Feeds

DoS attack reveals (yet another) crack in net's core

Self-trashing TCP exploit

3 Big data security analytics techniques

Security experts say they have discovered a flaw in a core internet protocol that can be exploited to disrupt just about any device with a broadband connection, a finding that could have profound consequences for millions of people who depend on websites, mail servers, and network infrastructure.

The bug in the transmission control protocol (TCP) affords attackers a wealth of new ways to carry out denials of service on equipment at the heart of data centers and other sensitive points on the internet. The new class of attack is especially severe because it can be carried out using very little bandwidth and has the ability to paralyze a server or router even after the flood of malicious data has stopped.

"If you use the internet and you serve a TCP-based service that you value the availability for, then this affects you," Robert E. Lee, chief security officer for Sweden-based Outpost24 told The Register. "That may not be every internet user, but that's certainly any IT manager, that's certainly any website operator, mail server operator, or router operator."

Lee said he and Outpost24 colleague Jack Louis discovered the bug in 2005, but decided to keep their finding secret while they tried to devise a solution. After largely hitting a wall, they decided to go public in hopes that a new infusion of ideas will finally get the problem fixed.

Other security experts have already weighed in on the TCP bug and said it appears Outpost24 isn't overstating its severity. Robert "RSnake" Hansen, who has been briefed by Lee, told El Reg it's "the most serious thing I've heard of in a month or two."

Robert Graham, CEO of Errata Security, said here that after listening to this interview with the researchers, he's inclined to believe the threat is real.

"They have been working deep withing TCP stacks," he wrote. "If such problems exist, then they would have certainly come across them."

The discovery is similar to several other bugs that have come to light over the past few months that reside in a network-wide system rather than in a single product. In July, researcher Dan Kaminsky unearthed a fundamental flaw in the design of the internet's address system that made it trivial to spoof websites and email addresses. And at the Defcon hacking conference a month later, researchers laid out a technique to surreptitiously hijack huge chunks of the internet and tamper with unencrypted traffic before it reaches its intended destination.

Last month, Lee and Louis began notifying unnamed makers of operating systems, routers, firewalls, and other TCP-enabled wares with the help of the Computer Emergency Response Team in Finland. So far, Outpost24 has shared multiple attack scenarios with them, and Lee said vendors were only in the early stages of grasping the problem.

"They're still trying to do triage and understand the individual attack types that we've identified for them," Lee said during a phone interview. "We're still trying to get them to back up a step. It's a class of attack, not necessarily individual things that the vendors need to be focusing on."

At the moment, there are no work-arounds other than forbidding anonymous connections, a solution that isn't an option for most net-connected devices.

Lee declined to identify the specific makers whose products that are vulnerable, but he indicated they read like a comprehensive list of companies involved in wares related to the internet.

"We haven't found anybody who has a TCP stack that runs TCP based services that isn't vulnerable," he said. "If they make a TCP stack then it's probably still going to be vulnerable to one or all of these attacks because this is something fundamental in how TCP works."

To streamline the execution of the multiple attack scenarios developed, Outpost24 has built a test kit they've dubbed Sockstress. So far, they've used it on 15 different TCP stacks, and all have been found to be vulnerable, Lee said.

Outpost24 is being vague with details about the vulnerability to prevent giving miscreants information that would enable them to carry out attacks. Lee will say only that the class of attack takes advantage of the way resources are allocated immediately after TCP-enabled devices complete the three-way handshake (syn, syn-ack, ack) that is required for two internet-connected devices to interact.

Once exploited, the attack allows miscreants to consume so many system resources that the device essentially crashes.

"It basically self thrashes, and the only recovery after about two to four minutes worth of attack flow, even after the attack stops, is to reboot the machine," Lee said. "There's almost a tipping point that happens when it gets to that self thrashing point." ®

3 Big data security analytics techniques

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.