Feeds

Windows XP will make Internet unstable – top security expert

Disturbing but true

  • alert
  • submit to reddit

Designing a Defense for Mobile Applications

According to top security expert Steve Gibson, Windows XP threatens to make the Internet unstable as it will allow large numbers of people to launch uncontrollable denial-of-service attacks to whichever IP address they see fit.

Mr Gibson came across the flaw while doing an in-depth investigation into DoS attacks on his own site, grc.com. "In a fluke of laziness (or good judgement?) that has saved the Internet from untold levels of disaster," he wrote, "Microsoft's engineers never fully implemented the complete 'Unix Sockets' specification in any of the previous versions of Windows. (Windows 2000 has it.) As a consequence, Windows machines (compared to Unix machines) are blessedly limited in their ability to generate deliberately invalid Internet packets."

These invalid Internet packets are what malicious Internet users fire at sites from a range of computers. So many are aimed at a particular site that all the bandwidth is used up and so the site disappears from view for all other Internet users as they get no information to or from the site's server.

All Windows OSes until Windows 2000 and now Windows XP would not allow someone to "spoof" the source of such Internet packets. This means that a sysadmin can see where they are coming from and then block all data from that PC - freeing up bandwidth and letting others see the site. Spoof packets don't allow you to do that.

Why, if Windows 2000 and all machines running on Unix can already spoof packets, do we need worry about Windows XP allowing the same thing? Simple: Windows XP is a consumer OS and so will be taken up by a huge number of technically illiterate consumers. These are precisely the people that hackers will target due to their limited understanding of security issues. They will allow Trojans, Zombie and other types of malicious program on their PCs, they will remain unaware of them and they won't be able to remove it, even if they do discover them.

This means that the opportunity for hackers to control and direct others' computers as they wish will grow at an enormous rate as more and more people upgrade to Windows XP.

Steve Gibson writes in his piece: "When those insecure and maliciously potent Windows XP machines are mated to high-bandwidth Internet connections, we are going to experience an escalation of Internet terrorism the likes of which has never been seen before."

He calls on everyone to contact Microsoft senior execs and explain the potential problem, with the aim of removing this ability, possibly in the first service pack it knocks out. He's serious. ®

Related Story

Everything you wanted to know about DDoS attacks

Related Link

Steve Gibsons' DoS piece

Boost IT visibility and business value

More from The Register

next story
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Chrome browser has been DRAINING PC batteries for YEARS
Google is only now fixing ancient, energy-sapping bug
Do YOU work at Microsoft? Um. Are you SURE about that?
Nokia and marketing types first to get the bullet, says report
Microsoft takes on Chromebook with low-cost Windows laptops
Redmond's chief salesman: We're taking 'hard' decisions
Cheer up, Nokia fans. It can start making mobes again in 18 months
The real winner of the Nokia sale is *drumroll* ... Nokia
EU dons gloves, pokes Google's deals with Android mobe makers
El Reg cops a squint at investigatory letters
Big Blue Apple: IBM to sell iPads, iPhones to enterprises
iOS/2 gear loaded with apps for big biz ... uh oh BlackBerry
prev story

Whitepapers

Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.