Feeds

Windows XP will make Internet unstable – top security expert

Disturbing but true

  • alert
  • submit to reddit

Secure remote control for conventional and virtual desktops

According to top security expert Steve Gibson, Windows XP threatens to make the Internet unstable as it will allow large numbers of people to launch uncontrollable denial-of-service attacks to whichever IP address they see fit.

Mr Gibson came across the flaw while doing an in-depth investigation into DoS attacks on his own site, grc.com. "In a fluke of laziness (or good judgement?) that has saved the Internet from untold levels of disaster," he wrote, "Microsoft's engineers never fully implemented the complete 'Unix Sockets' specification in any of the previous versions of Windows. (Windows 2000 has it.) As a consequence, Windows machines (compared to Unix machines) are blessedly limited in their ability to generate deliberately invalid Internet packets."

These invalid Internet packets are what malicious Internet users fire at sites from a range of computers. So many are aimed at a particular site that all the bandwidth is used up and so the site disappears from view for all other Internet users as they get no information to or from the site's server.

All Windows OSes until Windows 2000 and now Windows XP would not allow someone to "spoof" the source of such Internet packets. This means that a sysadmin can see where they are coming from and then block all data from that PC - freeing up bandwidth and letting others see the site. Spoof packets don't allow you to do that.

Why, if Windows 2000 and all machines running on Unix can already spoof packets, do we need worry about Windows XP allowing the same thing? Simple: Windows XP is a consumer OS and so will be taken up by a huge number of technically illiterate consumers. These are precisely the people that hackers will target due to their limited understanding of security issues. They will allow Trojans, Zombie and other types of malicious program on their PCs, they will remain unaware of them and they won't be able to remove it, even if they do discover them.

This means that the opportunity for hackers to control and direct others' computers as they wish will grow at an enormous rate as more and more people upgrade to Windows XP.

Steve Gibson writes in his piece: "When those insecure and maliciously potent Windows XP machines are mated to high-bandwidth Internet connections, we are going to experience an escalation of Internet terrorism the likes of which has never been seen before."

He calls on everyone to contact Microsoft senior execs and explain the potential problem, with the aim of removing this ability, possibly in the first service pack it knocks out. He's serious. ®

Related Story

Everything you wanted to know about DDoS attacks

Related Link

Steve Gibsons' DoS piece

Top 5 reasons to deploy VMware with Tegile

More from The Register

next story
Preview redux: Microsoft ships new Windows 10 build with 7,000 changes
Latest bleeding-edge bits borrow Action Center from Windows Phone
Google opens Inbox – email for people too thick to handle email
Print this article out and give it to someone tech-y if you get stuck
Microsoft promises Windows 10 will mean two-factor auth for all
Sneak peek at security features Redmond's baking into new OS
UNIX greybeards threaten Debian fork over systemd plan
'Veteran Unix Admins' fear desktop emphasis is betraying open source
Google+ goes TITSUP. But WHO knew? How long? Anyone ... Hello ...
Wobbly Gmail, Contacts, Calendar on the other hand ...
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
Redmond top man Satya Nadella: 'Microsoft LOVES Linux'
Open-source 'love' fairly runneth over at cloud event
prev story

Whitepapers

Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.