bugtraq - Re: IPv4 fragmentation --> The Rose Attack

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <200404101323.i3ADNqnB012439@caligula.anu.edu.au>
Date: Sat, 10 Apr 2004 23:23:52 +1000 (Australia/ACT)
From: Darren Reed <avalon@...igula.anu.edu.au>
To: gandalf@...ital.net
Cc: bugtraq@...urityfocus.com
Subject: Re: IPv4 fragmentation --> The Rose Attack


In some mail from gandalf@...ital.net, sie said:
> 
> On 4/9/04 12:56 PM, "Darren Reed" <avalon@...igula.anu.edu.au> wrote:
> 
> > In some mail from gandalf@...ital.net, sie said:
> >> From my experience in the real world, specifically with Windows 98 (and I
> >> suspect ME) I would say that yes we should care.  You would probably be
> >> frightened at the number of people still running Windows 9* and ME.
> > 
> > In this particular case, whether someone is running Windows ME/9* is
> > irrelevant to me - it's a local attack against them that isn't likely
> > to affect me.
> 
> I work at many other places than on my own personal computers.  I would like
> to know if attacks might affect any number of computers.  I am a computer
> professional.

And if so, surely any place where you see "Windows 9*/ME" should bring a
"you need to start planning on upgrading/replacing these with 2K/XP, if
 you haven't already." styled response.

> Or program with queues that drop packets in a FIFO fashion that have enough
> memory that an attack will still allow fragmented packets to be serviced.
> You can (at least) make it harder to DoS a machine.

If the time an entry stays in the queue is less than the time required
for reassembly to occur then even a FIFO will not suffice as an adequate
algorithmic countermeasure.  There are solutions to this too, but this
is just to say that it's more complex than "throw this data structure
in to fix."

Darren