bugtraq - Re: ICMP attacks against TCP: Conclusions

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Tue, 30 Aug 2005 18:16:46 +0400 (MSD)
From: Dan Yefimov <dan@...htwave.net.ru>
To: Fernando Gont <fernando@....utn.edu.ar>
Cc: bugtraq@...urityfocus.com
Subject: Re: ICMP attacks against TCP: Conclusions


On Thu, 28 Jul 2005, Fernando Gont wrote:

> Folks,
> 
> My posts to this list have tried to show how easy it is to perform ICMP 
> attacks against TCP.
> 
> The attacks are blind, so the attacker does not need to be a "man in the 
> middle" to perform then. The typical number of packets required to perform 
> any of these attacks is about 16000 (in many cases, the attacker requires 
> fewer packets). This means that even when a 128kbps link, it will take the 
> attacker much less than a minute to perform them.
> 
[skip]
...
> Big vendors' employees making misleading claims to the press have certainly 
> not helped to make people patch their systems, or push their vendors to 
> produce patches.
> 
> Those guys that have started nonsensical discussions about whether this is 
> new or not have not helped, either. And have not realized that the 
> discussion should be whether "this is current", rather than whether "this 
> is new".
> 
> I have received almost no feedback from "vendors". Unfortunately, they 
> don't realize that ICMP is a core protocol, and that discussion on the 
> counter-measures is needed for the benefit of us all.
> 
> Last, but not least, the IETF specifications need to address these issues. 
> If vendors patch their systems, but the IETF specifications are not 
> updated, there's a high chance that there will be brand-new vulnerable 
> implementations in the near term.
> 
> Get involved. Discuss the counter-measures. Get your vendor fix the 
> problems. And ask *how* they are fixing them (what if they just didn't 
> understand, and are not really protecting you, or causing more harm than 
> good?).
> 
> And have the specs address these issues. That's the real and final fix for 
> these issues.
> 
All we've heard from you are attack descriptions and claims for vendors to fix 
their OSes. It's easy to sit back and claim for others to do something. But
what we haven't ever heard from you are YOUR personal opinions and proposals on 
fixing the problem. So what personally you propose?
-- 

    Sincerely Your, Dan.