Printable View
Anybody seen this yet?
http://msnbc.msn.com/id/4788445/
Quote:
Watson, who runs the www.terrorist.net Web site, predicted that hackers will understand how to begin launching attacks "within five minutes of walking out of that meeting."
I'm coming up with nada....
Hmmm, I smell the distinct stench of BS. Here's why:
The idea of taking down the internet's core routers has been around forever. In fact, known BGP vulnerabilities have existed for years. Also, the less technical and probably more effective way to knock out a large section of the internet is to simply destroy the physical location where the routers are housed. I happen to know of one location on the east coast where it would be very easy to plow a truck through a building where one of these core routers is located.
Giving this guy credit for reading an RFC and then saying that he has discovered this core weakness is BS. Even better, Amit Yoran, who I think is a clown, wouldn't know a vulnerability if it jumped up and bit him in the ass. He is a DHS front man, nothing more.
OK, rant over.
:)
This isn't a BGP vulnerabilitie thehorse, this is a TCP vulnerability. Advisory here.
Yes, I understand that. However, its not as simple as just a TCP issue. My point is that before any of this came along, there were other ways to take down the internet.
Yeah, same stuff.
In short, it's a way of resetting TCP sessions. In most applications (where TCP-sessions are relatively short) this isn't really frightening. However, applications that depend on one continues TCP-session are in trouble. That's how I read it, but I could be wrong - I'm no tcp/ip wizz :)
Yahoo also has an article that’s high in bs but low on details.
http://story.news.yahoo.com/news?tmp...nternet_threat
Hoss is pretty much right here.... (Sorry Hoss, don't mean to go giving you are good rep ;)), but there are a lot of ways to bring down the internet... The cleanest and easiest has always been the root servers.... kill them and you kill the internet for anyone that doesn't know the IP address of the place you are trying to contact. It's been tried a few times.... IIRC the best attempt brought down 3 of the 17, degraded another 4 and couldn't touch the remaining 10, that's less than 50% success in the attack but the overall effect was much less mainly due to lower level servers caching a lot of stuff that they didn't used to and the fact that the attacker has to maintain the attack for a long period - the longer the attack is required to be in place the more time defenders have to mitigate it......
This attack, mainly successful against BGP, is a little different insofar as it requires the initial shutdown of the protocol while it rebuilds the routing tables and the routes "settle". Once that has occured it either has to be re-attacked, (mitigatable if you keep attacking from the same locations), or constantly attacked to keep the routing tables from being created, (also easily mitigatable). The solution is to make single, coordinated attacks from ever changing IP's, in order or spoof the addresses of the attacker. Ever changing IP's is harder to mitigate especially if the originating IP is spoofing too - but it's trackable over time and requires a large infrastructure on the attackers part. Simple spoofing from constant IP's, (less burden on the attacker), is relatively easily mitigatable too with upstream ACL's applied.
People who come up with exploits are excited about them, they see the potential for "huge" disruption easily - they tend to "overlook" the potential burden on the attacker or the relative ease of mitigation in the real world because it detracts from their discovery.
I don't think that this particular exploit will go much further, (if as far as), the root server attack that did relatively little harm.... The defenders of the "key points" are pretty good too you know..... ;)
Thanks all... I wonder if people at MSN ever research these stories before they throw them out like that... they are beginning to disappoint me.
slashdot has this as well as well as a link to the actual write up for the vuln.
http://www.uniras.gov.uk/vuls/2004/236929/index.htm
http://www.slashdot.org
The good folks at SANS also have a writeup on the vulnerability, along with an announcement from Cisco that there is a DOS vulnerability in SNMP processing. I have seen some interesting (bad) things happen when BGP routes start flapping all around the internet, and given that tools have been seen in the wild, only a matter of time before some kidiot does something nasty...
/nebulus (late to the game as usual)
This is news? Must be a slow day. Until we see it being exploited in the wild, I'm not sure there's a whole lot of reason for concern or shouting...
Another Link Here
http://zdnet.com.com/2100-1105_2-5195909.html
Ok, so now I am curious. I was quite happy with thehorse13's explanation at the top.
So one of two things is happening, and I strongly suspect that part of it is to generate publicity for Watson's upcoming conference....
Either it really is a potential problem, and nobody has stumbled across it in the last year since its discovery (which I find unlikely)..
Or the media is blowing everything wholly out of proportion, which we all know the American press in inclined to do anyway. The part I find intriguing is that it's spreading to other more credible sources... so now I'm not exactly sure what to think. I guess we'll just have to wait and see.
Heads up everyone, anything that uses the TCP protocal is in for some serious crap:
http://www.infoworld.com/article/04/...warning_1.html
Hey Hey,
For anyone who's interested, there's some what of a discussion @ http://www.antionline.com/showthread...hreadid=256932
I believe it was mentioned in another thread as well, but that's the only one that really had any activity.
