Feeds

Denial of service warning for network security tool

Give it some stick

  • alert
  • submit to reddit

Providing a secure and efficient Helpdesk

A security firm has issued an alert about a cracker tool which can be used to mount a denial of service attack (DoS) against its own products.

Internet Security Systems is warning about 'Stick' which can reportedly reduce the performance of, or deny service to, many commercial intrusion detection products, including ISS' RealSecure Network Sensor 5.0.

The tool, which has not yet openly available on the Internet, works by flooding intrusion detection systems (IDS) with more information than can be processed.

Stick uses the very straightforward technique of firing numerous attacks from random source IP addresses to purposely trigger IDS events. This technique has been seen before but the implementation used by Stick is far more effective than previous cracker tools which uses similar tricks.

In an alert about the problem ISS admitted: "The IDS system will attempt to keep up with the new flood of events, but if incoming events cross the IDS detection threshold, a DoS might result."

ISS X-Force has verified the existence of a vulnerability in the Windows NT and Windows 2000 versions of RealSecure Network Sensor 5.0 which leaves the product susceptible to an attack by Stick. On both Windows platforms, the event channel becomes congested during the duration of the attack, although the product doesn't actually crash it is thus rendered ineffective.

The Solaris version of Network Sensor is not thought to be affected by the issue.

ISS has developed two fixes for RealSecure Network Sensor that will limit the risk of a Stick attack, and has made more information on the issue available here. ®

Related stories

Different approach to intrusion detection touted
Network Associates weathers DoS attack
Microsoft struts into Net security market

Choosing a cloud hosting partner with confidence

More from The Register

next story
SMASH the Bash bug! Apple and Red Hat scramble for patch batches
'Applying multiple security updates is extremely difficult'
Shellshock: 'Larger scale attack' on its way, warn securo-bods
Not just web servers under threat - though TENS of THOUSANDS have been hit
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
Hackers thrash Bash Shellshock bug: World races to cover hole
Update your gear now to avoid early attacks hitting the web
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
prev story

Whitepapers

A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.