Bugtraq mailing list archives
Re: ICMP attacks against TCP: Conclusions
From: Dan Yefimov <dan () lightwave net ru>
Date: Tue, 30 Aug 2005 18:16:46 +0400 (MSD)
On Thu, 28 Jul 2005, Fernando Gont wrote:
Folks, My posts to this list have tried to show how easy it is to perform ICMP attacks against TCP. The attacks are blind, so the attacker does not need to be a "man in the middle" to perform then. The typical number of packets required to perform any of these attacks is about 16000 (in many cases, the attacker requires fewer packets). This means that even when a 128kbps link, it will take the attacker much less than a minute to perform them.
[skip] ...
Big vendors' employees making misleading claims to the press have certainly not helped to make people patch their systems, or push their vendors to produce patches. Those guys that have started nonsensical discussions about whether this is new or not have not helped, either. And have not realized that the discussion should be whether "this is current", rather than whether "this is new". I have received almost no feedback from "vendors". Unfortunately, they don't realize that ICMP is a core protocol, and that discussion on the counter-measures is needed for the benefit of us all. Last, but not least, the IETF specifications need to address these issues. If vendors patch their systems, but the IETF specifications are not updated, there's a high chance that there will be brand-new vulnerable implementations in the near term. Get involved. Discuss the counter-measures. Get your vendor fix the problems. And ask *how* they are fixing them (what if they just didn't understand, and are not really protecting you, or causing more harm than good?). And have the specs address these issues. That's the real and final fix for these issues.
All we've heard from you are attack descriptions and claims for vendors to fix their OSes. It's easy to sit back and claim for others to do something. But what we haven't ever heard from you are YOUR personal opinions and proposals on fixing the problem. So what personally you propose? -- Sincerely Your, Dan.
Current thread:
- ICMP attacks against TCP: Conclusions Fernando Gont (Aug 01)
- Re: ICMP attacks against TCP: Conclusions Dan Yefimov (Aug 30)
- Re: ICMP attacks against TCP: Conclusions Damien Miller (Aug 31)
- Re: ICMP attacks against TCP: Conclusions Dan Yefimov (Aug 30)