Thanks for the new link on the subject LB.
Peace,
HT
Before going off the deep end on this like most people have, please read the SANS ISC report
http://isc.sans.org/diary.php?date=2004-04-20
and take a good look at the solutions and what is truly affected. Some vendors have previously, or recently fixed this already (or at least fixed to the best of they're ability). This report also reiterates the most likely use of this flaw. If you werent using checksums on your BGP and VPN's everywhere possible you should be now.....
On a coincedental note, I wonder what with all the recent major vulnerabilites popping out why the media chose to latch on to this one?? It's big but the recent SSL issues and even todays Cisco SNMP issue are just as likely to affect backbones....
the Cisco SNMP reload issue can be found here:
http://www.cisco.com/warp/public/707...420-snmp.shtml
They are right though, when it rains it pours!! While we all wait for vendor patches, watch in amazement as 80% of the world doesnt patch, and scream in anguish at the systems we cant patch we can only hope that it gets better? I shoulda been a garbageman.
It's an old theory, but a new way to exploit the flaw. The reason for the uproar is that it is so widely effecting. In all the documentation mention of checksumming bgp transmission to mitigate this is there, and honestly if your running a core router (or even a small network router) with BGP and your not checksumming... then maybe you shouldnt be in charge of that router. Much like any other state based attack this can open the door for yet another bunch of scripts for yet another bunch of losers to use to launch yet another type of denial of service... And while activity may hit in the short term and it may cause some problems... eventually it will calm, and end up being just another denial of service.... which makes me wonder.... if everyone used ingress filtering, broadcast amplification wouldnt be a problem and yet broadcast based DDOS attacks are still just as possible. Perhaps we're just looking at another pain in the netadmins arse...
Or I could be off base and the age old TCP protocol may be in desparate need of revamping, why IPV6 never rolled the way they planned is another question we may need to ask. Rates right up there with why people still dont update antivirus, why VPN's arent in use more often, and why we've all become so reliant on vendors to patch things in "the nick of time".
/end rant
for all the "kiddies", I decided to go ahead and make a tool that can execute this attack. this way people will have something they can actually play with, see how it works and understand what the impact is.
You can read about it at www.iamaphex.net
Or you can download the tool directly from http://www.iamaphex.net/modules.php?...q=getit&lid=52
This works on Windows 2K and XP only (untested on 2003) because it needs raw sockets to spoof the ip addresses.
I'm just waiting to see what happens when after Cisco releases its new IOS, only 20% of network admins upgrade.
I can see your vision JRC, it is kinda like the beginning of Terminator. A network admin is at his office at his computer. He has just downloaded the latest patches for everything, however he decides that he will patch everything tommorrow.
Then you just pan through a bunch of burning computers where his network once stood while giant armored skiddes run through with their DoS Guns from the future.
(Add On)
You know, after going to the "affamed" hackers webpage www.terrorist.net I don't think the net has anything to worry about. If the kid that claims he can take down the internet can't even construct a working webpage, well...<insert sarcasm here>
Merged another thread into here.
Don't I know you from somewhere?? :DQuote:
for all the "kiddies", I decided to go ahead and make a tool that can execute this attack. this way people will have something they can actually play with, see how it works and understand what the impact is.
Something does strike me about this and perhaps I missed it in all the other posts but don't you need to know that the connection exists to be able to kill it and doesn't ettercap do this already!? (maybe I'm missing something here..)
?? As soon as some application is running over a network, you know that at least one connection exists. If you can snif the network, you should have everything you need to kill it - or maybe that's exactly what you're saying :)
Yes but here's the trick: I can detect connections running on MY network but say a connection from Australia to a location in Germany? For example, TheRealAphex's tool requires both source and destination IP. I might have one for a remote location but both? I don't know if this could be as wide as they claim it.Quote:
As soon as some application is running over a network, you know that at least one connection exists. If you can snif the network, you should have everything you need to kill it - or maybe that's exactly what you're saying
And yes, if I can sniff the network I can kill it (proven before elsewhere) which makes me wonder as to how "new" this is. Sounds more like FUD to me.
Isn't that the problem with all injection-based attacks?Quote:
Originally posted here by MsMittens
Yes but here's the trick: I can detect connections running on MY network but say a connection from Australia to a location in Germany? For example, TheRealAphex's tool requires both source and destination IP. I might have one for a remote location but both?(snip)
Yes but the media is blowing it out of proportion. I had a colleague in a panic yesterday because he heard on the radio about the vulnerability and that "hackers could bring down the Internet". It's a FUD issue.Quote:
Isn't that the problem with all injection-based attacks?
