Slashdot Mirror
Reverse Firewalls As An Anti-Spam Tool
An anonymous reader writes "VeriSign's principal scientist Phillip Hallam-Baker believes one answer to stopping spammers and even crackers is by using reverse firewalls. He says reverse firewalls should be embedded in every cable modem and wireless access point for home users. "A traditional firewall is designed to stop attacks from the outside coming in; a reverse firewall stops an attack going out," Hallam-Baker said. Apparently, a reverse firewall would reduce the value of recruiting your home PC as a member of a botnet because "normal users have no need to send out floods of e-mail, which reverse firewalls can stop, but they do allow a normal flow of e-mail. ""
Ahh, and who will control what defines an attack? Is using Freenet an attack? Bittorrent? Kazaa?
This looks like yet another way to force us to use the Internet in the way that corporations/governements want us to. No fucking thank you.
My other car is first.
Perhaps simply modifying mail protocols (migrating away from SMTP, POP3, IMAP etc.) to more robust and secured ones would be easier than having to create a product just to limit what you can do with your own machine and network connection.
But that would be silly now, wouldn't it? Sure, it would cost a lot a migrate your mail clients and mail servers to a hypothetical industry-standard "enhanced SMTP" or something like that, but wouldn't we all be better off in the long run?
Similarly, few individuals have a desperate need to run their own mail server, so ISPs should only allow mail connections to their own mail servers unless the user asks otherwise. How hard is that? Someone tell me this wouldn't have a major impact on spam zombies.
You could do the same for pretty much every unpopular service and just have an account page where users can specifically turn on services they need.
I suppose the router manufacturers will take this step, which would certainly generate more tech support calls and higher engineering costs, out of the goodness of their hearts?
The manufacturers are in a beautiful position on the spam/virus issue - they just route the packets, virii are Microsoft's problem. Why rock the boat?
Absolutely.
I'm not sure this is an option that the average windows user (and almost anyone sending out spam on their virus laden pc uses windows) would find simple.
Working as a support tech and dealing with mainly connectivity issues, I've learned that the number one issue blocking users from desirable online actities or access itself is a firewall. It used to be that the first troubleshooting step was to check the connections. Now it's become, check for firewalls.
I'm not sure the average windows user would find this a simple solution.
First of all, the linked article simply describes a firewall blocking some outgoing traffic with easy rate limit rules (i.e. no email after x messages sent in y amount of time). There's no need to call it a reverse firewall. It's a firewall, plain and simple. Just because most people allow all outgoing traffic doesn't mean that if you block some you've invented a new type of firewall.
The other article is really describing a completely different thing. They use the same term, reverse firewall, but they talk about firewalling each individual machine inside a lan. Basically, they suggest a firewall on each machine to protect the internal network from attacks that originate inside it. Completely different use of the term.
It sort of looks like the submitter just googled for "reverse firewall" and posted the first match. Or actually it appears to be the 4th match. Anyway, regardless, the two links seem to be talking about different things. Both of them have merit, but neither seems particularly innovative. I do like the first articles idea of rate limiting outgoing email on home router boxes by default. Seems like it would solve a lot of spam problems.
Best slashdot comment
For about 3.2 seconds till the UPNP enabled virus tells the UPNP enabled firewall that it is an authorized app...
A cable modem with a reverse firewall sounds nice but I would rather handle this at the CPU level. I want to choose what to block and accept.
Strange women lying in ponds distributing swords is no basis for a system of government.
Reverse Firewall? As far as I know, a wall of fire would be flaming on both sides.
All kidding aside, all capable firewalls do have outbound protection built into them. Consumer software firewalls monitor which programs are allowed to access the internet, for example, and enterprise-level firewalls allow you to define heuristics to block certain traffic patterns.
So, basically, the article is just suggesting a new name for an old concept. Really, the author wants consumer networking devices to have more capable firewalls.
