Re: Naptha - New DoS

[Sebastian <scut () NB IN-BERLIN DE>]

Hi.

On Fri, Dec 08, 2000 at 09:14:50AM +0000, rpc wrote:

> On reading the Razor advisory, it seems the attack involves spoofing as well as
> sniffing.
> There is a daemon running on a machine on the same LAN as the victem, which
> listens for the spoofed SYN packets, and the SYN/ACK reply from the victem.
> The sniffing daemon then forges the last ACK of the handshake, from the spoof
> to the victem.        Thus the victem thinks the TCP connection is ESTABLISHED and
> legitmate.  Repeat.

This is exactly the same as the "3wahas" flood utility does. Since over one
and a half year. (get it from teso.scene.at/releases.php)

ciao,
scut

--
- scut () nb in-berlin de - http://nb.in-berlin.de/scut/ --- you don't need a --
-- lot of people to be great, you need a few great to be the best ------------
http://3261000594/scut/pgp - 5453 AC95 1E02 FDA7 50D2 A42D 427E 6DEF 745A 8E07
-- CSMC_TOP_SECRET_ATOMAL.tar.bz2, 69043590 bytes received in 381.4 seconds --