Subject: RE: IPv6 NAT?

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Fri, 15 Feb 2008 10:10:04 -0800

Ok you tell me in less than a page how someone can use just those tools to be sure that their network is going to be safe when a network worm comes in an clobbers the print server running Linux 6.2

The problems are much harder than anyone knows to solve today.

How do I set an acl on my home server to be sure that the kids cannot watch unsuitable movies stored on it from their machines while being able to watch them myself?

Try it before you respond. And that is one of the better user interfaces.

Sent from my GoodLink Wireless Handheld (www.good.com)

 -----Original Message-----
From: 	Christian Huitema [mailto:[email-masked]]
Sent:	Friday, February 15, 2008 09:37 AM Pacific Standard Time
To:	Hallam-Baker, Phillip; Spencer Dawkins; Iljitsch van Beijnum; [email-masked]
Cc:	[email-masked]
Subject:	RE: IPv6 NAT?

> You know of an O/S that is not vulnerable to malware attacks? Please let me know
> the name, I haven't encountered one professionally since I was using OpenGenera
> in '95 and that was only secure because we had a more or less complete list with
> the names of every person who had ever successfully managed to learn the beast.

Very few software products can be considered perfect. However, NAT and basic statefull firewalls only protect against a specific category of attacks, the arrival of unsolicited connection requests through the network. Most mainline operating systems have built-in protection against such attacks. Windows XP-SP2 and Windows Vista certainly do. They come with a built in firewall that will, by default, prevent incoming traffic on all ports. I understand that recent Linux distributions and recent versions of OS/X have similar protections.

Attacking ports by sending random packets is very much a 2003 story. Modern malware typically works by exploiting users' naiveté, bugs in document parsers, or a combination of both. An example of user naiveté would be to ask users to download a special media player to look at frolicking bodies. An example of exploiting document parsers would be to lure users to visit a malevolent web site, and have they open a booby trapped image or movie.

The typical NAT or stateful firewall offers no protection against document parsing bugs. That is a good thing. If firewalls tried to do that, they would have to incorporate a large amount of document parsing code, and would most probably become a target for their own parsing bugs. Of course, no amount of electronics will protect against users intent on downloading a very special media player...

-- Christian Huitema

_______________________________________________
Ietf mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/ietf

---

From: Christian Huitema <[email-masked]>
Date: Fri, 15 Feb 2008 11:27:24 -0800

I don't know for Linux, but the normal configuration of a print or file sharing service in a Windows home network would be to only listen on the local network, which makes it immune to "arrival from the network". The connection simply will not be established. Of course, the simple "single network" solution does not work in enterprises. There are multiple solutions available to limit access to enterprise services, for example "server and domain isolation" using IPSEC (http://technet.microsoft.com/en-us/network/bb545651.aspx). This is actually what Microsoft does use in its internal network.

There are multiple offers for "parental control" services, e.g. built in Windows Vista (http://blogs.msdn.com/uac/archive/2006/04/06/570560.aspx).

Of course, if you are simply looking at incoming traffic load, then clearly routers can play a role by implementing a form of rate limiting.

From: [email-masked] [mailto:[email-masked]] On Behalf Of Hallam-Baker, Phillip
Sent: Friday, February 15, 2008 10:10 AM
To: Christian Huitema; Spencer Dawkins; Iljitsch van Beijnum; [email-masked]
Cc: [email-masked]
Subject: RE: IPv6 NAT?

 -----Original Message-----
From:   Christian Huitema [mailto:[email-masked]]
Sent:   Friday, February 15, 2008 09:37 AM Pacific Standard Time
To:     Hallam-Baker, Phillip; Spencer Dawkins; Iljitsch van Beijnum; [email-masked]
Cc:     [email-masked]
Subject:        RE: IPv6 NAT?

-- Christian Huitema

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Mon, 18 Feb 2008 15:34:50 -0800

This really isn't solving my problems at all. Which is a pity since I have rather more computer knowledge than the typical home or enterprise customer that Microsoft is attempting to serve. 
 
The problem isn't limited to Microsoft either. In this respect Apple is just as bad and Linux considerably worse.

