|
|
|
The first stage in the UnderFire development was to create the rating criteria that would be employed. This criteria was designed to be generic enough so that it could be used with the wide variety of firewall solutions on the market today as well as those not yet released. This criteria was also designed to give the reader a good understanding of the specific firewall being examined as well as facilitate at-a-glance comparisons between products. The following is a list of the criteria in outline form.
|
|
Part of the evaluation of a firewall requires testing. In section 7 of the evaluation criteria list there are a list of attacks that can be made against a firewall. These attacks can disable a firewalls or allow dangerous packets to flow through with no restrictions. Testing a firewall for these attack methods are important to the complete evaluation of a firewall. This section will focus on the network based attacks.
A network monitor tool is essential in determining if packets made it through the firewall to the opposite network. Having packet analysis tools in place on both networks can be useful in determining if the firewall has modified the packet once it is passed through. Some useful tools for monitoring are Argus, snoop (which is part of the Solaris operating system), Sniffit, and tcpdump.
Building packets that test for an attack is little more difficult. A few packages exist that can generate packet data and send packets. It is possible to write scripts to automatically generate attacks using these generation tools. Two packages that will generate packets are ipsend and spak.
Below is the list of network based attacks with a simple definition and a way of examining a firewall's susceptibility to such an attack.
Address Spoofing
Sequence Number Prediction
Session Hijacking
Fragmentation
Source Routing is a way of manual routing packets instead of letting routers decide the best method.
DNS Attacks
RIP Attacks
ICMP Attacks
SYN Floods are attacks based on a problem in the TCP/IP protocol. Every time a TCP connection is made to a remote machine a SYN (or "synchronize") packet is sent. The remote machine returns a SYN+ACK (or "synchronize and acknowledge") packet to the original machine to establish a connection. The protocol will wait for another response from the remote machine for a period of time (The protocol specifies 90 seconds, but some implementations wait longer.) There is a finite number of connections that can be in this wait state. When that limit is reached the machine cannot accept any new connections until the timeout period is reached for the current connections. An attacker can generate many SYN packets with a fake host address. The target machine will be unavailable to legitimate users because no new connections can be established. Several SYN Flood exploit programs are available. A firewall can be tested by using a SYN Flood program and trying to make legitimate connections through the firewall.
Port Scanning is a process used by attackers to gain information about the configuration of machines. There are several programs designed to scan machines for problems. SATAN, Strobe, and ISS are a few of them. A firewall should reveal very little information about itself. The firewall should also recognize these attempts at information gathering and create some kind of alert. A firewall can be tested by using one of these programs and checks the results of scan.
Christmas Tree Packets are packets that have all of the option bits set in the header. This condition cannot exist according the specifications of the protocol. Firewalls that do not implement the TCP/IP state machine correctly may allow such packets to pass through to the inside network.
Multicast/Broadcast Packets
Windows of Opportunity occur generally when the firewall machine is booting and the firewall software has not started or is not completely operational. There may a period of time when the machine will route packets as a normal router before the software starts. The operating system's configuration may be source of this problem. Another situation might arise when firewall software has not completed loading the filter rules. It might only filter packets based on the current set of rules it has. This condition is more difficult to test for considering the fact that the vulnerable time may be brief or the condition is difficult to replicate. An examination of the source code may be necessary to determine if this is a problem.
Heavy Load may cause some firewalls to pass packets through due to the tremendous volume of packets in the queue and the load on the firewall machine's resources. This can be simulated by using a lower speed machine and slowing it down by consuming resources (i.e. CPU time, memory, etc.). Then, by saturating the network with valid packets and a few that should be dropped by the filter rules it should be possible to see if all of the packets are allowed through.
|
|
packet filter
circuit level firewall
application level firewall
hybrid firewall
network interface
router
ethernet
Asynchronous Transfer Mode (ATM)
encryption
authentication
"plug and play"
internet
intranet
demilitarized zoning (DMZ)
virtual private networking (VPN)
address translation
token ring
source code
IP, IPX, Appletalk, XNS, SNA, X.25, OSI, NFS, RPC
SNMP, SNMP-II, Bridge, MIB, OOB, IB, Enet MIB
HTML, Telnet, SNMP
intrusion detection
address spoofing
sequence number prediction
session hijacking
fragmentation
source routing
DNS attacks
RIP attacks
ICMP attacks
port scanning
Xmastree packets
mcast/bcast handling
filtering tables
challenge/response
access control
dial up connection
transparent network presence
T1, T3, 10BaseT
Bidirectional filtering
|
|
[1] Bellovin, Cheswick, Firewalls and Internet Security, 1994
[2] Firewall Evaluation Checklist, Fortified Networks Inc.
[3] Firewall Product Functional Summary template, NCSA.
|