Re: Common ploy by....
gfolkert said:
The common ploy allows crackers to spoof things in that brief instant to get further along on a crack. I know I've used it to humble some admins that say thier CheckPoint Firewall is impervious... Well, when they change the default rule from anything other than REJECT, changing from Negative logic to Positive Logic or a combo of both as well as a bad order of rules... Well what you expect?
Yeah, what he said. The pity of it is that this is such an elementary, dumbass error: Practically the first thing you learn, in setting up routers, is that you should ensure that they reject everything as the very first step upon initialising the interfaces.
People don't realise that filtering routers are actually much trickier than application-level proxy gateways, in that sense. With the latter, only traffic that's been explicitly permitted will be handled at all. With the former, one little error with the rulesets, or a ruleset enacted only in the runtime state but not in the NVRAM, and you're vulnerable.
But routers with only 2K RAM should be dumpster fodder, no?
Rick Moen
rick@linuxmafia.com
