drudgereport: http://uptime.netcraft.com/up/graph?site=www.drudgereport.com
Slashdot: http://uptime.netcraft.com/up/graph?site=slashdot.com
Google: http://uptime.netcraft.com/up/graph?site=www.google.com
If you think no one would miss these sites, then you have no idea how popular they are.


2) Being that some of the most popular web sites on the Internet run Linux, which
makes statically opened ports readily available to anyone and these sites have very few
intrusions (slashdot was compromised once, Google is so large an redundant that I doubt
any client would notice an intrusion) it maybe that your concept of the problem is 
ill-conceived. In other words you are crafting a vulnerability were none exists.


>Correct, protection by filename alone is not security.  However, my 
>firewall in Windows does compare the file itself using a given name 
>to what it registered when the firewall rule was written.

I have a question which might shed light on where you are coming from.
Does this Firewall protect an entire network, or is it running as
a personal firewall for one machine ?

It sounds like a personal firewall for one machine. Since you are talking about
how the firewall look at what programs are registered (read that as installed)
and then matches the processes into it's state table. It would be interesting to
see if this "feature" works for machines behind the Windows firewall. It would also
be interesting to see how easy it would be to manipulate (try fool) the firewall
when it tries to get involved with this kind of Meta-info.
From what I see in this URL: it looks like Windows Firewall is just a personal firewall
since it can be exploited with IPV6 traffic.
http://support.microsoft.com/default.aspx?scid=kb;EN-US;Q306203

The reason I ask it that the firewall for Linux (Netfilter) was made to protect networks.
Yes it is also used as a personal firewall, but it is also a NAT/Firewall/lightweight router.
With patches Netfilter can also be built into a bridge/firewall (undetectable from attackers).
They HoneyNet project uses this (they call it a Honeywall) to monitor attacker activity without
the attacker knowing. So let's start trying to compare Apples to Apples and I think
we can make more progress on this list.

Alan




-----Original Message-----
From: annoyances-admin-DzJonyRHso41Ayx8vbq1stBPR1lH4CV8@public.gmane.org
[mailto:annoyances-admin-DzJonyRHso41Ayx8vbq1stBPR1lH4CV8@public.gmane.org]On Behalf Of PK Carlisle
Sent: Wednesday, September 10, 2003 4:24 PM
To: [email protected]
Subject: Re: [Annoyances] Linux vs Windows Firewalls


Correct, protection by filename alone is not security.  However, my 
firewall in Windows does compare the file itself using a given name 
to what it registered when the firewall rule was written.  Once I did 
have to reinstall my browser and the firewall told me that the 
program it understood to have that filename had been replaced and 
what did I want to do about it, so more than filename and directory 
is used in the comparison.  Similarly your virus named svchost.exe 
would cause an alert as it's a replacement file.

I agree that using Outlook, Active X over the net, and executing 
unknown executables is a foolish practice, and I already do none of 
the above / block all of the above in Windows.  

My question revolves around products like RealMedia, etc.  If one of 
these programs uses a commonly used (and so opened) port, 
allowing access by port alone allows these applications to report 
back ... anything they like, and not all programs tell you that they do 
this (Netscape 6 tries to communicate with Netscape's servers 
each time the browser is launched without telling the user).  Also, by 
running a piece of software like Real or Netscape, I in effect initiate 
the communication (whether the programs tells me it's 
communicating or not) so that would slip through a firewall as you 
describe it.

It -is- nice that a virus or data miner can only access my login 
account, but I guess it seems little comfort considering what 
programs want to store and send.  Linux appears to be wide open 
to this exploitation.   Is it possible that the only reason this exploit 
has not yet taken off is that Linux does not have enough market 
share to be *worth* attacking in bulk, but that someday it possibly 
might (if you took out 1% of the world's computers, would anyone 
even notice)?

Somebody mentioned GID matching to compare files in Linux.  MY 
QUESTION IS THIS: Does this GID matching also *selectively 
allow* access or does it just *report* attempted replacements??

(Please explain in concepts rather than Linux  procedures-- I'm new 
to Linux!)


> Date: Wed, 10 Sep 2003 10:50:02 -0400
> From: Lawrence MacIntyre <[email protected]>
> Subject: Re: [Annoyances] Linux vs Windows Firewalls
> To: [email protected]
> Organization: High Performance Information Infrastructure Group
> Reply-To: [email protected]
>
> So if I name my worm svchost.exe, the MS firewall will allow it to use
> your interface, but if I foolishly name it myworm.exe, it won't.  That
> doesn't buy you much security.  Firewalls must use ports, addresses,
> and protocol elements to be effective.  Filenames don't provide any
> meaningful security.
> 
> Filenames are simpler for users to understand, but unfortunately for
> them, not really effective means of protecting their machines.  You
> are much safer with the RedHat Linux default installation, which
> basically allows anything outgoing and nothing incoming except for DNS
> and responses to connections initiated by the local machine.
> 
> Remember that Linux doesn't have Outlook so the danger of executing
> random executables that have been received in email is only as great
> as the liklihood that the user will save and execute the file
> manually.=20 Also activeX doesn't work on any Linux browsers, so that
> mass of security holes isn't present either.  Assuming that the user
> doesn't log in as root, any worm or virus that might be written for
> Linux can only infect that user's files.  It can't affect the OS or
> other users.
> 
> On Wed, 2003-09-10 at 10:10, PK Carlisle wrote:
> > Care to add some substance regarding HOW I'm wrong? =20
> > Precisely how, given the limitation in the Linux firewall pointed
> > out,=20 is Linux to be made more secure?  Opening a port to every=20
> > program that wants to communicate over that port seems sloppy=20 and
> > risky.





------------------------ 

But nobody did come, because nobody does.... - Thomas Hardy, Jude the Obscure 


Earthlink, AOL, Yahoo & MSN/Hotmail IM: mrgoodbytesim  ICQ:13418006
PGP Public Key: http://home.earthlink.net/~mrgoodbytes/pkpubpgp.asc
VOX: 708-296-2466  FAX: 708-452-8594 


_______________________________________________
annoyances mailing list
[email protected]
http://michelangelo.renaissoft.com/mailman/listinfo/annoyances