Hi, Oops... This does show a point I missed (probably one of many). Any smidgen of intelligence in a network device may be exploitable. >From that, I'd add to the list something like: Harden each device - In the devices that have intelligence, (Unix, NT, etc.), and in your network devices (router, switch, hub) reduce the interfaces that are available (telnet, ftp, SNMP, finger, echo/ip, timestamp/ip, discard/ip, bootp, etc.) to only those service interfaces that you will want to present to the untrusted network. This may mean eliminating the ftp service from the web server which may mean that it is difficult to update the content. Bummer - your choice; safe or easy. Extrapolating from what Adam wrote, I'd suggest you know (or find) the entry points to each device and decide it they're safe or not. "Safe" being a term relative to your context. If they're just not needed, eliminate them. I'm sure there are many more types of malicious attacks on switches that I'll be learning about in the coming months... ;-) Thanks for the pointer. Good luck, Chris ---various stuff deleted for brevity, except--- At 03:57 PM 4/10/98 -0400, Adam Shostack wrote: >Eric Vyncke wrote: >| At 08:56 10/04/98 -0400, Adam Shostack wrote: >| > I hate to spread FUD, but last summer at Black Hat Briefings, >| >I asked a panel which included Mudge, route, Artimage, and a number of >| >other smart hackers about the next big type of attack, now that buffer >| >overflows and misconfigurations are commonplace. >| > >| > There were a couple of confident replies that switching >| >technology only works until you subject it to malicious attack, and >| >then all sorts of interesting things can be made to happen. >| > >| > This jibes with my experience, which is that technologies not >| >designed for security don't provide security, and that technologies >| >not designed to resist malicious attacks don't resist malicious >| >attacks. >| > >| > So, if you choose to rely on a switch, ask your vendor for >| >their test results from when they maliciously attacked it. Adjust >| >your trust levels accordingly. And deploy IPsec. >| > >| >Adam
This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 12:54:09 PDT