Re: [v6ops] Hmm. Interesting article...

On Tue, Feb 2, 2016 at 8:09 AM, Ca By <cb.list6@gmail.com> wrote:

>
>
> On Tue, Feb 2, 2016 at 7:34 AM, Fernando Gont <fgont@si6networks.com>
> wrote:
>
>> On 02/02/2016 12:24 PM, Howard, Lee wrote:
>> >
>> > On 2/2/16, 9:33 AM, "v6ops on behalf of Fernando Gont"
>> > <v6ops-bounces@ietf.org on behalf of fgont@si6networks.com> wrote:
>> >
>> >> On 02/02/2016 10:20 AM, Owen DeLong wrote:
>> >>>
>> >>>> On Feb 1, 2016, at 23:56, Fernando Gont <fgont@si6networks.com>
>> wrote:
>> >>>>
>> >>>> Maybe in that in IPv4 you typically have a NAT in front of your node,
>> >>>> where in IPv6 you don't necessarily have a fw?
>> >>>>
>> >>>
>> >>> If you're running a host without any sort of filter, that's really not
>> >>> a problem we should be solving at the network level. That's more of an
>> >>> educational problem.
>> >>
>> >> There's a reason for deploying network-based firewalls:
>> >> <https://tools.ietf.org/html/draft-gont-opsawg-firewalls-analysis-01>
>> >>
>> >
>> > There is an unaddressed tension here.
>> > I think one view is that IPv6 should be deployed without firewalls so
>> all
>> > hosts are reachable from arbitrary other hosts on the Internet.
>>
>> The folk busted by the recent ICMPv6-based freebsd exploit has a good
>> example regarding why you don't want to be reachable by everyone when
>> you don't really need that.
>>
>>
> Except for everyone with a FreeBSD based network based firewalls.
>
> In my experience, firewalls are a single point of failure that are
> generally more prone to attacks (state exhaustion, ALG mishandling bugs and
> associated platform crashes, ...) than anything else.  A firewall is a
> host, so it has all those same host issues you speak of.
>
> The biggest sources of network based DDoS today that is crushing the
> internet daily ....is generally labeled a "home firewall" ...these
> firewalls seem to expose UDP 1900, Chargen, NTP, and others.... The label
> says firewall.
>
> So, excuse me if i don't think firewalls do what you think they do in the
> real world.  In my experience, they are the vector of the worst attacks and
> concentrate the risk of a site going off-line into a single box that is
> more vulnerable (since it is running exotic ALGs, UPNP, PCP ...)  than any
> other box
>
> CB
>

Oh, and they also create really nice backdoors into something you call the
"trusted area"

http://arstechnica.com/security/2016/01/et-tu-fortinet-hard-coded-password-raises-new-backdoor-eavesdropping-fears/

Fortinet, Juniper, Nearly every home router....

So...tell me... where do you come up with this idea that firewalls help?

There is a lot of evidence they make things worse.  Firewalls have the
following *fundamental* architectural failings

0. Long history of being seriously owned, including recent backdoor issues.

1. They make users feel falsely secure so they make bad assumption about
the "secure network"

2. Commonly hit with state exhaustion attacks

3.  Architecturally they are generally deployed as a single door to the
network, so they are a single point of failure....even more hilarious is
when a vendor sells an high-availability pair and the state bug is reflect
from the HOT node to the standby node and they both crash

4.  They do advanced stateful packet fiddling, which is highly error prone
(UPNP, PCP, other ALGs)

I have been hit with evey one of the above.

CB

>
>
>> "Need to know basis", "principle of least privilege"... i.e., you are
>> not allowed to do and something that you're not really required to do...
>>
>>
>> > I think the other view is that all/most/many hosts should be protected
>> by
>> > a stateful firewall.
>> >
>> > I don¹t know that we can resolve this tension in v6ops, but I want to
>> make
>> > it explicit.
>>
>> Folks aiming at end to end connectivity have traditionally assumed that
>> the "host" is some sort of computer (laptop, tablet, etc.) whereas
>> "host" really becomes any crappy device that becomes IPv6-enabled...
>> possibly with sloppy code, unmanaged, and possibly not even possible to
>> upgrade. -- No.. you don't want that stuff eachable from anyone in the
>> Internet.
>>
>>
>> --
>> Fernando Gont
>> SI6 Networks
>> e-mail: fgont@si6networks.com
>> PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492
>>
>>
>>
>>
>> _______________________________________________
>> v6ops mailing list
>> v6ops@ietf.org
>> https://www.ietf.org/mailman/listinfo/v6ops
>>
>
>