|
|
BugTraq
Re: IPv4 fragmentation --> The Rose Attack Apr 07 2004 08:56AM Ventsislav Genchev (vigour atlantis bg) (2 replies) RE: IPv4 fragmentation --> The Rose Attack Apr 12 2004 11:21AM Taylan Develioglu (percival devnull nl) Re: IPv4 fragmentation --> The Rose Attack Apr 08 2004 06:26PM Darren Reed (avalon caligula anu edu au) (1 replies) Re: IPv4 fragmentation --> The Rose Attack Apr 09 2004 11:29AM gandalf digital net (1 replies) Re: IPv4 fragmentation --> The Rose Attack Apr 09 2004 05:56PM Darren Reed (avalon caligula anu edu au) (1 replies) Re: IPv4 fragmentation --> The Rose Attack Apr 09 2004 10:59PM gandalf digital net (1 replies) Re: IPv4 fragmentation --> The Rose Attack Apr 10 2004 01:23PM Darren Reed (avalon caligula anu edu au) (1 replies) |
|
Privacy Statement |
On 4/10/04 8:23 AM, "Darren Reed" <avalon (at) caligula.anu.edu (dot) au [email concealed]> wrote:
> In some mail from gandalf (at) digital (dot) net [email concealed], sie said:
>> I work at many other places than on my own personal computers. I would like
>> to know if attacks might affect any number of computers. I am a computer
>> professional.
>
> And if so, surely any place where you see "Windows 9*/ME" should bring a
> "you need to start planning on upgrading/replacing these with 2K/XP, if
> you haven't already." styled response.
Yup. Been there, did that. Small businesses have a hard enough time
justifying doing maintenance much less buying new equipment.
>> Or program with queues that drop packets in a FIFO fashion that have enough
>> memory that an attack will still allow fragmented packets to be serviced.
>> You can (at least) make it harder to DoS a machine.
>
> If the time an entry stays in the queue is less than the time required
> for reassembly to occur then even a FIFO will not suffice as an adequate
> algorithmic countermeasure. There are solutions to this too, but this
> is just to say that it's more complex than "throw this data structure
> in to fix."
> Darren
Agree 100% that a simple data structure will not fix this problem. But it
is a start. I would also say that in this case a "standard" (I.e. RFC) for
fragmentation reassembly should be written to take all of the diverse ways
that fragments are handled and standardize them. Again I am amazed that
every machine I hit with fragments seems to have a different effect on the
machine than the last machine I tested against.
Ken
---------------------------------------------------------------
Do not meddle in the affairs of wizards for they are subtle and
quick to anger.
Ken Hollis - Gandalf The White - gandalf (at) digital (dot) net [email concealed] - O- TINLC
WWW Page - http://digital.net/~gandalf/
Trace E-Mail forgery - http://digital.net/~gandalf/spamfaq.html
Trolls crossposts - http://digital.net/~gandalf/trollfaq.html
[ reply ]