He's missing something: home PCs aren't spam-generators, they are spam relays. The spam has to be getting in somehow, and that is something a normal firewall should be able to stop. On top of that, they have downloaded a trojan or been hit by a worm to turn them into relays in the first place, which is something a firewall + AV should prevent.
Also, it's probably just as easy to educate 75% of the people how not to become a spam relay as it is to get 75% of the people to buy something with a reverse firewall and then train them how to use it (most people I know just put their computers into the DMZ when they play games because they don't know how to forward ports).
Sure, layered security is a good thing, but I see this as likely to generate many headaches with not much benefit
-Ryan
AUWYHSTOT (Acronyms are Useless When You Have to Spell Them Out Too)
The virus is already on the inside with "root". It would be trivial for the virus to simply disable the firewall before spewing.
No, for a "reverse" firewall to make any sense, the firewall must be on a different machine.
It's normal, but it's also very annoying having to click yes/no everytime a process wants to create an outgoing connection. What the author suggests, is a hardware-based firewall (ie one that can't be switched off by a new generation virus - the current ones will terminate for instance any antivirus software they find running), that limits how many emails you can send per minute or hour.
Even for LAN firewalls, this is, or should be, normal behavior.
I know I've had my firewall setup to block outgoing port 25 traffic that doesn't come from the mail server for a long time now. I also log outbound port 25 requests, and twice this has alerted me to when one of my users was infected with a mass-mailing trojan.
Anyone who runs a firewall and does not currently have it set up similar to this should block outgoing port 25 connections that do not originate from your mail server immediately.
If you're running any reasonably modern firewall (or using Linux and iptables for your firewall) this is fairly trivial to setup.
Come on, guys. Let's all do our part to stop spam. Every little bit helps.
Topher
ZoneAlarmPro is best known for its ability to block to control outgoing traffic. However, lesser known is its ability to control outgoing email, by specifying which applications can send email, along with how many emails are sent at once before an alarm is raised about possible virus/worm, and the offending application is frozen by ZoneAlarm until the user intervenes & allows it permission to do so. So, the functionality of the reverse firewall to reduce spam that the author is asking for is already available.
Did you select from that "form" randomly or did you want to actually make an insighful point?
(x) Users of email will not put up with it
Actually if implemented properly (allowing people to configure it) people WILL put up with it..
(x) Requires immediate total cooperation from everybody at once
No. Every user that gets one of these things helps.
(x) Lack of centrally controlling authority for email
Huh?
(x) Open relays in foreign countries
No. Every user that gets this helps.
(x) Ideas similar to yours are easy to come up with, yet none have ever been shown practical
I think this is practical. Just like a regular firewall is practical. (Might as well make this thing a proper full blown hardware firewall)
(x) Countermeasures should not involve sabotage of public networks
(x) Countermeasures must work if phased in gradually
Pardon?
(x) This is a stupid idea, and you're a stupid company for suggesting it.
Yes - very amusing. We're all laughing at your stupidity.
This is not a fix-all solution. But it's a simple solution that would help to alleviate some of the spam problem.
groklaw, wired and slashdot. The holy trinity of work based time wasting.
Couple of relevant things:
Windows XP SP2 will include a reverse firewall that is enabled by default. Unfortunately it will be released, for compatibility reasons, after Duke Nukem Forever.
Principle Scientist for Verisign? The same company with the terrorists/geniuses (what's in a name?) who decided to hijack the DNS system and send it to a search portal that pays them money each time it gets used? Thanks a lot. I'll take advice from a great company like that.
I am government man, come from the government. The government has sent me. -- G.I.R.
I just think it's funny that VeriSign's "chief scientist" said we should use "reverse firewalls" ... I'll foil his plans by installing a reverse router with dual reverse Ethernet switches between my hosts and my cable modem. And I'll connect it all using my reverse CAT6 cables. This way, by the time a packet arrives at the reverse firewall it will already have been reversed...in which case...uhhh...it will be re-reversed and forwarded normally. Yup.
