INDUSTRY ANALYSIS
Are Firewalls Useful? And Another Thing...

The two questions are, first, why can't router software let us stamp out address spoofing? And secondly, why do we use firewalls?

Address spoofing depends crucially on being able to hide the real source address, so why not make that impossible?

One way to do it would be to have all the ISPs and network carriers whose connections constitute the Internet certify where packets entering the network come from.

Any packet has to have an origin characterized, from an Internet perspective, by the point at which it first reaches part of the shared resource -- usually a router or other device maintained by an ISP or backbone carrier. Suppose, therefore, that we put software on those devices that allows them to form a self-authenticating community and insert a signed source address into every packet forwarded from the customer's premises.

Shifting Responsibility

You can do that yourself if you have a network of machines running Solaris 2.7 or later, and the capability appears to be built into IPsec, too, but the goal here would be to shift responsibility, and therefore control, from the originator to the carrier that first puts the packet on the shared network. There seems to be room for this in the standard, the technologies needed are well understood, and the number of major carriers and ISPs involved is relatively small.

Making it happen shouldn't be very hard, and the nature of the carrier's role as the packet producer's gateway to the Internet means that attempts to send packets with false information already loaded will fail, while internal authentication among participating routers should make spoofing it at the point of delivery impossible.

If even a relatively small percentage of e-mail and other Net-aware applications were changed to make use of the resulting unforgeable "this came from" information in every arriving packet, both Web- and spam-spoofing would very quickly become impractical.

That has good consequences for both the antispam and antiphishing forces. For example, software to automate ISP source tracing and customer notification, if a PC or other device started spewing spam, would be almost trivial -- meaning that putting someone else's machines into disservice through a virus or worm would become much less effective than it is now.

Denial of Service

More importantly, spam recipients could safely respond to spam in the obvious way -- by bouncing the mail back to its real source several dozen times, thus initiating a denial-of-service response on the spammer without allowing others to use the predictability of this response as a means of initiating a denial-of-service attack on the innocent.

So what's wrong with this picture to explain why it isn't done? I haven't a clue, do you?

My second issue is both more straightforward and stranger. I've been watching a client blow up his network by installing SP2 in support of the notion that several thousand PCs inside a highly protected, and carefully segmented, network should all have their own firewall protection too.

That seemed a bit of overkill to me, but asking why they thought this appropriate showed that they were responding on auto-pilot and thus raised the more general question: why use firewalls at all?

Like everyone else, I know firewalls should be used, but not why. Is this something sensible like wearing a seatbelt or an obsolete workaround, like DHCP, for long-gone limitations in Windows?

It's the Service, Stupid!

The way firewalls work is instructive here. In the simplest case, arriving packets are captured before any local processing takes place and are either discarded or passed on for normal handling, depending on whether the destination port is supposed to be open or not.

Think about that; am I being naive or wouldn't just not starting the service have the same effect without incurring the overheads associated with the firewall?

Obviously, there are some services that users don't want to do without, but sometimes that's just too bad --my own secure workstation, for example, is protected by a combination of Solaris 2.8 on SPARC and an empty socket where the network connector should be.

Most of the time, however, layering functionally identical firewalls just seems to lead to user frustration without providing much in the way of real protection. Not only do things like Microsoft's (Nasdaq: MSFT) use of SOAP and webXML as a programming environment for the Internet provide nearly ideal means of bypassing firewalls, but the reality is that even relatively simple hacks can render most firewalls useless. Two widely known methods from the past, for example, used the ttl (time to live) setting and significant differences in the packet assembly process used by Unix and Windows derivatives to bypass both firewalls and active intrusion detection systems.

Unnecessary Effort

There are more esoteric attacks -- reprogramming the firewall's own receipt-side NIC produces an undetectable bypass -- and easier ones, like overpowering a WiFi installation, but such things might simply not be necessary. After all, if firewalls are so valuable, where's their impact on the spread of worms? When SQL-Slammer took roughly 19 minutes to slam most of the world's network-facing Windows machines -- including Microsoft's own -- where were the firewalls? Out of the loop and useless, that's where.

So why do we use firewalls instead of debugging services for security-related errors, using standard tools like subnetting and nonroutable packets to limit external exposure while turning off things we don't need, like SMB networking, error reporting, or QoS futzing?

The more I worry at it, the less obvious the answer becomes, so if you can tell me -- without calling me an idiot -- I'd really like to know.