Re: is: tcp/ip vuln, not?... was: WSCRIPT.EXE ,CSCRIPT.EXE replacement for *.vbs

[jlegate () ALIENCHICK COM (Jason Legate)]

In addition, the inability for routers to filter a major portion of the
data (null tcp packets/ack tcp packets) due to the possible validity of
all the packets.  If router filters are added to block a major chunk of
the newer DDoS's, they would have to block all legit traffic since the
newer packet generators generate "normal tcp traffic".

-j

On Tue, May 16, 2000 at 12:41:08AM +0000, Crispin Cowan wrote:
> Bluefish wrote:
>
> > Ehm. In what way did shortcommings of TCP/IP have any specific impact upon
> > the DDoS attacks? The attack was dependent upon two issues:
> >   1. ability to fill up the physical bandwith (alas network hardware)
> >   2. ability to overload local resources (RAM, processor etc)
>
> 3.  Ability to spoof a source IP address.
>
> 3 is critical, because the DDoS attacks use a relatively small number of zombie
> machines to spoof the existance of a really large number of legitimate clients.
> Without source IP address spoofing, the attacker could easily discover the few
> dozen zombie machines that are pounding the defender's machine, and have them
> shut down.
>
>
> > None of these attacks were directly related to any TCP/IP vulnerability.
>
> The complete lack of authentication in IP datagrams is directly related to the
> TCP/IP vulnerability.
>
> Crispin
> -----
> Crispin Cowan, CTO, WireX Communications, Inc.    http://wirex.com
> Free Hardened Linux Distribution:                 http://immunix.org
>                   JOBS!  http://immunix.org/jobs.html

-- 
/--------------------------/ Jason Legate \------------------------\
|     jlegate () sitesmith com       |         SiteSmith, Inc.        |
|        24x7 Call Center         |    http://www.sitesmith.com    |
|          888.898.7667           |     PGP Key ID - 0xA855AAC3    |
+---------------------------------+--------------------------------+
| Fingerprint - 2D5F 87A0 26E6 A65B 6837  D100 FB54 A972 A855 AAC3 |
\------------------------------------------------------------------/


<HR NOSHADE>
<UL>
<LI>application/pgp-signature attachment: stored
</UL>