Posted on 10/01/2008 1:28:30 PM PDT by ShadowAce
Things are a-brewin’ in Sweden. Sweden is not just home of the infamous bikini team, it is also the home of Outpost 24, an equally sexy software-as-a-service network scanning service, and the employer of my friend Robert E. Lee and his colleague Jack C. Louis. These guys are the inventors of UnicornScan, a user-land TCP stack turned into a port scanner. Never heard of it? Use Nmap exclusively? Well if you run Linux, I suggest checking it out, especially if missed ports in your portscan is inexcusable. But I digress.
Robert and Jack are smart dudes. I've known them for years, and they've always been one step ahead of the game. A couple of years ago, Jack found some anomalies in which machines would stop working in some very specific circumstances while being scanned. A few experiments, tons of reading through documentation, and one mysteriously named tool called "sockstress" later, and the two are now touting a nearly universal denial-of-service (DoS) attack that can be performed on almost any normal broadband Internet connection -- in just a few seconds.
How bad is it? Well, in an interview --- (fast-forward five minutes in to hear it in English), the two were asked if they could take out a data center. While they've never tried, it appears to be a totally plausible attack. Worse yet, unlike most DoS attacks, the machines often do not come back online once the attack is over. The victim system just doesn’t respond any more. Great, huh?
Robert and I talk a lot, and I asked him if he'd be willing to DoS us, and he flatly said, "Unfortunately, it may affect other devices between here and there so it's not really a good idea." Got an idea of what we're talking about now? This appears not to be a single bug, but in fact at least five, and maybe as many as 30 different potential problems. They just haven't dug far enough into it to really know how bad it can get. The results range from complete shutdown of the vulnerable machine, to dropping legitimate traffic.
The two researchers have already contacted multiple vendors since the beginning of September (I've had a small hand in getting them in contact with one of the vendors). Robert and Jack are waiting with no specific timeline to hear back from the affected TCP stack vendors. Think firewalls, OSes, Web-enabled devices, and so on. Yup, they'll all need to be hardened, if the vendors can come up with a good solution to the problem. IPv6 services appear to be more affected by the fact that they require more resources and are no more secure since they still reside on top of an unhardened TCP stack.
Jack and Robert are both trying to be as forthcoming as possible with the affected vendors without giving any specific information on how the attack works to the public at large -- openly acknowledging how dangerous the attack really is. Their hope is that the vendors appreciate the problem and come up with fixes that may not be initially obvious to them. I asked Robert when they planned to release their tool, to which he said he wasn't sure he would "ever release sockstress." The details, however, will be forthcoming once vendor patches are available. There are no mitigating short-term fixes, folks.
I feel winter slowly coming, and it would be a shame if entire power grids could be taken offline with a few keystrokes, or if supply chains could be interrupted. I hear it gets awfully cold in Scandinavia.
I read this a lot about DoS attacks and other such things being feared because of possible impacts on power grids and other infrastructure, but has there really ever been a case of this? Just curious...
Rules!{p>
Don't see much of Bushwa and the Yellow Buzzard. :-)
A line that could only be written by one of these:
I'll forgo my usual response (quoting Jayne from "Firefly").
Been busy. Haven't been home since late August. :)
Don't see much of Bushwa and the Yellow Buzzard. :-)
Bush dropped away a few years ago, and GE (I'm guessing here) got tired of being beaten on every conversation he had with people who know better. :)
It is bad karma to post an odd number of pictrues of women in a thread. You need to add 1 or 3 or 5 or ... more.
DULY NOTED AND LOGGED!! LOL!
It's been about 2 years since I was here. I seem to come back about every election cycle.
For a dollar more they could’ve been blondes.
Wow! Nice hair...
BTTT
THANKS for the heads-up! I’m looking into it NOW!
I’ll grab a copy of this ASAP and see what it will do. :-)
If their tool affects Cisco devices, we would all be screwed if that thing goes ‘public’.
I remember years ago seeing a small ARPA-net node sitting at Gunter AFS, back before we had Email, Usenet, and Internet. The original underpinnings of the Internet were developed to be cooperative, with what at the time were reasonable measures to eliminate or recover from "errant" devices. Computer "viruses" et al were unknown at that time.
With all of the info about various attacks we read lately, we realize again and again how fragile software can be.
Oh yummy!
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.