Researcher's Death Casts Pall Over Major TCP Fix

[Paul Ferguson <fergdawgster () gmail com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I did know Jack, but this is very tragic.

[snip]

The security researcher who discovered a major networking flaw that could
be used to take down Internet servers has died, leaving others to carry on
the work of fixing the flaw without him.

Jack Louis died in the early morning of March 15 of smoke inhalation during
a fire in his home in Karlskrona, Sweden. He was 32. Prior to his death, he
had discovered a half-dozen vulnerabilities that could be used to attack
computers via the Internet, using what's known as a Sockstress attack.

The attack could allow a low-bandwidth computer to knock very large servers
off of the Internet by attacking the TCP (Transmission Control Protocol)
software used by systems on the Internet. Although technical details of the
attack have not been disclosed, it could be targeted at routers, servers,
and even firewalls.

"These vulnerabilities have been around for a long time, and to the best of
our knowledge they have not been used in the wild," said Robert E. Lee, the
Outpost24 researcher who worked with Louis on the issue, and who had
frequently presented with Louis at security conferences and training
sessions.

Lee has had to step up to fill in his colleague's shoes following the
death. "It's been rough," he said. "Jack's been a very close friend and
business partner for the past six years. We did everything together."

The Finnish national Computer Emergency Response Team, (CERT-FI) which has
been coordinating work with the many vendors who must patch the issue, says
it expects to see patches by year's end.

The situation is unprecedented, said Jussi Eronen, an information security
adviser with CERT-FI.

"Jack's death didn't make our work any easier," Eronen said. However, he
added, "he documented his work very well and we have received the necessary
materials to report issues to vendors."

Lee expects to see patches in early June, although that date could be
pushed back. "The problem is, we can't have one vendor release [a patch]
without all the other vendors releasing it at the same time." Otherwise,
malicious hackers could reverse-engineer the fix in order to attack an
unpatched system.

Louis didn't have the chance to hand over all of his vulnerability research
before his death, Lee said. "There were a number of additional
[vulnerabilities] where Jack didn't have enough information to give the
vendors," he said.

To keep his work alive, however, Louis' friend Rick Jones is setting up a
foundation that will continue his work.

More information about Jack Louis can be found here 1] and on Lee's blog
[2].


[end]

Link:
http://www.pcworld.com/businesscenter/article/162765/researchers_death_cast
s_pall_over_major_tcp_fix.html

[1] http://unicornscan.org/
[2]
http://blog.robertlee.name/2009/03/jack-c-louis-loss-of-dear-friend.html

- - ferg

-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.5.3 (Build 5003)

wj8DBQFJ2/anq1pz9mNUZTMRAtizAKDTF7m763LYL//qheDGLjWNRg8KCQCgvUoD
tLi2Yc3lpVWFagfVUMUsU/o=
=s6XD
-----END PGP SIGNATURE-----




-- 
"Fergie", a.k.a. Paul Ferguson
 Engineering Architecture for the Internet
 fergdawgster(at)gmail.com
 ferg's tech blog: http://fergdawg.blogspot.com/
_______________________________________________
Fun and Misc security discussion for OT posts.
https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
Note: funsec is a public and open mailing list.