Re: is: tcp/ip vuln, not?... was: WSCRIPT.EXE ,CSCRIPT.EXE replacement for *.vbs

[crispin () WIREX COM (Crispin Cowan)]

Bluefish wrote:

> Ehm. In what way did shortcommings of TCP/IP have any specific impact upon
> the DDoS attacks? The attack was dependent upon two issues:
>   1. ability to fill up the physical bandwith (alas network hardware)
>   2. ability to overload local resources (RAM, processor etc)

3.  Ability to spoof a source IP address.

3 is critical, because the DDoS attacks use a relatively small number of zombie
machines to spoof the existance of a really large number of legitimate clients.
Without source IP address spoofing, the attacker could easily discover the few
dozen zombie machines that are pounding the defender's machine, and have them
shut down.

> None of these attacks were directly related to any TCP/IP vulnerability.

The complete lack of authentication in IP datagrams is directly related to the
TCP/IP vulnerability.

Crispin
-----
Crispin Cowan, CTO, WireX Communications, Inc.    http://wirex.com
Free Hardened Linux Distribution:                 http://immunix.org
                  JOBS!  http://immunix.org/jobs.html