Ştiri IT - HanuAncutei.com - ARTA de a conversa

LocuriFaine: Hoteluri si Pensiuni de Lux | Ferma Club

Regulament

Important:

Pentru propunerea spre dezbatere (pareri, critici, comentarii) asupra unui anume site (personal sau nu) va rugam sa vizitati forumul Design si Programare Web

Ştiri IT, Era informaţiei abia a început ...

Optiuni

rebel Vizualizare profil forumist	21 Apr 2004, 05:32 AM Mesaj #1
Don Juan Cronicar Grup: Membri Mesaje: 2.524 Inscris: 14 February 04 Din: Aproape în aproape Forumist Nr.: 2.225	Cineva, acolo sus, îti citeste e-mail-ul. Internetul a devenit terenul preferat de joacã al agentiilor secrete. Dupã atentatele de la 11 septembrie, teroristii sunt vânati pe forumurile de discutii, pe e-mail sau pe chat. Americanii cheltuie sume uriase pentru a sti tot ce miscã în spatiul virtual. Dacã expediati unei cunostinte un e-mail prin care o anuntati cã trebuie sa primeascã zece pepeni si cinci lãmâi, s-ar putea sã captati atentia unui program automat de monitorizare a Internetului. În lunile urmãtoare, un supercomputer va fi însãrcinat sã-si dea seama dacã sunteti un pasionat de agriculturã, daca i-ati trimis iubitei un cadou mai ciudat sau dacã (Doamne fereste!) faceti parte dintr-o celulã teroristã si vãa ocupati cu furnizarea materialelor explozive. • Monitorizare. E adevãrat, povestea pare desprinsã dintr-un roman SF. Si totusi, Internetul este monitorizat. Desi pare o nebunie sã verifici cele 30 de miliarde de pagini web sau sã citesti zecile de miliarde de mesaje trimise zilnic de utilizatorii serviciilor de posta electronicã, americanii o fac. De fapt, dezvoltã programe care filtreazã mesajele considerate suspecte. Atunci când computerele ajung la concluzia cã e-mail-urile „inocente“ ar putea ascunde activitãti periculoase, semnaleazã angajatilor agentiilor de securitate cã persoana „x“ îi trimite lui „y“ mesaje ciudate. Apoi oamenii sunt verificati discret de bãietii cu ochi albastri. • Lupu’ si cameleonu’. Iatã ce declarã recent prof. Abraham Kandel, seful unui institut de cercetare finantat de Guvernul American: „Vrem sã stim tot. Vrem sã stim cine foloseste Internetul si cum îl foloseste. Vrem sã stim cine ce este în grãdina zoologicã. Vrem sã stim în ce cuscã se aflã fiecare. Dacã îsi schimbã culoarea, ca un cameleon, si apoi dispare, noi tot vrem sã-l gasim folosind metode specifice. Vrem sã identificãm transferuri de bani, cunostinte sau instructiuni ale grupãrilor teroriste.“ ------------ Sursã: Jurnalul National Articol Complet: Cineva, acolo sus, îti citeste e-mail-ul. -------------------- *Dragostea, precum un râu, îşi va găsi un nou curs de fiecare dată când va întâlni în cale un obstacol.*

Raspunsuri

dead-cat

21 Apr 2004, 10:38 AM

Mesaj #2

Domnitor

Grup: Membri
Mesaje: 3.203
Inscris: 6 April 04
Din: On the Rhine
Forumist Nr.: 2.942

disclosure
de pe http://www.uniras.gov.uk/vuls/2004/236929/index.htm

QUOTE

NISCC Vulnerability Advisory 236929
Vulnerability Issues in TCP

What is Affected?

The vulnerability described in this advisory affects implementations of the Transmission Control Protocol (TCP) that comply with the Internet Engineering Task Force’s (IETF’s) Requests For Comments (RFCs) for TCP, including RFC 793, the original specification, and RFC 1323, TCP Extensions for High Performance.

TCP is a core network protocol used in the majority of networked computer systems today. Many vendors include support for this protocol in their products and may be impacted to varying degrees. Furthermore any network service or application that relies on a TCP connection will also be impacted, the severity depending primarily on the duration of the TCP session.

