Feeds

DoS attack reveals (yet another) crack in net's core

Self-trashing TCP exploit

Internet Security Threat Report 2014

Security experts say they have discovered a flaw in a core internet protocol that can be exploited to disrupt just about any device with a broadband connection, a finding that could have profound consequences for millions of people who depend on websites, mail servers, and network infrastructure.

The bug in the transmission control protocol (TCP) affords attackers a wealth of new ways to carry out denials of service on equipment at the heart of data centers and other sensitive points on the internet. The new class of attack is especially severe because it can be carried out using very little bandwidth and has the ability to paralyze a server or router even after the flood of malicious data has stopped.

"If you use the internet and you serve a TCP-based service that you value the availability for, then this affects you," Robert E. Lee, chief security officer for Sweden-based Outpost24 told The Register. "That may not be every internet user, but that's certainly any IT manager, that's certainly any website operator, mail server operator, or router operator."

Lee said he and Outpost24 colleague Jack Louis discovered the bug in 2005, but decided to keep their finding secret while they tried to devise a solution. After largely hitting a wall, they decided to go public in hopes that a new infusion of ideas will finally get the problem fixed.

Other security experts have already weighed in on the TCP bug and said it appears Outpost24 isn't overstating its severity. Robert "RSnake" Hansen, who has been briefed by Lee, told El Reg it's "the most serious thing I've heard of in a month or two."

Robert Graham, CEO of Errata Security, said here that after listening to this interview with the researchers, he's inclined to believe the threat is real.

"They have been working deep withing TCP stacks," he wrote. "If such problems exist, then they would have certainly come across them."

The discovery is similar to several other bugs that have come to light over the past few months that reside in a network-wide system rather than in a single product. In July, researcher Dan Kaminsky unearthed a fundamental flaw in the design of the internet's address system that made it trivial to spoof websites and email addresses. And at the Defcon hacking conference a month later, researchers laid out a technique to surreptitiously hijack huge chunks of the internet and tamper with unencrypted traffic before it reaches its intended destination.

Last month, Lee and Louis began notifying unnamed makers of operating systems, routers, firewalls, and other TCP-enabled wares with the help of the Computer Emergency Response Team in Finland. So far, Outpost24 has shared multiple attack scenarios with them, and Lee said vendors were only in the early stages of grasping the problem.

"They're still trying to do triage and understand the individual attack types that we've identified for them," Lee said during a phone interview. "We're still trying to get them to back up a step. It's a class of attack, not necessarily individual things that the vendors need to be focusing on."

At the moment, there are no work-arounds other than forbidding anonymous connections, a solution that isn't an option for most net-connected devices.

Lee declined to identify the specific makers whose products that are vulnerable, but he indicated they read like a comprehensive list of companies involved in wares related to the internet.

"We haven't found anybody who has a TCP stack that runs TCP based services that isn't vulnerable," he said. "If they make a TCP stack then it's probably still going to be vulnerable to one or all of these attacks because this is something fundamental in how TCP works."

To streamline the execution of the multiple attack scenarios developed, Outpost24 has built a test kit they've dubbed Sockstress. So far, they've used it on 15 different TCP stacks, and all have been found to be vulnerable, Lee said.

Outpost24 is being vague with details about the vulnerability to prevent giving miscreants information that would enable them to carry out attacks. Lee will say only that the class of attack takes advantage of the way resources are allocated immediately after TCP-enabled devices complete the three-way handshake (syn, syn-ack, ack) that is required for two internet-connected devices to interact.

Once exploited, the attack allows miscreants to consume so many system resources that the device essentially crashes.

"It basically self thrashes, and the only recovery after about two to four minutes worth of attack flow, even after the attack stops, is to reboot the machine," Lee said. "There's almost a tipping point that happens when it gets to that self thrashing point." ®

Internet Security Threat Report 2014

More from The Register

next story
George Clooney, WikiLeaks' lawyer wife hand out burner phones to wedding guests
Day 4: 'News'-papers STILL rammed with Clooney nuptials
Shellshock: 'Larger scale attack' on its way, warn securo-bods
Not just web servers under threat - though TENS of THOUSANDS have been hit
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
PEAK IPV4? Global IPv6 traffic is growing, DDoS dying, says Akamai
First time the cache network has seen drop in use of 32-bit-wide IP addresses
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
You dirty RAT! Hong Kong protesters infected by iOS, Android spyware
Did China fling remote access Trojan at Occupy Central?
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.