• We’re currently investigating an issue related to the forum theme and styling that is impacting page layout and visual formatting. The problem has been identified, and we are actively working on a resolution. There is no impact to user data or functionality, this is strictly a front-end display issue. We’ll post an update once the fix has been deployed. Thanks for your patience while we get this sorted.

Stealth firewalls

R

Rifter

Lifer
Was talking to a network admin i know recently and he was going on about stealth firewalls that stealth all ports being the best thing ever. Obviosly you cant do that if you have a server on the inside that needs open ports but can use them for offices and whatnot that just need internet and he said they were great cause they dont respond to any requests so no one knows you are there. I told him he was full of shit because if i was scanning his ports and it dropped all packets i would know there was a firewall/network there being hidden because if no computer was turned on behind the router it would return a host unreachable packet, not nothing. He told me i was wrong. Who is right?
 
Actually, you both have points.
Even with a computer off, if it's physically connected to the router, the ethernet is still recieving/sending, so that PC is in a sense, still able to be pinged. Iunno *shrugs*
 
Host unreachable can also be a result of a routing loop. I see this more commonly in my job. If a host is umplugged from the network, you would simply get failed pings.
 
If you know a computer is at an ip address then there goes your stealth. It is only good if the attacker does not know there is a pc at the address.
 
Rifterut said:
I told him he was full of shit because if i was scanning his ports and it dropped all packets i would know there was a firewall/network there being hidden because if no computer was turned on behind the router it would return a host unreachable packet, not nothing. He told me i was wrong. Who is right?
Click to expand...

The network admin is correct in that from a perspective of an outside attacker, a "stealth" firewall is indistinguishable from a host that doesn't exist. However, if the network admin thinks that a "stealth" firewall provides any more security than a firewall that simply responds saying that a port is closed, he's mistaken. In addition, such firewalls are usually also configured to block incoming ICMP packets (particularly echo requests), which is incredibly irritating and can potentially lead to an accidental denial of service.
 
Modelworks said:
If you know a computer is at an ip address then there goes your stealth. It is only good if the attacker does not know there is a pc at the address.
Click to expand...

That is incorrect. A computer, server, harware firewall, whatever can be assigned an IP and be completley undiscoverable.
 
^my question is what IP...not the internal/intranet IP rite?..I hope not, because that's what's been coming up lately in my tests done on auditmypc and grc....it shows my private IP address, which is somehow (and which I hate), displayed within your browser header everytime you go online...so if your talking about that IP, then shewww! *wipes sweat from forehead* ...good riddens...
 
Ya know, I read threads like this and I realize how chain stores and government agencies lose so much customer data via simple network hacks.

In the event somebody outside your network is trying to hack your box two conditions exist; (1) they already know you are there and what your static IP is, and from that they can deduce what they need (2) it's a bot / malware running an a search algorithm via brute force.

In either condition, nobody gives a sh_t if your ports are stealth or not. Ironically the only time the condition is verified is when you check an outside service (or read amatuer security sites like GRC). My opinion is that 'stealth' ports and not respondiong to a basic ping is like turning your porch light off to try and hide your house from a burglar. If you are on the internet, you have an IP address and you have ports.

Also, the potential attacks coming from outside *aren't* attacking your firewall (except in some very rare instances). The vulnerability is the *applications and OS services* listening to those ports. If those layers are blocked from the internal or external side, and/or patched sufficiently, I could care less if a port says 'f-off' to an automated bot or doesn't respond at all.

If you want to have some fun sometime get a good firewall that shows realtime connection attempts and set up some 'honey pots' like a fake open port 25 relay, or unpatched windows web server. Watch the bot nets swarm to you like crazy and look up the countries of origin of the IPs.
 
spikespiegal said:
Ya know, I read threads like this and I realize how chain stores and government agencies lose so much customer data via simple network hacks.
Click to expand...

Its more surprising how much personal info is lost due to mis-dials and bad mail labels.

In the event somebody outside your network is trying to hack your box two conditions exist; (1) they already know you are there and what your static IP is, and from that they can deduce what they need (2) it's a bot / malware running an a search algorithm via brute force.
Click to expand...