Severity

The impact of this vulnerability varies by vendor and application, but in some deployment scenarios it is rated critical. Please see the vendor section below for further information. Alternatively contact your vendor for product specific information.

If exploited, the vulnerability could allow an attacker to create a Denial of Service condition against existing TCP connections, resulting in premature session termination. The resulting session termination will affect the application layer, the nature and severity of the effects being dependent on the application layer protocol. The primary dependency is on the duration of the TCP connection, with a further dependency on knowledge of the network (IP) addresses of the end points of the TCP connection.

The Border Gateway Protocol (BGP) is judged to be potentially most affected by this vulnerability.

BGP relies on a persistent TCP session between BGP peers. Resetting the connection can result in medium term unavailability due to the need to rebuild routing tables and route flapping. Route flapping may result in route dampening (suppression) if the route flaps occur frequently within a short time interval. The overall impact on BGP is likely to be moderate based on the likelihood of successful attack. If the TCP MD5 Signature Option and anti-spoofing measures are used then the impact will be low as these measures will successfully mitigate the vulnerability.

There is a potential impact on other application protocols such as DNS (Domain Name System) and SSL (Secure Sockets Layer) in the case of zone transfers and ecommerce transactions respectively, but the duration of the sessions is relatively short and the sessions can be restarted without medium term unavailability problems. In the case of SSL it may be difficult to guess the source IP address.

Data injection may be possible. However, this has not been demonstrated and appears to be problematic.

Summary

The issue described in this advisory is the practicability of resetting an established TCP connection by sending suitable TCP packets with the RST (Reset) or SYN (Synchronise) flags set.

The packets need to have source and destination IP addresses that match the established connection as well as the same source and destination TCP ports.

The fact that TCP sessions can be reset by sending suitable RST and SYN packets is a design feature of TCP according to RFC 793, but a reset attack is only possible at all because the source IP address and TCP port can be forged or “spoofed”.

Although denial of service using crafted TCP packets is a well known weakness of TCP, until recently it was believed that a successful denial of service attack was not achievable in practice. The reason for this is that the receiving TCP implementation checks the sequence number of the RST or SYN packet, which is a 32 bit number, giving a probability of 1/232 of guessing the sequence number correctly (assuming a random distribution).

The discoverer of the practicability of the RST attack was Paul A. Watson, who describes his research in his paper “Slipping In The Window: TCP Reset Attacks”, presented at the CanSecWest 2004 conference. He noticed that the probability of guessing an acceptable sequence number is much higher than 1/232 because the receiving TCP implementation will accept any sequence number in a certain range (or “window”) of the expected sequence number. The window makes TCP reset attacks practicable.

Any application protocol which relies on long term TCP connections and for which the source and destination IP addresses and TCP ports are known or can be easily guessed will be vulnerable to at least denial of service attacks.

Details

TCP is the transport layer protocol designed to provide connection-oriented reliable delivery of IP packets. To do this TCP uses a mixture of flags, to indicate state, and sequence numbers, to identify the order in which the packets are to be reassembled.

TCP also provides a number, called an acknowledgement number, that is used to indicate the sequence number of the next packet expected. The packets are reassembled by the receiving TCP implementation only if their sequence numbers fall within a range of the acknowledgement number (called a "window"). The acknowledgement number is not used in a RST packet because a reset does not expect a packet in return. (To be completely accurate, although the last statement is true for a RST packet without the ACK flag set, used to indicate that a TCP port is closed, a RST/ACK is used to terminate an active connection in the event of error. In a RST/ACK packet an acknowledgement number is included in the packet, although it is not checked by the receiving TCP implementation.)

RFC 793, p36, states the following:

"In all states except SYN-SENT, all reset (RST) segments are validated by checking their SEQ-fields [sequence numbers]. A reset is valid if its sequence number is in the window. In the SYN-SENT state (a RST received in response to an initial SYN), the RST is acceptable if the ACK field acknowledges the SYN."

Resets must be processed immediately. RFC 793, p25, says "[…] [E]ven when the receive window is zero, a TCP must process the RST and URG fields of all incoming segments."

