4 ms·

This is a metric ton of completely pointless theater. Your services should simply be unreachable over anything but wireguard (or another secure VPN option).

Joel_Mckay 1y ago
Depends on the use-case, IPsec is often not supported by many LANs. Also, network crossing is 1 badly configured client away from full infrastructure worming. At some point, the idealism of white-listed pears and VPN will fail due to maintenance service costs. Two things may be true at the same time friend. =3 https://www.poetry.com/poem/101535/the-blind-men-and-the-elephant https://www.poetry.com/poem/101535/the-blind-men-and-the-ele...
- frumplestlatz 1y ago
  Yes, and those two true things are: - You should be using WireGuard. - “Port knocking” is pointless theater.
  - Joel_Mckay 1y ago
    CVE-2024-26950 is also true, and while I respect your opinion... a VPN has a lot of additional links in the chain trivially broken by competent hostiles or incompetent client installations. IPSec is simply a luxury unavailable on some LANs =3
    - tptacek 1y ago
      I don't understand what you think CVE-2024-26950 has to do with this thread. Do you understand what that vulnerability actually is, or did you just go search "WireGuard CVE" to find ammunition?
      - Joel_Mckay 1y ago
        Firewall administrative network port traffic priority is important for systems under abnormal stress.
        tptacek 1y ago
        I don't know what this even means. Do you understand the vulnerability you cited? Can you explain it here?
        Joel_Mckay 1y ago
        The relatively benign legacy kernel level pointer-bug CVE chosen is hardly the worst thing from WireGuard or strongSwan over the years. However, it makes the point a priority reliable network side-channel administrative login is more robust under some use-cases. Adding layers of complexity rarely improves security, and doesn't usually address the underlying issue of accountability. And I often ponder if a bastion host is even still meaningful in modern clouds. =3
        tptacek 1y ago
        The bug you cited is in Netlink. It's not exposed on the network. What's the "worse" thing you're referring to? I think you just searched "WireGuard CVE" and tried to play it off.
        Joel_Mckay 1y ago
        In general, doing a qualitative summary of the projects impact is less helpful, and never as verbose as some would prefer on platform specific issues. Additionally, wireguard is now more popular than strongswan these days... https://www.cve.org/CVERecord/SearchResults?query=ipsec https://www.cve.org/CVERecord/SearchResults?query=ipsec https://www.cve.org/CVERecord/SearchResults?query=wireguard https://www.cve.org/CVERecord/SearchResults?query=wireguard https://www.cve.org/CVERecord/SearchResults?query=strongswan https://www.cve.org/CVERecord/SearchResults?query=strongswan Best of luck, and straw-man arguments are never taken seriously. =3
fencepost 1y ago
"We had a secure VPN option set up, but then we had to replace our Ivanti VPN solution so we switched to Fortigate. Then there were some concerns so we jumped to Sonicwall. After that debacle we finally got the budget to go with Cisco and I'm sure everything will be fine now!"
- frumplestlatz 1y ago
  I said a secure VPN option. However, even with all those choices, “port knocking” still wouldn’t be a solution for anything. [edit] Are you just searching for random WireGuard CVEs now? CVE-2024-26950 was a *local-only* DoS and potential UaF requiring privileged access to wireguard netlink sockets.
  - Joel_Mckay 1y ago
    You mean CVE-2024-26950 ? =3 <edit> Firewall administrative network port traffic priority is important for systems under abnormal stress.
    - deleted 1y ago
      [deleted]
- immibis 1y ago
  These are what I call, corporate solutions. They're used to make CEOs feel good while deflecting blame, not to actually do the job. See also how nobody gets blamed if AWS goes down, but everyone who used a different host with higher uptime did get blamed when that went down. Open source tools are good at actually doing the job, as long as it's a programmer type of job. We've known how to do unbreakable encryption for decades now. Even PGP still hasn't been broken. Wireguard is one of those solutions in the "so simple it has obviously no bugs" category - that's actually what differentiates it from protocols like OpenVPN. Think about the recent satellite listening talk at DEFCON and how that massive data leak could have been prevented by even just running your traffic through AES with a fixed key of the CEO's cat's name on a Raspberry Pi, but that's a non-corporate solution and so not acceptable to a corporation, who will only ever consider enabling encryption if it comes with a six figure per year license fee which is what the satellite box makers charged for it. Corporations, as a rule, are only barely competent enough to make money and no more.

