Autor: Szymon Sokol (szymon_at_uci.agh.edu.pl)
Data: Tue 24 Jan 1995 - 14:54:17 MET
Lech Borkowski (lbs_at_phys.ufl.edu) wrote:
: comments, anyone?
Tak, ja pozwole sobie skomentowac:
: The new attack makes use of a flaw in the design of the network to fool the
: router computers into believing that a message is coming from a trusted source.
: By masquerading as a familiar computer, an attacker can gain access to
: protected computer resources and seize control of an otherwise well-defended
: system.
Mowiac krotko: chodzi o "packet forging". Jezeli router pozwala wylaczyc
"source routing" i nie akceptuje pakietow przychodzacych "ze zlej strony",
to ten atak sie nie uda. Poza tym, jezeli Twoj komputer nie uznaje zadnych
innych za "trusted" (w sensie .rhosts, NFS, itd.) to rowniez nie zadziala.
Nie jest tak zle. Stwierdzenie ze "esentially everyone is vulnerable" nalezy
uznac za gruba przesade.
: The security warning to be issued on Monday will include a list of brands of
: router computers that can use a computer program to protect against the new
: attack, which is called IP, or Internet protocol, spoofing. The new defense
: works by recognizing packets that have been forged and rejecting them. But the
: advisory will also list brands of routers that have no way of protecting against
: the attack.
No wlasnie. Oczywiscie Cisco pozwala na taka ochrone, a siec NASK bazuje
glownie na Cisco...
: "This is a really tough problem because it is an attack based on the way
: things work normally," said Marcus Ranum, a senior scientist at Trusted
: Information Systems, a computer security firm.
Dziwi mnie, ze Marcus (znany ze swoich radykalnych pogladow na bezpieczenstwo)
uznal za normalny stan, w ktorym bezpieczenstwo bazuje na adresach IP (vide
.rhosts). Odkad pamietam, byl zwolennikiem silnej kryptograficznej
autentykacji. Ten facet uwaza hasla (obojetne jak skomplikowane) za
przestarzala technologie (i ma duzo racji).
: "These guys are striking the basis of trust that makes the network work," Mr.
: Ranum said, "and I hate that."
To niestety prawda... Ale w momencie, kiedy Internet zaczyna byc uzywany do
celow komercyjnych (wedruja po nim numery kart kredytowych itp.) enkrypcja
staje sie koniecznoscia.
--
Szymon Sokol -- Network Manager
U U M M M M University of Mining and Metallurgy, Computer Center
U U MM MM MM MM ave. Mickiewicza 30, 30-059 Krakow, POLAND
U U M M M M M M M M TEL. +48 12 338100 EXT. 2885 FAX +48 12 338907
UUUU M M M M M M WWW page: http://www.uci.agh.edu.pl/~szymon/
To archiwum zostało wygenerowane przez hypermail 2.1.7 : Wed 19 May 2004 - 15:49:48 MET DST