Ms. M:
I think the key to the "danger" here is that you only need to be able to guess the source and destination. You may be able to go further and determine whether the routers are using BGP by making BGP reqeusts to them and seeing if they respond appropriately.
For example a tracert to yahoo comes up with these hops.... These are going to be fairly important routers. I can see that hop 8 can talk to hop 9 directly. If I want I can spoof hop 8's address at hop 9's router and try to tear down the connection. If I'm lucky and succeed then I put that route down for the period it takes to bring the connection back up and rebuild the routing tables.
8 30 ms 20 ms 50 ms p5-2-0-1.rar1.chicago-il.us.xo.net [65.106.6.173]
9 30 ms 60 ms 40 ms p0-0.ir1.chicago2-il.us.xo.net [65.106.6.134]
10 91 ms 60 ms 30 ms so-2-3-3.edge1.chicago1.level3.net [209.0.225.13]
If I'm a bit fancier I'll send a BGP request to both routers, (I'm not familiar with BGP but they have to respond in a recognizable fashion). If I get a satisfactory response from either or both I can bring down one or the other or both.
An automated app collecting tracert info and passing the middle router's information to a "scan" engine that looks for BGP and or any other exploitable protocol/implementation that then passes the vulnerable routers IP's to the attack engine would probably be fairly trivial for someone to come up with. If that were to happen then the impact would be noticable along given routes. It's mitigable by the fact that the original source could be tracked in a fairly short time and blocked. But that's where the imagination and planning of the attacker comes in.
Yes, I think this could be a fairly damaging attack were it to be properly executed.... But I think you'll find that many of the routers that are quite key to the backbones are being upgraded/patched/mitigated as we speak.
So basically this amounts to: If ISPs implemented proper egress/ingress filtering, this would be a non-issue. Good to know.
csch: You said if...... Little word..... Big meaning.... ;)
Tegir Shrak: Yes, I did say If, not all do. Some do however.Quote:
IPV6 has been talked about long before I even owned a computer...Which isn't long, but There is more to this than "Well just switch to IPv6 and all the problems go away right?" No, This from what I understand hasn't had the testing IPv4 has. Remember when the internet came together?Quote:
Originally posted here by THEJRC
Or I could be off base and the age old TCP protocol may be in desparate need of revamping, why IPV6 never rolled the way they planned is another question we may need to ask. Rates right up there with why people still dont update antivirus, why VPN's arent in use more often, and why we've all become so reliant on vendors to patch things in "the nick of time".
/end rant
IPv6 is not ready yet. They may have professional security guys working on it to see what could happen, but those security guys know what they are looking for, and can NOT create the same problems the average moron on the internet could. It takes an idiot to find/create REAL problems, security research guys can find most of the usual bugs in something, but like I said, let Alabama have a crack at it before it gets released to the public.
And what the hell are we going to do with enough IPs to give every person on earth one? ;)
@MsMittens
yes my tool requires a bit of information but information that doesn't require you to actually know the full tcp header. in fact you only need 2 things that aren't obviously given to you. the client source ip and port.
for someone connected to irc with a hostmask or a webserver serving pages to individuals, it wouldn't be that useful because you wouldn't know the ips of all the users and it would require disconnecting them each but for example 2 IRC servers that are linked, you would know both IPs and you would know the range of the ports on one side of the connection (6660-6669 for example or a port scan could reveal a non-standard port) and the other side could be detected using various probes.
then armed with a few details that aren't that hard to obtain, you can cause a netsplit, and you could do it in under 8 minutes on a cable modem with one host.
to say nothing of a distibuted attack with some fat pipes.
In addition I thought people might be interested in what Major ISP's are doing to deterr this kinda of attack. Enter md5 authentication. Look it up.. you might be surprised how simple a concept it is.
Best info i found on this vulnerability.
http://www.uniras.gov.uk/vuls/2004/236929/index.htm
For those interested, the source for the tool posted by TheRealAphex is now on K-otik.
Hey all,
I get the security updates from Watchguard because I have a firebox 700 and like to see the updates, usually the updates are pretty boring, but thought this one was kind of interesting.
Article talkes about the flaws of TCP (hehe wow.. really .. a flaw in TCP...how canny is that.... :-) )
Anyway its a good read and short on TCP-BGP-Watchguard.....and also relates to routers that run BGP as a protocol.
Enjoy!!
TCP Attack Affects Firebox Models
Severity: Medium
22 April, 2004
Summary
On Tuesday April 20, several network security news outlets released information about a new Internet attack technique, in anticipation of a major speech on the subject delivered today. Subsequently, many major media outlets distorted the significance of the attack technique. The technique can be used to cause instability and Denial of Service in network routing infrastructures. WatchGuard customers are encouraged to understand the limits and the nature of this attack and take appropriate steps to protect themselves.
