full-disclosure - Core Internet Vulnerable

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

From: RCompton at chartercom.com (Compton, Rich)
Subject: Core Internet Vulnerable - News at 11:00

Emergency!!!
Raise shields!!!

http://www.uniras.gov.uk/vuls/2004/236929/index.htm
http://isc.sans.org/diary.php

-----Original Message-----
From: Crist J. Clark [mailto:cristjc@...cast.net]
Sent: Tuesday, April 20, 2004 12:28 PM
To: full-disclosure@...ts.netsys.com
Subject: [Full-Disclosure] Core Internet Vulnerable - News at 11:00

Does anyone know WTF they are trying to say in this AP article,
"Core Internet Technology Is Vulnerable,"

http://story.news.yahoo.com/news?tmpl=story&cid=562&ncid=738&e=1&u=/ap/20040
420/ap_on_hi_te/internet_threat

It sounds like they are talking about a sequence number guessing
attack on TCP BGP sessions? Sequence number prediction isn't really
a new attack, but the story says,

  "Experts previously maintained such attacks could take between
   four years and 142 years to succeed because they require guessing
   a rotating number from roughly 4 billion possible combinations.
   Watson said he can guess the proper number with as few as four
   attempts, which can be accomplished within seconds."

Hmmm... Four attempts... And the story makes it sound like a 
cross-platform attack, not a bug in a particular OS's ISN generation.
FUD or is there something here?
-- 
Crist J. Clark                     |     cjclark@...m.mit.edu
                                   |     cjclark@....edu
http://people.freebsd.org/~cjc/    |     cjc@...ebsd.org

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html