First the point about my network is that the printers do not connect up to Windows boxes, they connect up to the network, which is the only logical arrangement really. I have not got the foggiest idea which operating system Brother use on their printers. But I am pretty sure its reasonably powerful and certainly not the type of thing that I would ever allow to go on the Internet directly. The task here is to configure the network so that we are sure that there is no external vulnerability that 1 requires least effort, 2 is most likely to be done correctly
 
The only tool that a consumer can purchase today that meets those needs is a firewall that cuts off inbound ports. It is a blunt instrument but it is the only one that meets the requirements.

Second, net nanny or the like really does not meet the requirements I outlined. I suggest that Microsoft take some note of these requirements since you have only spent a billion dollars buying access to the necessary technology but you are not deploying it in a form that end users could possibly use to meet their needs.
 
In the scenario I gave, the data I wish to stop the kids accessing is already on my network, net nanny is totally useless in this instance. Let us imagine that I have a configuration that consists of one Vista machine and one Home Server on which there is stored a collection of ripped DVDs of video nasties, you know The Sound of Music, Care Bears Movie etc. some of the nastiest films I have seen. I do not with the kids tastes to be corrupted by this rubbish.
 
Try setting up that configuration and take a good look at the information that the user has to work with. I would send you screen shots that make this point but the machine has just gone out of action with a hardware fault. I promise you that there is absolutely no way any competent admin could possibly be confident that the machine was configured as intended without logging in using the kids accounts to check that they were unable to see the banned movies.

When I wrote The dotCrime Manifesto: How to Stop Internet Crime, I was thinking in terms of how to provide security usability for applications such as email and the Web. Since then I have been looking at the problem of how to systematize an approach to security usability engineering. 
 
The point here is not to identify one set of products as being 'worse' than others, NONE of the products I have used is any better. Security Usability is something that the entire industry has been failing on. The solution here is not 'buy a Mac'.
 
I am really not at all suprised that users cling to their +5 amulet of protection firewalls. They at least know how to use them. 

The reason we see so many data breaches and lost SSNs is that the products out there in the market are ALL broken by design. They are all based on a security architecture where it is assumed that data does not move. Well with the Internet data sure does move and that has real consequences.
 
Now part of the solution is going to be heavyweight usability engineering with intensive lab testing etc. But many of the products and systems I have been looking at have faults that I believe could and should have been detected in the early design phase.

Security cannot be effective when it is provided in the form of a DIY assembly required project. But thats what the field has been doing.

________________________________

From: Christian Huitema [mailto:[email-masked]] 
Sent: Friday, February 15, 2008 2:27 PM
To: Hallam-Baker, Phillip; Spencer Dawkins; Iljitsch van Beijnum; [email-masked]
Cc: [email-masked]
Subject: RE: IPv6 NAT?

 -----Original Message-----
From:   Christian Huitema [mailto:[email-masked]]
Sent:   Friday, February 15, 2008 09:37 AM Pacific Standard Time
To:     Hallam-Baker, Phillip; Spencer Dawkins; Iljitsch van Beijnum; [email-masked]
Cc:     [email-masked]
Subject:        RE: IPv6 NAT?

-- Christian Huitema

---

From: Theodore Tso <[email-masked]>
Date: Mon, 18 Feb 2008 19:58:27 -0500

On Mon, Feb 18, 2008 at 03:34:50PM -0800, Hallam-Baker, Phillip wrote:
> In the scenario I gave, the data I wish to stop the kids accessing
> is already on my network, net nanny is totally useless in this
> instance. Let us imagine that I have a configuration that consists
> of one Vista machine and one Home Server on which there is stored a
> collection of ripped DVDs of video nasties, you know The Sound of
> Music, Care Bears Movie etc. some of the nastiest films I have
> seen. I do not with the kids tastes to be corrupted by this rubbish.

Heh.  From the Capitol Step's, "All I Want For Christmas Is A Tax
Increase" album:

http://www.amazon.com/gp/music/wma-pop-up/B000003JOO001001/ref=mu_sam_wma_001_001

> Security cannot be effective when it is provided in the form of a
> DIY assembly required project. But thats what the field has been
> doing.

I'm afraid it's worse than that.  As long as we provide general
purpose computers, and some insiders that are determined to bring home
databases filled with SSN so they can do work in the evenings, or
children who know more about computers than their parents and who are
determined download videos of "Barney does Dallas", I'd claim is
pretty much impossible to solve the particular security problem which
you are worried about.

