Printable View
I am just wondering what all of your opinions are on M$ decision to include user level access to the Berkly Raw Socket interface icluded in XP. I have several questions as fallows...
1. Was it a neccesary funtion to include?
2. Can we expect a new wave of PC based DOS attacks using the interface?
3. What can be done about "forged" malicious packets in the occurance of such an attack?
All right, I'd take time to write it all, but I'll go strait to the source:
Since all this "broo ha ha" was started by Steve Gibson (www.grc.com) why not take time to see the other (and true) side of the medal at www.grcsucks.com ... Scroll down to the Raw Sockets (XP) articles...
Ammo
microsoft says yes, some others say no.Quote:
Originally posted by Dygital
1. Was it a neccesary funtion to include?
i highly doubt it, but it is quite possible(probable IMHO) that you will see atleast a few DDoS progy's targeted directly at XP.Quote:
2. Can we expect a new wave of PC based DOS attacks using the interface?
well, if you mean forged as in the originating ip then at the ISP level they can make filters that will drop any packets that have an ip that is not in their network before it gets anywhere.Quote:
3. What can be done about "forged" malicious packets in the occurance of such an attack?
if you mean forged in terms of sending packets that say things they shouldnt(such as sending tons of SYN's, which would make the pc being DoS'd think you are requesting a connection), AFAIK nothing can be done. the pc recieving the requests will just keep sending back ACK/SYN packets and waiting for a responce. in the mean time its queue will fill up and it will not be able to accept valid incomming connections. atleast that is my understanding and i dont claim to be the all knowing god of networking, so please correct me if im wrong.
i would also like to add that from what ive read on grcsucks.com, the tend to ignore as many important points as gibson does. for instance: in http://www.grcsucks.com/grcdos2.htm the responder constantly talks about how "Raw Sockets have been around for years in Unix based operating systems, and although many script kiddiots have made the move, they have yet to take over the world with the functionality of it"...he leaves out the fact that DDoS attacks are Distributed, so you need compromised systems. windows is popular with people who dont know what they are doing so it is easy to get a few compromised win boxes where most unix users are more security-aware, so its a bit harder(plus its less popluar, hence a smaller number of boxes to try to compromise).
Raw sockets have been around for years, but only to root, not to every user on the computer. Imagine some script kiddie getting 300 broadband XP home users and attacking any website with an unstoppable denial of service attack. The only thing stopping it would be the will of the attacker. People wont complain about it until it is happening every day. Maybe if microsoft were to be attacked with their own stupid security flaw this would cause them to make a change. Not having raw sockets would not prevent the denial of service attack, but at least you could have filtering ability that would allow you to get back online. From http://grc.com:
"The fact that the technology of a fence or a lock is imperfect, does not obviate that measure's security utility. But this was exactly the defense I heard today for not bothering to improve XP's security. Can any locked car be stolen? Of course. So are locks on cars therefore pointless? Of course not. Why increase the difficulty of exploiting XP's Internet connectivity in one way, when there are other ways to exploit it? Because fences work . . . and full raw sockets are too easy to use."
At the risk of upsetting someone, MS has never really done the security thing very well. I don't think they really understand it, take file and printer sharing for example, "hello! the system is wide open by default".
DDoS's are popular becasue they are easy and and don;t take too much preperation, especially with root kits and the like.
MS is not going to do anything about this even if it turns epidemic. The next version of Windows will probably have raw sockets too.
I can picture the average clueless user going "Drrrrr, this XP sure runs slow on my AMD 1800 `XP' and 512 MB DDR RAM, I guess I need to upgrade". Meanwhile Mr. Malicious Process goes on undisturbed. Will be good for folks in the PC hardware retail business though :D.
well till now i have yet to see the world get doomed with MS into of raw sockets into XP. I have setup a network of 10 Xp systems all of which have net acces in a 100 mbps LAN. As far as a DOS attack goes, well a strict group policy and a good hardware/software base firewall dose seem to good bet as to stopping them. Although one feature that i see as a weak link is the automatic start up of the Remote Astitance Service on a XP box.
XP starts up remote assistance by default?
Even the Pro version?
