Cisco Adaptive Security Appliance goes beyond blocking ports. Is that a Microsoft-only defense?

Discussion in 'Cisco' started by Ramon F Herrera, Mar 2, 2007.

  1. I recently installed my first Cisco ASA-5500 security box. It is a
    very impressive piece of equipment, with a bewildering array of
    capabilities. The feature that find most intriguing is that it goes
    above (in the ISO/OSI sense) the IP, TCP and UDP layers, presumably
    inspecting whether a message or packet contains a virus or other
    malware.

    What I would like to clarify, because is a matter of dispute among
    some colleagues, is exactly what applications and operating systems
    are being inspected. My buddies claim (more like a wild or hopeful
    guess) that not only is port 1521 of an Oracle server blocked but the
    ASA knows about Oracle exploits, and similarly it can check for
    weaknesses on behalf of Linux or other Unixes. I find that very hard
    to believe, and my counterclaim is that only Windows or other
    Microsoft products have reached a level of disseminated infections to
    grant the depth of attention by the security software.

    Comments?

    -Ramon F Herrera
     
    Ramon F Herrera, Mar 2, 2007
    #1
    1. Advertisements

  2. Ramon F Herrera

    joel garry Guest

    Looking at the data sheets, it just looks like it uses typical trend
    micro stuff to look for malware. If they can point to something that
    specifically mentions Oracle, let us know.

    Most of us don't even use port 1521 anymore.

    Be afraid:
    http://www.securiteam.com/securitynews/6N00D1FEKE.html
    http://www.cisco.com/en/US/products/products_security_advisory09186a00806e9b6f.shtml

    Hey, maybe that means they do know what to look for!

    jg
     
    joel garry, Mar 2, 2007
    #2
    1. Advertisements

  3. Ramon F Herrera

    hpuxrac Guest

    Why don't you test it out?

    That starts by constructing a test case and determine how this device
    allows/prevents/alerts ...
     
    hpuxrac, Mar 3, 2007
    #3
  4. Please clarify. Are you claiming that most folks are simply using
    another port different from 1521 in hopes of confusing the attackers
    (due respect, but that would be a rather poor defense) or are they
    using a non-TCP mechanism to communicate with the server?

    -Ramon
     
    Ramon F Herrera, Mar 3, 2007
    #4
  5. I would have to open port 1521 in my firewall to see if I can
    compromise it remotely. Then try to break into my Linux machines, and
    similarly for the Macs. I simply don't have the resources. It would be
    so much simple if Cisco published it explicitly: "all the anti-malware
    tools we have is for Microsoft products".

    -Ramon
     
    Ramon F Herrera, Mar 3, 2007
    #5
  6. Ramon F Herrera

    joel garry Guest

    Search metalink and Oracle security related sites for the minimum
    necessary hardening. The proof of concept worm that was floating
    about not long ago got everyone in a tizzy about changing 1521. See
    http://www.dizwell.com/prod/node/374

    petefinnegan.com pointed to this: http://www.sans.org/score/oraclechecklist.php

    jg
     
    joel garry, Mar 3, 2007
    #6
  7. Ramon F Herrera

    JJ Guest

    I believe ASA is extremely limited right now and also requires a firmware
    update to improve its detection. I seem to recall it has about 30
    application layer checks versus Juniper's 100 application layer checks and
    versus Check Point's 1,700 application layer checks. I'm more familar with
    CP and it definitely knows about different exploits for many vendors
    products.

    Ray
     
    JJ, Mar 3, 2007
    #7
  8. Ramon F Herrera

    DA Morgan Guest

    Perhaps instead of talking to Cisco you should talk to F5 Networks.
    --
    Daniel A. Morgan
    University of Washington

    (replace x with u to respond)
    Puget Sound Oracle Users Group
    www.psoug.org
     
    DA Morgan, Mar 3, 2007
    #8
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.