And I'm not sure people are really willing to accept computers with
the sorts of controls that would prevent these sorts of attacks on
data.  Look at the resistence to Microsoft's Palladium project by
people such as Ross Anderson.  (http://www.cl.cam.ac.uk/%7Erja14/tcpa-faq.html)

Most consumers are far more focused on the sorts of abuse that could
be perpetrated by Hollywood, the Music Industry, and Microsoft, rather
than problems with databases filled with US Military personnel's
credit information getting stolen out of unsecured laptops of
incompentent government bureaucrats.  One could have a debate about
whether this is a correct assessment of risks by the consumer and by
organizations like EFF and EPIC, but it's reality that won't be easily
changed.

In any case, this is a bit of a rathole from the original discussion,
I suspect....

						- Ted

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 19 Feb 2008 06:10:51 -0800

I think that many people in the security world and rather more outside
it are repeating a big mistake we made during the cryptowars of the
1990s here.

During the cryptowars, designing protocols to make them 'Freeh-proof'
became a priority. It was certainly a bigger priority than making them
usable by ordinary people. Case in point, insisting on deploying S/MIME
and PGP as pure end-to-end security protocols to remove the possibility
of interception at the server. This is the architecture that you need to
defeat interception at the server but it comes at the cost of having to
push out credentials to all the end points. So fewer than 0.01% of users
ever enroll for an end user credential, fewer use them. Meanwhile we
have a major problem with spam and social engineering attacks, both of
which exploit the lack of authentication in the email system.

The risk we face here is that people dismiss trustworthy computing in
the same way for no other reason than to spite the RIAA.

Security responds badly to political mandates, particularly the mandate
'don't make the system too secure'. There are real problems in using
trustworthy computing for copyright enforcement systems. Any system that
depends on protecting the confidentiality of decryption keys that are
embedded in a couple of billion end points is going to have limited
effectiveness. But that fact says nothing about the practicality of
protecting secrets that are only deployed out to a few thousand end
points that are subect to regular and effective control.

I'll continue on my personal (not corporate) blog:

http://dotfuturemanifesto.blogspot.com/2008/02/dont-make-it-too-secure.h
tml

-----Original Message-----
From: Theodore Tso [mailto:[email-masked]] 
Sent: Monday, February 18, 2008 7:58 PM
To: Hallam-Baker, Phillip
Cc: Christian Huitema; Spencer Dawkins; Iljitsch van Beijnum;
[email-masked]; [email-masked]
Subject: Re: IPv6 NAT?

On Mon, Feb 18, 2008 at 03:34:50PM -0800, Hallam-Baker, Phillip wrote:
> In the scenario I gave, the data I wish to stop the kids accessing is 
> already on my network, net nanny is totally useless in this instance. 
> Let us imagine that I have a configuration that consists of one Vista 
> machine and one Home Server on which there is stored a collection of 
> ripped DVDs of video nasties, you know The Sound of Music, Care Bears 
> Movie etc. some of the nastiest films I have seen. I do not with the 
> kids tastes to be corrupted by this rubbish.

http://www.amazon.com/gp/music/wma-pop-up/B000003JOO001001/ref=mu_sam_wm
a_001_001

> Security cannot be effective when it is provided in the form of a DIY 
> assembly required project. But thats what the field has been doing.

I'm afraid it's worse than that.  As long as we provide general purpose
computers, and some insiders that are determined to bring home databases
filled with SSN so they can do work in the evenings, or children who
know more about computers than their parents and who are determined
download videos of "Barney does Dallas", I'd claim is pretty much
impossible to solve the particular security problem which you are
worried about.

And I'm not sure people are really willing to accept computers with the
sorts of controls that would prevent these sorts of attacks on data.
Look at the resistence to Microsoft's Palladium project by people such
as Ross Anderson.  (http://www.cl.cam.ac.uk/%7Erja14/tcpa-faq.html)

Most consumers are far more focused on the sorts of abuse that could be
perpetrated by Hollywood, the Music Industry, and Microsoft, rather than
problems with databases filled with US Military personnel's credit
information getting stolen out of unsecured laptops of incompentent
government bureaucrats.  One could have a debate about whether this is a
correct assessment of risks by the consumer and by organizations like
EFF and EPIC, but it's reality that won't be easily changed.

In any case, this is a bit of a rathole from the original discussion, I
suspect....

						- Ted