Recently, the next generation or "application aware" firewall has come onto the scene as the next logical progression of firewall technology and the platform of choice for enterprise traffic filtering needs. However, many vendors have overstated the capabilities of these firewalls and how the underlying technology really works. This talk will examine how next generation firewalls make decisions and how application awareness works, and then dive into the security tradeoffs they make in the name of performance. A new tool, Fireaway, will be demoed to show how the techniques covered in this talk can be automated to completely bypass firewall rules, exfiltrate data and establish obfuscated command and control channels through the firewall, all while looking like normal user activity.
Russell Butturini is the senior enterprise security architect at a large healthcare company in Franklin TN. He occasionally has good ideas and he presents on them at places such as DEFCON, Derbycon, and various BSides. In his free time, he has a compulsive gambling problem when it comes to betting on horse races, so he's hoping the Derbycon goons make sure he shows up for this talk and isn't on a multi day gambling bender at Churchill Downs.