I'm gonna go to reverse sleep now.
"A clear conscience is usually the sign of a bad memory."
Apart from the annoying debasement of the word "scientist", this really does reveal VeriSign's view of the function of the Internet and, unfortunately, it's becoming more common.
If I buy an "Internet" service I have a reasonable expectation of being able to run any service I can encode in IP packets and have that service routed transparently end to end. I *should* be able to run a VPN, remotely mount filesystems, use VoIP or even run a mailserver if I want to. If I can't it isn't an Internet.
Increasingly, ISPs seem to think that providing a link to their web proxy and a POP3 mailbox constitutes an adequate service. It might be for some people, but it's not the Internet, it's CompuServe revisited. It's good for ISPs though, because they can start charging you extra for "services" which simply involve them removing rules from your compulsory firewall.
but a firewall is a piece of software which allows or denies packets based on their properties; it cares not in which direction they are flowing.
A reverse firewall, then, is just a firewall. It's like the difference between a slash and a forward slash (pet peeve). In fact, if you use an iptables or ipchains firewall, you only need a few extra rules to implement this on your gateway machine.
Perhaps it's just me, but egress filtering is the default behaviour on all FW boxes I set up. And I'm not even that much of a harcore security geek.
"Consistency is contrary to nature, contrary to life. The only completely consistent people are the dead." A. Huxley
Eh, when I stopped accepting direct-to-mx mail from dynamic IP addresses, I had exactly 1 legitimate mail get blocked in the first six months, and that was because the sender forgot he'd been playing with Mercury.
Compared to the 900+ viruses/spams/worms that get 550'd every month, I'd call that acceptable.
yeah just like all the other "personal firewalls".
I believe there is a future for this afterall:
"welcome to the setup of your personal firewall. To install some personal settings please anwswer the following questions:
- Do you click on banners.
Yes / no / Banners?
- Do you use floppies and CD's provided by your idiot neighbour.
Yes / no / also from my uncle
- Is your default webpage www.msn.com.
Yes / no / Banners?
- You have created a personal webpage about your hobbies.
Yes / no / with my cat
- Running Outlook and Outlook express.
Yes / no / I like it
- Paid for more space on the hotmail account.
Yes / no
- You made friends with a Gorrila.
Yes / no / I like him because he is purple
- Do you trust company popups that trie installing software.
Yes / no / They are here to help me run the internet arent they?
Thank you for filling out these questions, your personal setting will now be choosen. While we are doing that please fill in as many square boxes below as possible and a few email adresses from YOU and your friends so we can GIVE you information for FREE......
Setting found, If one of the questions above was not no your personal firewall will be put in the L-User setting, dis-engaging internet connection now, thank you, go read a book or play solitaire........still here? the setting was permanent, shoo, SHOO, rebooting now......
Message from god, Please logoff, rebooting the Universe
I set up a firewall at a medium-sized company and the only machine which was allowed to connect to some remote machine on port 25 was the mail server. In a similar vein, the transparent proxy was deliberately set up to break LookOut Express HotMail over HTTP.
Simple things like that, default to deny for both inbound and outbound, virus checking on the mail server: they all greatly reduce the risk of these Windows plagues.
And I thought it was all pretty much standard practice.
I personally think that individuals should take more responsibility for their equipment. It's not really the ISP's business to put in firewalls - perhaps if the users were to pay for the additional service, then the ISP can provide... The individual can always put in a firewall themselves which would only allow port 25 connection to their ISP's mailserver.
Perhaps - a "manditory" additional fee for a firewall for those who do not have an operational firewall?
Just thinking aloud....
-- The universe began. Life started on a billion worlds...
-- Except on one where stupidity was there first.
You mean, like Firestarter?
http://firestarter.sourceforge.net/
It doesn't require any knowledge to configure the firewall.