[Not a problem for me cos I've disabled it, but its worrying that MS seem to let all kinds of services start up without the common user even knowing!)
well at the risk of heart breaking u my friend. Though by default Xp is resource hungry. But it is not that u always need a killer system to run it. We use a amd K6-2 500mhz with 64mb pc 100 ram of which 8 mb is shared by the graphics card . this system is our quake2 server, mail server, bastone host, intranet web server and also the print server !!! this system has a avg uptime of 88.76% since it was setup-- 5.5weeks. Giventhe ultra low config i'd say it value for money and hardware. I do admit it is slow but a shot of 128mb ram does wwonders for this system. so it not only about tweaking but also making the right choices. Any way it work for us.:rolleyes: :D
I run XP on an AMD K6/2-450 with 128 MB ram, 8 of which is used for the onboardv graphics!
I'd have to agree with your assessment 8Ball. Both sides of this particular coin are just media hogs. Gibson was trying to garner attention by making it such an issue, and whomever runs grcsucks.com was just attempting to piggyback on that attention by spinning their own version of things. Both sides ignore very critical facts, such as the one you pointed out in your post. I do think Gibson is correct in one area though: Microsoft DOES NOT understand security.
If you give it time, we'll start seeing viruses that use SYN floods with source IPs that randomize every few minutes probably in the next 18-24 months if I had to guess, unless XP really doesn't sell well. Code red was almost a warning shot. Imagine code red but instead of the lame DDoS it was attempting to use, it's armed with SYN flooding capability and source IP control that lets it change the source IP of the host every few minutes. Some fine tuning and a large base of XP Home Edition users would be all that's needed to make a virus that could quite literally shut down large sections of the 'net.
We'll just have to wait and see what happens, I suppose.
ya....add in theregister.com to the media hogs. i saw some stuff written by one of the guys there...lets just say almost as stupid as that "worst windows virus ever!" thread. i have to say that i lean more twards gibson's side than his oposition....99% of the arguements against him consist of nothing more than nitpicking spefic things he said rather than debating the actual issue...stuff like "he shows a picture of a programs hex code and the third number from the left in the thirtyith row is off by one number so he is obviously a total idiot and you should worship me for exposing him"
as i said above, however, gibson ignores several important issues. my opnion would be that he is at the learning stage with this stuff even tho he knows alot of other stuff quite well. as we all know alot of knoledge can be dangerious, but just a little of knoledge is deadly.
Speaking of Syn floods... I wonder if they'll include a service-pack thingy (if it isn't already there) to XP that would allow you to set Syn timeouts, such as a level of 'patience' with hosts trying to start an incoming TCP connection. That way, if you aren't running a server, you could give incoming connections a really low timeout, since it's likely you don't care much about people trying to connect to you.
I guess what I mean is that a syn flood is primarily a denial to others of a server. If you aren't concerned with being acessible to others who initiate contact via TCP, then it wouldn't be so damaging for your system to drop incoming TCP connections due to currently waiting for a ton of secondary SYNs.
From what I've read, this basically boils down to that programs on XP machines can do a lot more in terms of crafting packets, without relying on VXDs and many fancy-shmansy low-level modifications and additions, right? And that XP will be using (*nix-like) Berkeley sockets as opposed to ye olde Winsock?
I'm not very clear, personally, on the conflict. Is it that it just makes it easier for people to make programs that do socket/packet hyjinx? Well, that can be a great good or great evil. But it also might make it easier to craft programs designed to detect and curb Evil-Little-Viruses-&-Worms™.
Well, I don't know the ins and outs of writing low-level networking code under XP, but from everything I've read there is absolutely no reason to allow anyone other than the 'system' account access to edit packets at their leisure. Basically, from what I've read, NAT doesn't even require that kind of access, and modifying the source IP/dest IP in the packets is basically what it does.Quote:
Originally posted by Terr
I'm not very clear, personally, on the conflict. Is it that it just makes it easier for people to make programs that do socket/packet hyjinx? Well, that can be a great good or great evil. But it also might make it easier to craft programs designed to detect and curb Evil-Little-Viruses-&-Worms™.