On 26 Mar 96 at 19:57, Frank O'Dwyer wrote concerning
CloakingSoftware(tm)
>
> > This makes them more vulnerable by
> > definition (they can be "seen" by the network components on the trusted and
> > untrusted sides). A properly configured transparent MS-DOS firewall without
> > an actual IP stack is simply not as vulnerable - you can't see it and you
> > can't attack it in traditional manner(s) in which firewall systems are
> > attacked, including those based on NT and W95.
>
> Again I must take issue with this 'you can't see it, so it's not
> as vulnerable as visible systems' suggestion. It just isn't so,
> and I think I can prove it. Consider:
>
> If invisibility is so good, why stop with the firewall? Make ALL your
> hosts invisible, then you won't even need a firewall. Here's how
> you do it: Simply put an extra network card in all of your hosts, and put
> my CloakingDevice(tm) ($100 to you :-) behind (yes, behind) each host.
> You'll need to replace your host stack with my CloakingSoftware(tm) too, of
> course, but we'll come back to that.
>
> What the CloakingDevice does is very simple. A dedicated piece of
> miniaturised hardware like a T-shaped terminator, it assumes your host's
> current IP address and responds to every packet directed at it with
> 'host unreachable'. Obviously, you can't attack the CloakingDevice,
> since it does hardly anything and runs no services and no OS. Just
> enough to respond 'host unreachable', nothing else.
>
> The really clever part is my CloakingSoftware, which runs on
> each of your hosts and only costs $200 for a single user licence.
> (Pretty cheap, since it obliterates all your security worries. :-)
> The CloakingSoftware runs in kernel mode and bridges ALL packets
> to the CloakingDevice behind it. The CloakingDevice responds with
> host unreachable (what else?) and this response is also bridged on
> the way back by the CloakingSoftware, which examines the response
> prior to bridging it.
>
> Now because the CloakingSoftware is a super smart bridge and thus
> stateful, it knows just how to rewrite the host unreachable packet so
> that it appears just like part of a http response, telnet session, or
> whatever would be most appropriate to the particular original packet the
> CloakingDevice didn't respond to. To a client, it looks like your
> host is giving service as usual but of course your host has no IP stack and
> only responds to packets from the super secure CloakingDevice.
> It doesn't listen to clients at all. :-) And the CloakingDevice doesn't
> offer service at all, so that's safe too.
>
> Obviously, with this setup ALL your systems are secure. You can't
> attack any of them because none of them are there. Your hosts don't
> respond to any packet directed at them (they bridge everything to the
> CloakingDevice). The CloakingDevice doesn't respond to any packet
> directed at it (it sends host unreachable). Yet, even though your
> whole network is not visible, all of your current services still look
> to be there! Not only that, now everything from your corporate database
> to your web server is running in _kernel_ mode, _beneath_ all the weaker
> OS stuff. Plus, since you don't need the firewall box any more, you can
> now run something _useful_ on that box. Hooray for CloakingSoftware!
>
> Moral; don't listen to what they say. Watch their hands. ;-)
>
> Cheers,
> Frank O'Dwyer.
>
> (P.S. Not attacking the DOS-based approach, btw - that's fine.
> it's only the invisibility pitch that I take issue with).
>
> (P.P.S no, this is not a product announcement. I don't speak
> for DEC :-)
Dawgone it I could have sworn the pea was under the middle shell...
|
|