Overview
On Tuesday April 20, 2004, numerous network security information outlets released an advisory about a "new" Denial of Service (DoS) attack exploiting a weakness in the TCP protocol, one of the building blocks of the Internet. This attack technique is, in fact, not new. It was first brought to light in May 1998 at a Congressional hearing on network security (and has been discussed in some form since the founding of the Internet). What is new is that researcher and statistician Paul A. Watson has shown that exploiting the vulnerability is easier than was previously thought. Major router vendors have known about this new attack for at least four weeks and have been working with their customers to develop patches and get them deployed before public disclosure of the new attack.
In brief, if an attacker knows the source address and port, and the destination address and port (a four-tuple) for a long-lived TCP session, under certain circumstances the attacker could use this information to reset the connection. Resetting the connection constitutes a DoS against the service.
What does this mean to me?
The short answer: Not a lot, unless you're an ISP or you have an unusual network.
While in theory all applications that use TCP are vulnerable to this attack, in practical terms, the exposure is quite limited because most TCP sessions do not last long enough to readily enable the attack. The application that is most susceptible to this attack is called Border Gateway Protocol (BGP), the most common routing protocol on the Internet. BGP provides a way for routers to share information with one another about what addresses they route for. BGP uses a long lived, TCP connection to share this information. Central to BGP is the notion of a peer. Peers exchange information about the networks they route traffic for.
If an attacker were to reset the connection between two BGP peers, both of them would start the process of rebuilding their routing tables. While the routers are doing that, their ability to route traffic is impaired. If an attacker does this to enough routers with large enough routing tables he could effectively "disconnect" those routers and all of the people who rely on them from the Internet. Since one vulnerable router can disrupt all of its peers whether they are vulnerable or not and the vast majority of ISPs connect their routers with each other using BGP, the major ISPs are taking this very seriously.
Because BGP is an advanced routing protocol, most small to mid-size organizations don't have the sort of network where BGP is used. For modestly sized networks, BGP is generally more trouble than it's worth. In the typical small to mid-size network, any impact from this attack will probably be indirect, experienced as an inability to get to certain parts of the Internet or, if the attack is directed at the organization's ISP, inability to access the Internet at all.
How are WatchGuard firewalls affected?
We believe there are only two aspects of Firebox functionality that would be affected by this new attack.
A Firebox Vclass configured as a BGP peer.
As discussed above, BGP is particularly susceptible to this new attack. BGP is one of the dynamic routing protocols the Firebox Vclass supports, and therefore a Vclass product implementing BGP is vulnerable. In order to mitigate the effects of the attack we recommend that you:
Implement ingress and egress filtering to check that the traffic entering or leaving the network has a source IP address that is expected on the router/firewall interface that receives the traffic.
Limit the amount of information available through network diagnostic tools and DNS resource records, being careful not to expose TCP port information unnecessarily.
Note that your Vclass firewall can also be impacted by this new attack if a router with which it peers is successfully attacked. The impact of this attack against the Vclass or the peer would be a disruption in routes handled by BGP.
The Firebox logging channel
The Firebox logging channel for Firebox II/III/X maintains a single, long-lived TCP connection, and the source/destination ports and addresses are easily discovered or guessed. This means the Firebox logging channel meets the criteria required for this attack to work. However, since the logging channel will cache log entries on the Firebox until a connection can be re-established, or fail over to a secondary log server in the event the connection between the Firebox and the log server is broken, an attack against the logging channel would have minimal impact on the performance of the network and the ability of an administrator to receive the logs.
Conclusion
While the potential impact of this issue is far-reaching for the Internet as a whole, and should cause some concern for all Internet users, most users of WatchGuard products are not likely to be directly impacted by it.
heh I should check back on my threads more often...
While the flaw is serious in nature... and BGP keeps getting brought up (along with the gotta know source and destination ports blah blah blah and exploit tool blah blah) I'd like to bring up one important thing to keep in mind.....
This attack only works on connections with lengthy windows (BGP for instance) while there could be serious threats to DNS, SMTP, and the like.. nobody seems to have prodded much.... in reality, theres a million wide open machines out there on high speed home broadband links which can be quickly compromised (if they havent been already) by much quicker tools, and can launch more effective attacks with much less effort. we're looking at another fun skiddie sploit and thats really about it.
We need to focus on awareness of mitigation for the masses (uh laymans that means we need to teach jim home user to update his damn antivirus) more than anything at this point. If the other much much smaller (and already patched) vulnerabilities were nonexistant (because users patch and update) then maybe we would have cause for alarm... but of course it doesnt take much to launch any flood based denial of service from a bunch of zombied machines... and this is just another denial of service vulnerability (although more direct and complicated).
Just my 2 cents... and now I'm broke...