lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20050721051955.GG16231@loder.us>
Date: Thu Jul 21 06:11:12 2005
From: fulldisc at loder.us (Chad Loder)
Subject: Re: ICMP-based blind performance-degrading attack

Darren Reed wrote:

> Ok, so you really think this is new...
> 
> Go look in the bugtraq archives for 8 July 2001 and you might find an
> email like the one below.  THere was a thread on this topic then.

Darren, you're totally off-base.  That bugtraq thread talks about
TCP-based attacks on host performance.  You can just firewall the
attacker's packets.  Even ipf can do that somewhat reliably.

The blind ICMP attacks are totally different.  Did you even read
the draft?  Maybe you'd find the CanSecWest presentation easier
to comprehend since it's broken down into short slides with
bulleted lists.

Since OpenBSD implemented fixes for the ICMP attacks, I've seen quite
a few people complaining on the lists about how they thought of all
this stuff years ago. That's getting really boring.  A more interesting
conversation would be: what are other operating systems doing to fix
their stacks?

	--Chad

Powered by blists - more mailing lists