holisticinfosec.org on SPA Ghost Services
05 January, 2010
Russ McRee of holisticinfosec.org
has written the January Toolsmith
issue from the ISSA Journal about fwknop and the ability to create
ghost services with Single Packet Authorization. In his Toolsmith paper, Russ emphasizes
the possibility of using the ghost services concept to bypass strict outbound network
filtering rules on a local network in order to access an external service that is bound
to a port that is filtered by the local firewall. That is, the service is made accessible
by having the SPA packet created by the fwknop client request that the remote fwknopd server
create iptables DNAT rules to forward connections to a port that the local network actually
allows out to the port where the service is bound. Russ uses this concept to access a file
that is piped through a netcat listener on TCP port 6543, but do it from the heavily
filtered network over TCP port 110 (normally associated with pop3).
Here is a link to the Toolsmith PDF entitled "Single Packet Authorization: The Ghost in the Machine".