Or they know your email address. Or they know which hotel you're staying in and that you'll be at a "business meeting" from 8-11p. Or they just got a janitorial job in the datacenter... 😉

In either condition, nobody gives a sh_t if your ports are stealth or not. Ironically the only time the condition is verified is when you check an outside service (or read amatuer security sites like GRC). My opinion is that 'stealth' ports and not respondiong to a basic ping is like turning your porch light off to try and hide your house from a burglar. If you are on the internet, you have an IP address and you have ports.

Also, the potential attacks coming from outside *aren't* attacking your firewall (except in some very rare instances). The vulnerability is the *applications and OS services* listening to those ports. If those layers are blocked from the internal or external side, and/or patched sufficiently, I could care less if a port says 'f-off' to an automated bot or doesn't respond at all.
Click to expand...

Be more worried about client side attacks. Businesses should be worried about basic webapp attacks too.

If you want to have some fun sometime get a good firewall that shows realtime connection attempts and set up some 'honey pots' like a fake open port 25 relay, or unpatched windows web server. Watch the bot nets swarm to you like crazy and look up the countries of origin of the IPs.
Click to expand...

Don't advocate running a honeypot without also mentioning that its a really bad idea if you are doing it "just for fun." Especially heavy weight honeypots (like unpatched windows servers). There's a lot of work involved with honeypots, and most of it involves you trying to keep yourself from ending up in jail, on blacklists, or major debt from lawsuits. 😉 They are fun though.
 
Last edited:
The nice thing with stealth is that it might be more likely to just make the hacker "walk away" while if the hacker knows there is a PC there he might just launch a syn dos attack or simply a continuous port scan in hopes the firewall gets brought down for a short period of time. Though with billions of unprected machines out there even if the hacker knows the machine is there, but is protected he/she might still just walk away.

It's the targetted attacks and bots that suck. No matter what, they'll find a way. The only good solution there is a good NAT firewall but even then there may be ways to get around that, I'm no hacking or security expert.

And yeah honey pots are fun. It's fun to put an unpatched windows machine on the DMZ. It gets totally hacked within minutes.
 
n0cmonkey said:
Its more surprising how much personal info is lost due to mis-dials and bad mail labels.
Click to expand...

More information is lost through social engineered attacks than any other form. It is so much easier for someone to sit with a phone book and a notepad and start randomly calling people pretending to be their bank than it is for someone to hack into computers looking for the same info.
 
Modelworks said:
And what good is that if I already know the computer is at that ip ?
Click to expand...

But its not always a computer with an ip; it could be a network printer, among other things. And the intruder more than likely wouldn't know that and his continued efforts to try and "hack" it would be wasted.
 
Last edited:
Stealth rule dropping all traffic destined for the firewall needs to be in place. Only rules that should be above it are for managing the firewall and VPNs. In some cases you may have to make exceptions but I would do so very carefully. You people keep saying "if you know the ip" you can hack the $%^& out of the firewall. The reason for a stealth rule is to inhibit the information gathering phases of attacks. Of course if someone really spends some time they are going to get it....but a stealth rule will stop 90% of the people who are just looking for easy targets. If you think its a good idea to allow ICMP from the internet directly to your firewall, I would keep your resume updated.
 
OR you can just take my advice =p. I promise you having ICMP open to the world will draw more evil in than good. Malicious bastards will be more prone to finding you.....and auditors will scrutinize you!
 
theevilsharpie said:
Malicious bastards don't need ICMP to find my firewall 😉
Click to expand...
You would have one of those non-pingable 'router' between the server in the DMZ and the internet too? 😉 The one that does not answer (as opposed to 'host unreachable'). As theevilsharpe already knows, no reply means there is something there. ICMP then helps troubleshoot for those who won't believe that they are getting to the network and servers. The reason folks orginally stealthed was to drop the load on the firewalls from answering ICMP requests.

ICMP yes too, everything else to the firewall, no.

Stealth probably seems cool in small scale and it is in some day 0 cases that have long been patched, but it is just like a machine without a listening port. A real firewall's rules should be configured so only allowed addresses on allowed ports to specific destinations. In big sites, the firewalls are protected too. Something like F5's Big-IP kills the malicious ICMP and other DOS packets.
 
You must log in or register to reply here.

TRENDING THREADS

Back
Top