full-disclosure - Re: ICMP-based blind performance-degrading attack

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20050721051955.GG16231@loder.us>
Date: Thu Jul 21 06:11:12 2005
From: fulldisc at loder.us (Chad Loder)
Subject: Re: ICMP-based blind performance-degrading attack

Darren Reed wrote:

> Ok, so you really think this is new...
> 
> Go look in the bugtraq archives for 8 July 2001 and you might find an
> email like the one below.  THere was a thread on this topic then.

Darren, you're totally off-base.  That bugtraq thread talks about
TCP-based attacks on host performance.  You can just firewall the
attacker's packets.  Even ipf can do that somewhat reliably.

The blind ICMP attacks are totally different.  Did you even read
the draft?  Maybe you'd find the CanSecWest presentation easier
to comprehend since it's broken down into short slides with
bulleted lists.

Since OpenBSD implemented fixes for the ICMP attacks, I've seen quite
a few people complaining on the lists about how they thought of all
this stuff years ago. That's getting really boring.  A more interesting
conversation would be: what are other operating systems doing to fix
their stacks?

	--Chad