Joel_Mckay 1y ago

Depends on the use-case, IPsec is often not supported by many LANs. Also, network crossing is 1 badly configured client away from full infrastructure worming. At some point, the idealism of white-listed pears and VPN will fail due to maintenance service costs. Two things may be true at the same time friend. =3 https://www.poetry.com/poem/101535/the-blind-men-and-the-elephant https://www.poetry.com/poem/101535/the-blind-men-and-the-ele...

frumplestlatz 1y ago
Yes, and those two true things are: - You should be using WireGuard. - “Port knocking” is pointless theater.
- Joel_Mckay 1y ago
  CVE-2024-26950 is also true, and while I respect your opinion... a VPN has a lot of additional links in the chain trivially broken by competent hostiles or incompetent client installations. IPSec is simply a luxury unavailable on some LANs =3
  - tptacek 1y ago
    I don't understand what you think CVE-2024-26950 has to do with this thread. Do you understand what that vulnerability actually is, or did you just go search "WireGuard CVE" to find ammunition?
    - Joel_Mckay 1y ago
      Firewall administrative network port traffic priority is important for systems under abnormal stress.
      - tptacek 1y ago
        I don't know what this even means. Do you understand the vulnerability you cited? Can you explain it here?
        Joel_Mckay 1y ago
        The relatively benign legacy kernel level pointer-bug CVE chosen is hardly the worst thing from WireGuard or strongSwan over the years. However, it makes the point a priority reliable network side-channel administrative login is more robust under some use-cases. Adding layers of complexity rarely improves security, and doesn't usually address the underlying issue of accountability. And I often ponder if a bastion host is even still meaningful in modern clouds. =3
        tptacek 1y ago
        The bug you cited is in Netlink. It's not exposed on the network. What's the "worse" thing you're referring to? I think you just searched "WireGuard CVE" and tried to play it off.
        Joel_Mckay 1y ago
        In general, doing a qualitative summary of the projects impact is less helpful, and never as verbose as some would prefer on platform specific issues. Additionally, wireguard is now more popular than strongswan these days... https://www.cve.org/CVERecord/SearchResults?query=ipsec https://www.cve.org/CVERecord/SearchResults?query=ipsec https://www.cve.org/CVERecord/SearchResults?query=wireguard https://www.cve.org/CVERecord/SearchResults?query=wireguard https://www.cve.org/CVERecord/SearchResults?query=strongswan https://www.cve.org/CVERecord/SearchResults?query=strongswan Best of luck, and straw-man arguments are never taken seriously. =3

fencepost 1y ago

"We had a secure VPN option set up, but then we had to replace our Ivanti VPN solution so we switched to Fortigate. Then there were some concerns so we jumped to Sonicwall. After that debacle we finally got the budget to go with Cisco and I'm sure everything will be fine now!"

frumplestlatz 1y ago
I said a secure VPN option. However, even with all those choices, “port knocking” still wouldn’t be a solution for anything. [edit] Are you just searching for random WireGuard CVEs now? CVE-2024-26950 was a *local-only* DoS and potential UaF requiring privileged access to wireguard netlink sockets.
- Joel_Mckay 1y ago
  You mean CVE-2024-26950 ? =3 <edit> Firewall administrative network port traffic priority is important for systems under abnormal stress.
  - deleted 1y ago
    [deleted]
immibis 1y ago
These are what I call, corporate solutions. They're used to make CEOs feel good while deflecting blame, not to actually do the job. See also how nobody gets blamed if AWS goes down, but everyone who used a different host with higher uptime did get blamed when that went down. Open source tools are good at actually doing the job, as long as it's a programmer type of job. We've known how to do unbreakable encryption for decades now. Even PGP still hasn't been broken. Wireguard is one of those solutions in the "so simple it has obviously no bugs" category - that's actually what differentiates it from protocols like OpenVPN. Think about the recent satellite listening talk at DEFCON and how that massive data leak could have been prevented by even just running your traffic through AES with a fixed key of the CEO's cat's name on a Raspberry Pi, but that's a non-corporate solution and so not acceptable to a corporation, who will only ever consider enabling encryption if it comes with a six figure per year license fee which is what the satellite box makers charged for it. Corporations, as a rule, are only barely competent enough to make money and no more.