It is also possible to perform the same attack with SYN (synchronise) packets. An established connection will abort by sending a RST if it receives a duplicate SYN packet with initial sequence number within the TCP window. RFC 793, p31 states:

“The principle reason for the three-way handshake is to prevent old duplicate connection initiations from causing confusion. To deal with this, a special control message, reset, has been devised. […] If the TCP is in one of the synchronized states (ESTABLISHED, FIN-WAIT-1, FIN-WAIT-2, CLOSE-WAIT, CLOSING, LAST-ACK, TIME-WAIT), it aborts the connection and informs its user.”

TCP window sizes are negotiated in the initial 3-way handshake used to set up a TCP connection, with higher values serving to improve throughput in some circumstances. Vendor-chosen defaults also influence the selection. In any case, the larger the window size, the greater is the probability that a randomly chosen TCP sequence number will lie within the window range. This is the basis for the attack.

A TCP connection is defined by a 4-tuple comprising source and destination IP addresses, and source and destination ports. An attacker seeking to disrupt an existing TCP connection must supply the 4-tuple correctly. As the source port varies, additional work is generally called for on the part of the attacker. However, research (referenced below) has shown that the process of source port selection on many platforms includes predictable elements, so that the attack remains practicable. By weighting 'likely' source port values carefully, an attacker can disrupt TCP implementations that employ a range of window sizes.

Application layer protocols that are critically affected are those that:

• Depend on long lived TCP connections
• Have known or easy-to-guess IP address end points
• Have easy to an easy-to-guess source TCP port

As noted above BGP does use long lived TCP connections, and the IP addresses and source port (and destination port) are sometimes available through the use of BGP looking glasses (multi-source, multi-destination trace route tools) or DNS resource records. Using “trace route” commands can provide information on peering point IP addresses. Thus BGP is likely to be critically affected by the TCP vulnerability.

These denial of service attacks can be carried out by single machine, or by multiple co-operating systems (to form a distributed denial of service attack).

It is also possible to inject packets, which will be processed if they are in the window. The difficulty with data injection attacks is that the receiving TCP implementation will reassemble the packets received according to sequence number, dropping any duplicate packets.

Vendor specific information will be released as it becomes available and if vendor permission has been received. Subscribers are advised to check the following URL regularly for updates:

http://www.uniras.gov.uk/vuls/2004/236929/index.htm

[Please note that updates to this advisory will not be notified by email.]

This vulnerability has been assigned the CVE name CAN-2004-0230.

The Open Source Vulnerability Database ID number for this vulnerability is 4030.

Mitigation

The following mitigation steps are still being evaluated and may be incomplete. Customers should work with vendors for the workaround most appropriate for the product in question.

In the absence of vendor patching of the TCP implementation, the following are general mitigating steps:

• Implement IP Security (IPSEC) which will encrypt traffic at the network layer, so TCP information will not be visible
• Reduce the TCP window size (although this could increase traffic loss and subsequent retransmission)
• Do not publish TCP source port information

It should be noted that IPSEC provides confidentiality and authentication services at the network layer, and can provide a measure of trust in the authenticity of the end points as well as encryption of traffic between the end points. However, in the context of the current attack IPSEC will reject RST and SYN packets that are not part of a secure IP packet stream.

To change the TCP window size, in some Unix variants you can set a value of the default TCP windows size by using the “sysctl” program (“ndd -set” in the case of Sun Solaris). In the case of Microsoft Windows NT/2000/XP/2003, the default window size can be changed by modifying the value of the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters key. As noted above, great care should be exercised when altering the default TCP window size as network performance could be adversely affected.

In the case of BGP, the following may counter the problem:

• Implement ingress and egress filtering to check that the traffic entering or leaving the network has a source IP address that is expected on the router/firewall interface that receives the traffic
• Implement the TCP MD5 Signature Option to checksum the TCP packet carrying the BGP application data (see RFC 2385), being careful to set and maintain strong (i.e. difficult to guess) passwords to which the MD5 checksum is applied. Also see RFC 3562 which discusses the security requirements of this keying material.
• Limit the amount of information available through looking glasses and DNS resource records, being careful not to expose TCP port information unnecessarily

The IETF ingress filtering standard is defined in RFC 2827. A discussion of egress filtering can be found at http://www.sans.org/y2k/egress.htm.

