Hi,
I've seen some firewalls that support inspection of fragmented traffic, but
it does not mean they reassemble the traffic. This should be done at the
endpoint (host or server, or proxy).
I agree that it becomes more difficult to 'fool' firewalls or IPS/IDS with
fragmentation, but myself I had a lot of success with fragroute to bypass
IDS/IPS systems that were able to decrypt SSL traffic. Very few (not to say
none ...) were able to handle fragroute. If they already succeeded to
support IP fragmentation, they certainly messed up when using the TCP
segmentation features present in fragroute.
Regards,
Xxradar
http://www.Radarhack.Com
-----Original Message-----
From: listbounce@securityfocus.com [mailto:listbounce@securityfocus.com] On
Behalf Of Harry Hoffman
Sent: Wednesday, September 26, 2007 4:36 AM
To: seclt yuri
Cc: pen-test@securityfocus.com
Subject: Re: Are Fragmentation Attacks Still Used for IDS/IPS Evasion?
well, there are a few things to think about...
fragmentation as DOS attacks,
fragmentation as cover for stealth attacks,
incorrectly configured firewalls,
compromised systems on the inside that have a greater level of access
then on the outside. (internal servers that are separated from Desktops
from a router and not a firewall... not all that uncommon, unfortunately).
Cheers,
Harry
seclt yuri wrote:
Yes but this effectively means that fragmentation
attacks are useless if launched across the 'Net and
when performing a penetration test without local
access.
Also, even internal host systems are usually
segregated from servers and server vlans by a
firewall, so even then, I can't see how fragmentation
attacks would be effective. The only scenario that I
can think of would be within the same subnet or vlan
where traffic doesn't pass through a firewall.
Please correct me if I am wrong. Thank you.
--- Harry Hoffman <hhoffman@ip-solutions.net> wrote:
yep, unfortunately not enough people using host
based firewalls and alot
of attacks happen inside of where the firewall
protects (i.e. local lan)
seclt yuri wrote:
Hi,
I was just reading up on fragmentation attacks
using
fragrouter and fragrouter as a mean of IDS/IPS
evasion. However, since almost all firewalls both
commercial and free (iptables for examples) now
have
support for fragment reassembly, are fragmentation
attacks still effective? Thanks.
____________________________________________________________________________
________
Need a vacation? Get great deals
to amazing places on Yahoo! Travel.
http://travel.yahoo.com/
------------------------------------------------------------------------
This list is sponsored by: Cenzic
Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution
FREE today!
http://www.cenzic.com/downloads
------------------------------------------------------------------------
------------------------------------------------------------------------
This list is sponsored by: Cenzic
Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE
today!
http://www.cenzic.com/downloads
------------------------------------------------------------------------
____________________________________________________________________________
________
Fussy? Opinionated? Impossible to please? Perfect. Join Yahoo!'s user
panel and lay it on us.
http://surveylink.yahoo.com/gmrs/yahoo_panel_invite.asp?a=7
------------------------------------------------------------------------
This list is sponsored by: Cenzic
Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!
http://www.cenzic.com/downloads
------------------------------------------------------------------------
------------------------------------------------------------------------
This list is sponsored by: Cenzic
Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!
http://www.cenzic.com/downloads
------------------------------------------------------------------------
