Re: R: icmp o non icmp ?? questo è il problema

St0rM wrote:

> Leggo su Slashdot:
>
> ===
> The process of Port Knocking is a way to allow only people who know 
> the "secret knock" access to a certain port on a system. For example, 
> if I wanted to connect via SSH to a server, I could build a backdoor 
> on the server that does not directly listen on port 22 (or any port 
> for that matter) until it detects connection attempts to closed ports 
> 1026,1027,1029,1034,1026,1044 and 1035 in that sequence within 5 
> seconds, then listens on port 22 for a connection within 10 seconds. 
> The web site explains it in some detail, and there is even an 
> experimental perl implimentation of it that is available for download. 
> I can't think of any easy ways you could get around a system using 
> this security method - let alone even know that a system is 
> implimenting it. Another article on port knocking is here."
> ===
>
> Servirebbe a qualcosa? Puo' essere considerato "security through 
> obscurity" ?



http://www.phenoelit.de/stuff/cd00rdescr.html

E' una backdoor che funziona circa nello stesso modo - aspetta una certa 
sequenza di pacchetti prima di attivarsi.
....a me personalmente pare molto piu' un metodo da "attaccante" che non 
voglia farsi scoprire, che una misura di security. obscurity si, ma al 
contrario :-(


Daniele

________________________________________________________
http://www.sikurezza.org - Italian Security Mailing List