The use of the TCP MD5 Signature Option will prevent the exploitation of this vulnerability. Router customers should implement this on all BGP peering points if it is supported by the router, upgrading the router firmware if necessary.

Solution

Please refer to the Vendor Information section of this advisory for implementation specific remediation.

Some vendors will have reduced the likelihood of successful denial of service by amending the TCP implementation to issue a further acknowledgment packet challenge for RST and SYN packets that do not have exactly the expected sequence number.

The Internet Engineering Task Force (IETF) has published an Internet Draft to co-incide with the release of this advisory. The text of this draft is available from the IETF web site:
http://www.ietf.org/internet-drafts/draft-...cpsecure-00.txt

NISCC has produced best practice guidelines for BGP available at
http://www.niscc.gov.uk/BGP Filtering Guide.pdf

Secure configuration templates for BGP implementations on Cisco IOS and Juniper JunOS can be found at:

• Cisco http://www.cymru.com/Documents/secure-bgp-template.html
• Juniper http://www.qorbit.net/documents/junos-bgp-template.pdf

Guidance on tuning of the IP stack for a number of different UNIX operating systems is available at http://www.cymru.com/Documents/ip-stack-tuning.html

Vendor Information

The following vendors have provided information about how their products are affected by these vulnerabilities.

--------------------

Black holes are where God divided by zero.

Mesaje in acest topic

rebel Ştiri IT 21 Apr 2004, 05:32 AM

rebel Piata IT va depãsi 780 milioane de euro Valoarea ... 21 Apr 2004, 05:42 AM

rebel Flaw found in security of Internet • Researchers ... 21 Apr 2004, 05:47 AM

dead-cat disclosure de pe http://www.uniras.gov.uk/vuls/200... 21 Apr 2004, 10:38 AM

dead-cat QUOTE Vendor Information The following vendors h... 21 Apr 2004, 10:42 AM

rebel Motorul de cautare tridimensional • Cercetãtorii ... 21 Apr 2004, 01:18 PM

rebel Internetul Urii • Sute de site-uri si jocuri onl... 22 Apr 2004, 02:24 PM

rebel Britanicii, cei mai mari internauti • Patru tãri ... 22 Apr 2004, 02:33 PM

rebel Vulnerabilitate a sistemelor CISCO cauzeazã bãtãi ... 22 Apr 2004, 02:43 PM

rebel E-learning Românesc • Scoala româneasca s-a conec... 23 Apr 2004, 12:38 PM

rebel Cum se mai dau românii pe Internet? • Potrivit ul... 23 Apr 2004, 12:53 PM

rebel DEX-ul pe Internet • DEX online a apãrut ca o nec... 24 Apr 2004, 04:33 AM

rebel Iubitul meu, calculatorul • Oamenii sfârsesc prin... 28 Apr 2004, 01:02 PM

Mihai Download Muzica - Gratuit si Legal @@@ Download.c... 28 Apr 2004, 04:31 PM

rebel În sala de clasã, rãspunsul este doar la un click ... 30 Apr 2004, 11:49 AM

rebel Internetul poate sucomba oricand • Tehnologia car... 30 Apr 2004, 11:59 AM

rebel FBI ataca site-urile extremiste • FBI-ul a intrat... 30 Apr 2004, 12:06 PM

rebel Un regat pentru o bucatã de Google • Imediat ce a... 30 Apr 2004, 12:19 PM

rebel Computerul dãuneazã grav Sãnãtatii • Un bãrbat în... 2 May 2004, 01:10 AM

rebel China nu iubeste Internet Cafe-urile • China a i... 2 May 2004, 01:22 AM

rebel Rudele lui Blaster fac ravagii pe Internet • Calc... 2 May 2004, 01:39 AM

rebel Jurnalist condamnat pe Net • Un jurnalist vietnam... 9 May 2004, 02:23 PM

rebel Upgrade pregãtit pentru scolile din Dedham • Expe... 11 May 2004, 07:55 AM

rebel Lynx Studio Technology îsi extinde distributia • ... 11 May 2004, 08:11 AM

rebel Microsoft si Electronic Arts intrã-n joc • Micros... 12 May 2004, 09:52 AM

rebel Microsoft, pus pe fapte. • Surse din cadrul gigan... 12 May 2004, 01:17 PM

rebel Prima Televiziune pentru Internauti • Câtiva ziar... 12 May 2004, 03:30 PM

rebel Microsoft avertizeazã privind o vulnerabilitate no... 12 May 2004, 09:58 PM

