Subject: RE: Fwd: IPv6 Scoped Addresses and Routing Protocols

From: "Michel Py" <[email-masked]>
Date: Mon, 10 Jun 2002 02:14:46 -0700

> Pekka Savola wrote
> You take one approach and disregard all the others.

I don't. I just say that in this scenario site-local address helps. What
is the hacker knows the backdoor because he installed it himself and
cannot compromise the web server? Your argument is irrelevant.

> Security is about finding the weakest links and strengthening them.  
> You just looked at only one of them here..

Security is about plugging holes. There are hundreds to plug. Saying
that plugging a hole is useless because some other holes might be open
is the best way to get hacked.

Michel.

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Pekka Savola <[email-masked]>
Date: Mon, 10 Jun 2002 12:22:18 +0300 (EEST)

> is the best way to get hacked.

If hacking into the firewall to install a static NAT mapping is the
easiest (or one of the easiest) way to break into a system, something is
REALLY REALLY wrong IMO.

-- 
Pekka Savola                 "Tell me of difficulties surmounted,
Netcore Oy                   not those you stumble over and fall"
Systems. Networks. Security.  -- Robert Jordan: A Crown of Swords

---

From: Keith Moore <[email-masked]>
Date: Mon, 10 Jun 2002 11:16:37 -0400

> is the best way to get hacked.

that's sort of like saying that putting your finger in a crack in the dam
is useless because there are probably other cracks. 

Keith

---

From: JJ Behrens <[email-masked]>
Date: Thu, 13 Jun 2002 17:21:59 -0700

> is the best way to get hacked.

Michael,

I am no security wizard.  However, it seems to me that you are suggesting that
site-local addresses add a small amount of security because there's no way to
connect directly from the attacker's machine to the database machine.  However,
if the Web server has been compromised (which is a very reasonable proposition
based on recent events), it seems just as easy for the attacker to mount his
attack by first ssh'ing to the Web server, and then attacking the database 
server from there.

I welcome your corrections if I have missed something.

Thanks,
-jj

-- 
Users of C++ should consider hanging themselves rather than shooting their 
legs off--it's best not to use C++ simply as a better C.
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------