BugTraq
Back to list
|
Post reply
Re: NetBIOS could be used as network flood amplier
Apr 05 2003 12:47AM
Francesco Vigo (f vigo anti-idle com)
In-Reply-To: <E9A01F52DC939448BBDE44ED2E1C468F6710DD (at) muskie.rc.on (dot) ca [email concealed]>
Hi,
maybe there was some incomprehension about what I meant.
I am aware that "Broadcast Storm" is an old and well known problem, that
affects misconfigured LANs. It's easy to find documentation about that
matter, but that's not the point of my discussion.
A "Broadcast Storm", as far as I know, happens when a lot of machines in a
local network, for some reason, start to send broadcast packets and fill
the network capacity.
My argument was about a different thing: many flooders, like smurf and
fraggle, work sending spoofed packets to broadcast addresses of
misconfigured networks, making all the machines reply to the spoofed
address, which is the "victim" host (outside the network) and gets
flooded. (e.g. with ICMP echo replies, UDP echo replies, UDP chargen data,
etc). I also noticed that there are a lot of variants of those programs
which work also with DNS data or game servers data.
Everyone knows this.
The only thing i've done is looking if this kind of attack could work even
with NetBIOS Name Request packets: after my tests I noticed that it works,
and it usually generates a bigger amount of replied data than ICMP echos,
UDP chargen or others.
I looked around in the Internet and found nothing about NetBIOS being used
IN THIS WAY (I mean spoofed NetBIOS Name Requests sent to broadcast
addresses of misconfigured networks to flood remote hosts), so I made
additional tests and made them public.
Best Regards,
Francesco Vigo
--- Original Message
>From: "Russ" <Russ.Cooper (at) rc.on (dot) ca [email concealed]>
>To: "Francesco Vigo" <f.vigo (at) anti-idle (dot) com [email concealed]>,
> <bugtraq (at) securityfocus (dot) com [email concealed]>
>
>Its called a NetBIOS Broadcast Storm, and its 15 years old now. No need =
>to write your own code, many manufacturers, like Ungermann-Bass, IBM, =
>Tandem Computers and others all wrote code that could do this quite =
>effectively. The only difference between your code and theirs is that =
>theirs would do it when you didn't want them to.
[ reply ]
Privacy Statement
Copyright 2010, SecurityFocus
Hi,
maybe there was some incomprehension about what I meant.
I am aware that "Broadcast Storm" is an old and well known problem, that
affects misconfigured LANs. It's easy to find documentation about that
matter, but that's not the point of my discussion.
A "Broadcast Storm", as far as I know, happens when a lot of machines in a
local network, for some reason, start to send broadcast packets and fill
the network capacity.
My argument was about a different thing: many flooders, like smurf and
fraggle, work sending spoofed packets to broadcast addresses of
misconfigured networks, making all the machines reply to the spoofed
address, which is the "victim" host (outside the network) and gets
flooded. (e.g. with ICMP echo replies, UDP echo replies, UDP chargen data,
etc). I also noticed that there are a lot of variants of those programs
which work also with DNS data or game servers data.
Everyone knows this.
The only thing i've done is looking if this kind of attack could work even
with NetBIOS Name Request packets: after my tests I noticed that it works,
and it usually generates a bigger amount of replied data than ICMP echos,
UDP chargen or others.
I looked around in the Internet and found nothing about NetBIOS being used
IN THIS WAY (I mean spoofed NetBIOS Name Requests sent to broadcast
addresses of misconfigured networks to flood remote hosts), so I made
additional tests and made them public.
Best Regards,
Francesco Vigo
--- Original Message
>From: "Russ" <Russ.Cooper (at) rc.on (dot) ca [email concealed]>
>To: "Francesco Vigo" <f.vigo (at) anti-idle (dot) com [email concealed]>,
> <bugtraq (at) securityfocus (dot) com [email concealed]>
>
>Its called a NetBIOS Broadcast Storm, and its 15 years old now. No need =
>to write your own code, many manufacturers, like Ungermann-Bass, IBM, =
>Tandem Computers and others all wrote code that could do this quite =
>effectively. The only difference between your code and theirs is that =
>theirs would do it when you didn't want them to.
[ reply ]