rebel CNN.com a cãstigat douã premii EPpy (2004) pentru ... 13 May 2004, 05:25 AM

rebel Programele spion din computerul tau • 'Spywar... 13 May 2004, 05:34 AM

rebel Pistol livrat pe eBay • Un student canadian a cum... 13 May 2004, 05:41 AM

rebel FBI si-a modernizat computerele degeaba > Biro... 13 May 2004, 05:48 AM

rebel Specialistii anuntã iesirea pe piatã a celui mai s... 16 May 2004, 02:04 AM

rebel Oficialii încearcã a da de urma piratilor si distr... 16 May 2004, 03:06 PM

Mihai Companiile vor achizitiona tehnologie informatica ... 16 May 2004, 11:20 PM

rebel A început ca un simplu proiect de artã. Cu un caie... 17 May 2004, 06:24 AM

rebel FBI a arestat 65 de persoane pentru folosirea de r... 17 May 2004, 01:31 PM

rebel Hackerii au obtinut codul sursã pentru sistemul de... 17 May 2004, 03:45 PM

rebel Internet la ... Înãltime? • Compania germanã Luft... 18 May 2004, 05:20 PM

rebel AOL, pe punct de plecare America Online (AOL), bi... 18 May 2004, 06:02 PM

rebel Grup de hackeri tratati cu aceeasi lamã O aliantã... 21 May 2004, 10:07 AM

rebel Google va avea o slujbã greoaie de are de gând a-s... 22 May 2004, 01:16 AM

rebel Napster? Legal? Napster, ce a promovat tranzactii... 22 May 2004, 02:02 AM

rebel Yahoo Inc., o companie de frunte a Internetului, a... 28 May 2004, 07:37 AM

Mihai Microsoft: Decizia de la Bruxelles este "inju... 9 Jun 2004, 03:44 PM

rebel Ultimele statistici ale VeriSign indicã faptul cã ... 9 Jun 2004, 03:52 PM

rebel Politia Virtualã Britanicã se va alãtura altor div... 10 Jun 2004, 02:36 PM

rebel Reprezentantii grupului Beatles sunt în trative cu... 10 Jun 2004, 02:58 PM

rebel Comcast, unul dintre cei mai mari provideri de Int... 13 Jun 2004, 02:06 AM

rebel Utilizatorii serviciului de mesagerie instantã (AI... 13 Jun 2004, 04:27 PM

rebel Microsoft Corp., cel mai mare producãtor de softwa... 14 Jun 2004, 11:34 AM

Mihai Mai multe persoane nu au putut accesa ieri mari si... 16 Jun 2004, 12:57 PM

rebel Primul premiu Millennium Technology a fost acordat... 16 Jun 2004, 02:05 PM

rebel În ciuda vizitei ofiterului executiv sef al Micros... 18 Jun 2004, 11:58 AM

rebel O industrie organizatã reprezentând mai-marii prov... 23 Jun 2004, 03:48 AM

rebel QUOTE (Text de înselãciune)Repede! Un om de af... 23 Jun 2004, 08:13 PM

rebel Asociatia Industriei de Inregistrare din America (... 23 Jun 2004, 10:27 PM

rebel Hitachi si NEC îsi vor combina forcele pentru a se... 28 Jun 2004, 03:19 PM

