bugtraq - Re: IPv4 fragmentation --> The Rose Attack

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <BC9D8959.125B1%gandalf@digital.net>
Date: Sat, 10 Apr 2004 11:22:01 -0500
From: <gandalf@...ital.net>
To: Darren Reed <avalon@...igula.anu.edu.au>
Cc: BugTraq <bugtraq@...urityfocus.com>
Subject: Re: IPv4 fragmentation --> The Rose Attack


Greetings and Salutations:

On 4/10/04 8:23 AM, "Darren Reed" <avalon@...igula.anu.edu.au> wrote:
> In some mail from gandalf@...ital.net, sie said:
>> I work at many other places than on my own personal computers.  I would like
>> to know if attacks might affect any number of computers.  I am a computer
>> professional.
> 
> And if so, surely any place where you see "Windows 9*/ME" should bring a
> "you need to start planning on upgrading/replacing these with 2K/XP, if
> you haven't already." styled response.

Yup.  Been there, did that.  Small businesses have a hard enough time
justifying doing maintenance much less buying new equipment.

>> Or program with queues that drop packets in a FIFO fashion that have enough
>> memory that an attack will still allow fragmented packets to be serviced.
>> You can (at least) make it harder to DoS a machine.
> 
> If the time an entry stays in the queue is less than the time required
> for reassembly to occur then even a FIFO will not suffice as an adequate
> algorithmic countermeasure.  There are solutions to this too, but this
> is just to say that it's more complex than "throw this data structure
> in to fix."
> Darren

Agree 100% that a simple data structure will not fix this problem.  But it
is a start.  I would also say that in this case a "standard" (I.e. RFC) for
fragmentation reassembly should be written to take all of the diverse ways
that fragments are handled and standardize them.  Again I am amazed that
every machine I hit with fragments seems to have a different effect on the
machine than the last machine I tested against.

Ken

---------------------------------------------------------------
Do not meddle in the affairs of wizards for they are subtle and
quick to anger.
Ken Hollis - Gandalf The White - gandalf@...ital.net - O- TINLC
WWW Page - http://digital.net/~gandalf/
Trace E-Mail forgery - http://digital.net/~gandalf/spamfaq.html
Trolls crossposts - http://digital.net/~gandalf/trollfaq.html