At 03:01 PM 1/23/96 -0500, you wrote:

Frank Willoughby writes:

Egads. Let's take this off-line & stop bothering the cypherpunks folks with this discussion. Those not interested in this thread are kindly requested to hit the <delete> key now. Thanks. 8^)

Yes, certainly. You can bribe someone, get physical access to machines, etc.

However, unless you know a way to crack RSA, it is unlikely that a system using Photuris+IPsec will permit IP spoofing.

I re-iterate, any system can be gotten around - and frequently will. As far as IPsec goes, it is probably just a matter of time before we see the first CERT Advistory (maybe in a couple of years) on this. Nothing is invincible.

...

The creativity of hackers is succeeded only by their motivation and ability to put many hours into trying to solve a problem. Including the word "probably" was deliberate. Kerberos was also thought to be secure - 'til it was compromised.

Kerberos was compromised? When? By whom? Are you talking about Bellovin's paper on weaknesses in Kerberos (most of which are avoidable or fixed in K5), or are you talking about a real break? If the latter, its the first that I've heard of it.

Actually, I was refering to Bellovin's paper. Surely you don't think that the bugs that were discovered are the only ones which can be exploited and that Kerberos (or any other software product) is invincible? I don't.

...

...

...

I suspect even when firewalls are embedded in the O/S,

That would be somewhat meaningless. The point of a firewall, as others here have noted, is that it is easier to secure one machine than five hundred or ten thousand.

Of course it is easier to secure one machine that 500 or 10K. However, NOT securing the 500 or 10K systems still leaves them vulnerable to network attacks. Providing the O/S with rudimentary firewalling capabilities helps to increase the security of those systems. Like many of my colleagues in the Information Security field, I have (grossly) modified/hacked/butchered my systems to provide the system with some rudimentary firewalling capabilities and the extra security I needed. In many cases, it meant taking advantage of strange behaviours of the systems to achieve the capabilities & results I wanted.

...

I disagree here also. Systems by themselves are fairly useless. Their power (and main vulnerability) comes from their ability to network with other systems. A system connected to a network is vulnerable. The fact that a corporate firewall protects the system from the Internet in no way decreases the vulnerability of that system (and other systems) from *internal* attacks which can be as devastating as an Internet attack.

Including firewall capabilities as part of the Operating System's network applications would help the system protect itself from abuses from the Internet - as well as from internal.

These last two paragraphs are gibberish.

Beats me. They make sense to me. What part about Information & Network Security don't you understand? These are fairly basic concepts. I can go explain these concepts either in another forum or off-line via e-mail or phone (your dime, my time), but not here. This is the cypherpunks mailing list, not the firewalls mailing list.

You can't "firewall" every machine -- the act is meaningless. A Firewall is a filter designed to protect you from bugs in the setup or implementation of the software on the machines on the inside. What would it mean for a machine to have "firewall software" in the operating system? Systems already attempt to prevent unauthorized access -- the reason you have firewalls is because that software is sometimes buggy. "Firewall software" in the OS is a meaningless concept.

Perhaps this is where you are getting mixed up. A firewall isn't just a box which you plug into a network between the company's WAN and the Internet - it's a capability. Many "firewalls" are systems which implement this capability. The main characteristics of the firewall are (paraphrasing rather liberally from Steve Bellovin's book): o The firewall is designed to protect an entity from a particular network connection. Usually, we think of the entity as being another network. In this particular case, we are putting in a firewall (or the ability to filter out what we don't to deal with) on the O/S itself to reduce the risks of potential attacks from a network (internal LAN, Internet, etc). o All traffic from the insecure network has to go through the firewall. Logical. If the "firewall" is a piece of software which is installed on the O/S to "filter out" certain network connections, then we have "firewalled" our system. Commercial firewall products such as: DEC's DECseal, Raptor's Eagle, V-ONE's SmartWall, etc, actually provide two levels of protection: 1) They protect the internal network from hazards of the Internet (or untrusted network) 2) The protect themselves from hazards of the Internet or other untrusted network (such as the internal LAN) Implementing a firewall as part of an O/S provides the protection mentioned in point number 2: It protects itself from the internal LAN to some degree. Granted not as much as it possibly can, due to the fact that you have users & applications on the system which aren't secure, however, an added measure of protection will be provided to the system.

Perry

Perry, (and others who may be interested in this thread) This is my last mail on this thread in this list. If you or others would like to discuss this further, please feel free to send me an e-mail directly or join me in discussing this in the firewalls mailing list. Fellow cypherpunks, I'm sorry about the bandwidth used in responding to Perry's question. Unfortunately, it was addressed to the list and required a response from me. Thanks for your patience. Back to the subject at hand (cryptography) Best Regards, Frank Fortified Networks Inc. - Management & Information Security Consulting Phone: (317) 573-0800 - http://www.fortified.com/fortified/ <standard disclaimer> The opinions expressed above are of the author and may not necessarily be representative of Fortified Networks Inc.