Feeds

DoS attack reveals (yet another) crack in net's core

Self-trashing TCP exploit

Internet Security Threat Report 2014

Security experts say they have discovered a flaw in a core internet protocol that can be exploited to disrupt just about any device with a broadband connection, a finding that could have profound consequences for millions of people who depend on websites, mail servers, and network infrastructure.

The bug in the transmission control protocol (TCP) affords attackers a wealth of new ways to carry out denials of service on equipment at the heart of data centers and other sensitive points on the internet. The new class of attack is especially severe because it can be carried out using very little bandwidth and has the ability to paralyze a server or router even after the flood of malicious data has stopped.

"If you use the internet and you serve a TCP-based service that you value the availability for, then this affects you," Robert E. Lee, chief security officer for Sweden-based Outpost24 told The Register. "That may not be every internet user, but that's certainly any IT manager, that's certainly any website operator, mail server operator, or router operator."

Lee said he and Outpost24 colleague Jack Louis discovered the bug in 2005, but decided to keep their finding secret while they tried to devise a solution. After largely hitting a wall, they decided to go public in hopes that a new infusion of ideas will finally get the problem fixed.

Other security experts have already weighed in on the TCP bug and said it appears Outpost24 isn't overstating its severity. Robert "RSnake" Hansen, who has been briefed by Lee, told El Reg it's "the most serious thing I've heard of in a month or two."

Robert Graham, CEO of Errata Security, said here that after listening to this interview with the researchers, he's inclined to believe the threat is real.

"They have been working deep withing TCP stacks," he wrote. "If such problems exist, then they would have certainly come across them."

The discovery is similar to several other bugs that have come to light over the past few months that reside in a network-wide system rather than in a single product. In July, researcher Dan Kaminsky unearthed a fundamental flaw in the design of the internet's address system that made it trivial to spoof websites and email addresses. And at the Defcon hacking conference a month later, researchers laid out a technique to surreptitiously hijack huge chunks of the internet and tamper with unencrypted traffic before it reaches its intended destination.

Last month, Lee and Louis began notifying unnamed makers of operating systems, routers, firewalls, and other TCP-enabled wares with the help of the Computer Emergency Response Team in Finland. So far, Outpost24 has shared multiple attack scenarios with them, and Lee said vendors were only in the early stages of grasping the problem.

"They're still trying to do triage and understand the individual attack types that we've identified for them," Lee said during a phone interview. "We're still trying to get them to back up a step. It's a class of attack, not necessarily individual things that the vendors need to be focusing on."

At the moment, there are no work-arounds other than forbidding anonymous connections, a solution that isn't an option for most net-connected devices.

Lee declined to identify the specific makers whose products that are vulnerable, but he indicated they read like a comprehensive list of companies involved in wares related to the internet.

"We haven't found anybody who has a TCP stack that runs TCP based services that isn't vulnerable," he said. "If they make a TCP stack then it's probably still going to be vulnerable to one or all of these attacks because this is something fundamental in how TCP works."

To streamline the execution of the multiple attack scenarios developed, Outpost24 has built a test kit they've dubbed Sockstress. So far, they've used it on 15 different TCP stacks, and all have been found to be vulnerable, Lee said.

Outpost24 is being vague with details about the vulnerability to prevent giving miscreants information that would enable them to carry out attacks. Lee will say only that the class of attack takes advantage of the way resources are allocated immediately after TCP-enabled devices complete the three-way handshake (syn, syn-ack, ack) that is required for two internet-connected devices to interact.

Once exploited, the attack allows miscreants to consume so many system resources that the device essentially crashes.

"It basically self thrashes, and the only recovery after about two to four minutes worth of attack flow, even after the attack stops, is to reboot the machine," Lee said. "There's almost a tipping point that happens when it gets to that self thrashing point." ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
Knock Knock tool makes a joke of Mac AV
Yes, we know Macs 'don't get viruses', but when they do this code'll spot 'em
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
Why weasel words might not work for Whisper
CEO suspends editor but privacy questions remain
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
BlackEnergy crimeware coursing through US control systems
US CERT says three flavours of control kit are under attack
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
New hybrid storage solutions
Tackling data challenges through emerging hybrid storage solutions that enable optimum database performance whilst managing costs and increasingly large data stores.
Getting ahead of the compliance curve
Learn about new services that make it easy to discover and manage certificates across the enterprise and how to get ahead of the compliance curve.