Definition:
A LAND attack is a DoS (Denial of Service) attack that consists of
sending a special poison spoofed packet to a computer, causing it to
lock up. The security flaw was first discovered in 1997 by someone
using the alias "m3lt", and has resurfaced many years later in
operating systems such as Windows Server 2003 and Windows XP SP2.
(http://en.wikipedia.org/wiki/LAND_attack)
Explanation of LanD:
LanD uses a specially crafted ICMP echo packet which has the same
source and destination address. The receiving system stalls due to
the erroneous packet and not having instructions to handle the unique
packet. In Windows 9x variants, the systems will "blue screen. " On
modern NT variants, the systems will hang for approximately 30
seconds with full CPU usage before discarding the packet. With a
looped script, the attacker can render the system useless. UNIX
variants have been able to use a firewall rule to drop LanD packets ?
leaving most systems patched.
Microsoft originally released an initial patch that secured Windows 9x
variants ? causing the exploit to lose popularity and become somewhat
obscure. Later, when Windows NT variants were released, Microsoft
neglected to patch the security flaw; this caused Windows XP Service
Pack 2 to remain susceptible to such an attack. Within the last four
(4) months, Microsoft has released a patch for Windows NT variants.
LanD versus Remote LanD:
LanD was originally introduced in the late 1990s and was very popular
with educational and business networks. The original LanD attack had
to be executed internally on the local network ? thereby giving rise
to the name "LanD" (indicating that access has been granted to the
local premises). However, with a remote attack (Remote LanD),
crafting special packets and spoofing the destination and source IP
addresses will cause the attack to be carried out remotely against the
central connectivity device.
Exploit / Proof of Concept:
There is no handwritten code needed to exploit this vulnerability.
The only requirement is an IP packet creation utility (such as HPing2
or IPSorcery). Below are some HPing2 examples:
Victim's IP Address: 63.24.122.59
Victim's Router IP Address: 192.168.1.1
hping2 -A -S -P -U 63.24.122.59 -s 80 -p 80 -a 192.168.1.1
Remote LanD Specifications:
Although the exploit will work without the Ack, Syn, Push, and Urg
(flags), the device does not seem to shut off without these flags.
Sending just the LanD part of the packet seems to only create high
amounts of latency on the victim's end. The spoofed source address
must be the address of the central connectivity device; although the
normal default is 192.168.1.1, some manufacturers use different
addresses (such as 192.168.1.100 or 192.168.0.1). As a result, the IP
address should be checked prior to initiating any test. Additionally,
a broadcast address will work for a source address as well, thereby
flooding the network with responses from all the machines connected to
the network. Although it will not stale the Central Connectivity
Device, it will maximize the entire network usage - crippling the
network with extremely high latency.
Test Environment:
- Test One
- Attacker: hping2 on Comcast Cable connection behind Linksys Router
- Victim: DSL Modem/Router on Verizon DSL connection
- Test Two
- Attacker: hping2 on Comcast Cable connection behind Linksys Router
- Victim: Linksys Router on Comcast Cable connection
- Test Three
- Attacker: hping2 on Comcast connection behind Linksys Router
- Victim: Comcast Cable Modem
- Test Four
- Attacker: hping2 on Comcast connection behind Linksys Router
- Victim: Cisco Router on T1 connection
- Test Five
- Attacker: hping2 on Comcast connection behind Linksys Router
- Victim: Cisco Pix Firewall, on T1 connection
Test Results:
Test One:
Connection Latency - followed by the modem physically turning off.
Time elapsed: approximately 10 seconds (from beginning of packet
flooding to complete shutdown).
Test Two:
Connection Latency, router reset, then connection lost. Reset needed
before router would communicate online again.
Test Three:
Modem lights flickered; the modem lost connection and sat with the
Data light completely out.
Test Four:
Router lost connection to the internet.
Test Five:
Firewall lost network connection.
Conclusion:
It appears that central connectivity device manufacturers need to
release firmware updates and/or patches to protect against LanD and
remote LanD attacks. The LanD attack is no longer simply a local
attack but has now evolved into having the capability of being
launched remotely.
Acknowledgements:
- Casey O'Brien, M.S.
- Assisted with test trials
- Matthew Wines
- Assisted with test trials
- Yvonne M. Wray, M.S.
