[6bone] Re: Internal Address Space

[Jeroen Massar]

Michel Py wrote:

<SNIP>
> By initiating the traffic from the inside at both hosts, which opens a
> temporary hole in the firewall to allow return traffic. A good example
> of that kind of trick is Morpheus: People can pull mp3s from your RFC
> 1918 host crossing NAT and crossing a stateful firewall  _without_
having
> to punch a hole in the firewall and without static NAT configuration.
I
> think that teredo also allows to do the same. All these mechanisms are
> based in contacting an agent outside; if that agent is listening on
port
> 80 there is not much you can do to prevent your host talking to it.

As long as one has a bit of clue and has "data" going from the inside to
the outside you can do anything you want.
Unless you got a team of sniffing admins who destroy anything that even
looks suspicious.
Just think: IP over Email, IP over HTTP etc. If you want to have a
secure network you'll need
to fully trust your local users and ofcourse the software they use.
Effectively that's a nogo everywhere you go.

Greets,
 Jeroen

BTW: Just in case someone claimes "But I can check all my OpenSource
software for backdoors":
Start reading _and_ understanding for instance the linux kernel,
Mozilla, KDE, etc... and we'll hear
back from you in a couple of years. It's all about trust, but do you
trust your glass of milk ? :)