Re: [IPsec] draft-kivinen-ipsecme-esp-null-heuristics comments

[Tero Kivinen <kivinen at iki.fi>]

Grewal, Ken writes:
> [Ken] In some cases, the certainty must be 100%, otherwise there is
> no control. E.g. A new exploit has just been published for certain
> types of traffic - published vulnerability where a virus/worm can
> exploit a 'buffer overrun/stack overflow' condition for a given
> piece of software providing a given service, which subsequently
> allows a hijacker to take control of the machine/server. That
> service MUST be shut down to ensure that the vulnerability cannot be
> exploited and spread. This may or may not result in shut down of the
> server hosting the service, as you may want to allow remote
> patching, etc. Easiest way to do this is to block the port over
> which the vulnerability is being exploited.  

Which does not help if you allow any encrypted ESP traffic to the
host, as the attacker will then just use encrypted ESP to make the
attack. On the other hand if you do not allow any encrypted ESP
packets, you KNOW that all packets are ESP-NULL, which makes the
packet checks much easier even for stateless devices.
-- 
kivinen at iki.fi