rebel Efortul Microsoft de sãptãmâna trecutã de a repar... 7 Jul 2004, 11:38 AM

rebel Mai mult de o treime din software-ul instalat anul... 8 Jul 2004, 10:04 AM

Mihai Microsoft lanseaza un nou serviciu, rival al Googl... 3 Aug 2004, 02:13 PM

rebel Microsoft, gigantul software ce reuneşte na... 26 Aug 2004, 09:26 AM

rebel Mai multe oraşe din California au intentat în... 29 Aug 2004, 06:24 AM

rebel Microsoft Corp., cel mai mare producător de s... 29 Aug 2004, 08:06 AM

rebel O companie nonprofit ce ajută "săra... 29 Aug 2004, 05:21 PM

rebel Opera Software a anunţat că al său ... 1 Sep 2004, 01:40 AM

rebel Veritas Software Corp., cel mai mare provider de s... 1 Sep 2004, 02:31 AM

rebel "Spargerea" de la Berkeley ar fi putut c... 21 Oct 2004, 05:15 AM

rebel Samsung Electronics a anunţat apariţia p... 21 Oct 2004, 05:29 AM

rebel Browser-ul Netscape a împlinit 10 ani, dar are un ... 22 Oct 2004, 07:38 PM

rebel Yahoo! a încercat să câştige teren î... 22 Oct 2004, 07:54 PM

rebel Noua versiune a jocului de succes Grand Theft Auto... 23 Oct 2004, 10:02 AM

rebel Aplicaţia de căutare pe Desktop oferit... 23 Oct 2004, 10:45 AM

rebel Web browserul gratuit Firefox, ce a înlăturat... 9 Nov 2004, 02:07 PM

rebel Vânzătorul de muzică online Napster a an... 11 Dec 2004, 10:24 PM

rebel Sistemul de plată online PayPal va putea fi d... 12 Dec 2004, 12:37 AM

rebel Yahoo Inc. a anunţat că va începe testar... 12 Dec 2004, 01:58 AM

rebel Studiourile majore de la Hollywood intenţione... 14 Dec 2004, 04:58 PM

rebel Agenţia de supraveghere a Internetului a ofer... 14 Dec 2004, 05:39 PM

rebel Crearea unei librării globală virtual... 14 Dec 2004, 06:40 PM

rebel WebSideStory, companie de statistici la cerere a a... 14 Dec 2004, 07:08 PM

rebel Administratorul NASA, Sean O'Keefe se va întâl... 14 Dec 2004, 07:26 PM

rebel Poliţia germană a arestat joi cinci pers... 20 Dec 2004, 10:58 AM

rebel Namco a anunţat astăzi detalii privind u... 21 Dec 2004, 12:55 AM

rebel Iertare pentru lipsa de activitate din ultimul tim... 27 Jan 2005, 01:20 PM

rebel Google şi Yahoo! au anunţat lansarea... 27 Jan 2005, 01:26 PM

rebel Toţi utilizatorii Windows vor trebui să-... 27 Jan 2005, 02:23 PM

rebel Software-ul folosit în reţele foarte mari va ... 29 Jan 2005, 03:33 AM

rebel Google a lansat o versiune gratuită a unui AP... 29 Jan 2005, 03:56 AM

rebel Jeffrey Lee Parson, adolescentul din Minnesota car... 29 Jan 2005, 04:24 AM

rebel Pe 27 ianuarie 2005, jocul online numit Hattrick a... 29 Jan 2005, 01:10 PM

rebel Curtea Superma de Justitie din Norvegia a revocat ... 31 Jan 2005, 01:42 PM

rebel Skype, compania de telefonie pe Internet gratuit... 1 Feb 2005, 01:30 PM

dead-cat Solaris 10 released. 1 Feb 2005, 04:59 PM

rebel Omul principal în spatele browserului Firefox a an... 1 Feb 2005, 08:01 PM

rebel Nokia a intrat într-un acord de cooperare cu provi... 2 Feb 2005, 01:43 PM

rebel O mică firmă de securitate ruseasc... 2 Feb 2005, 03:47 PM

dead-cat Carly kicked! CEO-ul concernului Hewlett-Pack... 10 Feb 2005, 10:50 AM

rebel Bine ai venit pe-aici, dead-cat 11 Feb 2005, 12:32 PM

rebel Yahoo! a lansat o versiune beta a toolbar-ului... 11 Feb 2005, 12:56 PM

2 Pagini

1 2 >

« Cele mai vechi · Internet - Siteuri Utile, SEO, Promovare, Hosting · Cele mai noi »