- Report editor
As discovered by:
Justin M. Wray
(jayizkool (at) gmail (dot) com [email concealed])
Devices/Vendors Vulnerable:
Microsoft Windows XP, SP1 and SP2
Linksys Routers
Westell Routers/Modems
Motorola Modems/Routers
Cisco Firewalls, Switches, and Routers
DSL Modems
Cable Modems
Consumer Routers
All Central Connectivity Devices (any manufacturer)
Devices/Vendors Tested:
Linksys BEFW11S4
Linksys WRT54GS
Westell Versalink 327W (Verizon Modem)
Cisco Catalyst Series (Multiple)
Scientific Atlantic DPX2100 (Comcast Modem)
Definition:
A LAND attack is a HYPERLINK "http://en.wikipedia.org/wiki/Denial-of-service_attack" \o "Denial-of-service attack" DoS (Denial of Service) attack that consists of sending a special poison HYPERLINK "http://en.wikipedia.org/wiki/Spoofing_attack" \o "Spoofing attack" spoofed HYPERLINK "http://en.wikipedia.org/wiki/Packet" \o "Packet" packet to a computer, causing it to lock up. The security flaw was first discovered in 1997 by someone using the alias "m3lt", and has resurfaced many years later in HYPERLINK "http://en.wikipedia.org/wiki/Operating_system" \o "Operating system" operating systems such as HYPERLINK "http://en.wikipedia.org/wiki/Windows_Server_2003" \o "Windows Server 2003" Windows Server 2003 and HYPERLINK "http://en.wikipedia.org/wiki/Windows_XP" \o "Windows XP" Windows XP SP2. ( HYPERLINK "http://en.wikipedia.org/wiki/LAND_attack" http://en.wikipedia.org/wiki/LAND_attack)
Explanation of LanD:
LanD uses a specially crafted ICMP echo packet which has the same source and destination address. The receiving system stalls due to the erroneous packet and not having instructions to handle the unique packet. In Windows 9x variants, the systems will ?blue screen.? On modern NT variants, the systems will hang for approximately 30 seconds with full CPU usage before discarding the packet. With a looped script, the attacker can render the system useless. UNIX variants have been able to use a firewall rule to drop LanD packets ? leaving most systems patched.
Microsoft originally released an initial patch that secured Windows 9x variants ? causing the exploit to lose popularity and become somewhat obscure. Later, when Windows NT variants were released, Microsoft neglected to patch the security flaw; this caused Windows XP Service Pack 2 to remain susceptible to such an attack. Within the last four (4) months, Microsoft has released a patch for Windows NT variants.
LanD versus Remote LanD:
LanD was originally introduced in the late 1990s and was very popular with educational and business networks. The original LanD attack had to be executed internally on the local network ? thereby giving rise to the name ?LanD? (indicating that access has been granted to the local premises). However, with a remote attack (Remote LanD), crafting special packets and spoofing the destination and source IP addresses will cause the attack to be carried out remotely against the central connectivity device.
Exploit / Proof of Concept:
There is no handwritten code needed to exploit this vulnerability. The only requirement is an IP packet creation utility (such as HPing2 or IPSorcery). Below are some HPing2 examples:
Victim?s IP Address: 63.24.122.59
Victim?s Router IP Address: 192.168.1.1
hping2 -A -S -P -U 63.24.122.59 -s 80 -p 80 -a 192.168.1.1
Remote LanD Specifications:
Although the exploit will work without the Ack, Syn, Push, and Urg (flags), the device does not seem to shut off without these flags. Sending just the LanD part of the packet seems to only create high amounts of latency on the victim?s end. The spoofed source address must be the address of the central connectivity device; although the normal default is 192.168.1.1, some manufacturers use different addresses (such as 192.168.1.100 or 192.168.0.1). As a result, the IP address should be checked prior to initiating any test. Additionally, a broadcast address will work for a source address as well, thereby flooding the network with responses from all the machines connected to the network. Although it will not stale the Central Connectivity Device, it will maximize the entire network usage - crippling the network with extremely high latency.
Test Environment:
Test One
Attacker: hping2 on Comcast Cable connection behind Linksys Router
Victim: DSL Modem/Router on Verizon DSL connection
Test Two
Attacker: hping2 on Comcast Cable connection behind Linksys Router
Victim: Linksys Router on Comcast Cable connection
Test Three
Attacker: hping2 on Comcast connection behind Linksys Router
Victim: Comcast Cable Modem
Test Four
Attacker: hping2 on Comcast connection behind Linksys Router
Victim: Cisco Router on T1 connection
Test Five
Attacker: hping2 on Comcast connection behind Linksys Router
Victim: Cisco Pix Firewall, on T1 connection
Test Results:
Test One:
Connection Latency - followed by the modem physically turning off. Time elapsed: approximately 10 seconds (from beginning of packet flooding to complete shutdown).
Test Two:
Connection Latency, router reset, then connection lost. Reset needed before router would communicate online again.
Test Three:
Modem lights flickered; the modem lost connection and sat with the Data light completely out.
Test Four:
Router lost connection to the internet.
Test Five:
Firewall lost network connection.
Conclusion:
It appears that central connectivity device manufacturers need to release firmware updates and/or patches to protect against LanD and remote LanD attacks. The LanD attack is no longer simply a local attack but has now evolved into having the capability of being launched remotely.
Acknowledgements:
Casey O?Brien, M.S.
-Assisted with test trials
Matthew Wines
-Assisted with test trials
Yvonne M. Wray, M.S.
-Report editor
Submitted: 12/14/2005 by Justin M. Wray
Unpatched systems only
As recently posted on BugTraq.
Pix firewalls with a rule dropping LanD packets are not affected.
This is a theoretical view point of the author; not all devices/vendors have been tested.
Internet Control Message Protocol
Includes Windows 95, Windows 98, and Windows ME
Also known as the ?blue screen of death,? this is a common Microsoft Windows error that causes the need for the system to be manually re-started.
Includes Windows NT 4, Windows 2000, Windows 2000 Server, Windows XP (Home and Professional), Service Pack 1, and Service Pack 2
PAGE
PAGE 7
"%/345CDYZ\vwx???ÂÙÚÛáìôõ , @ M O R S ] _ ` a b x z ? ? ? ¢ £ ³  öíéåéåéÝØåÑéÇ¿Ç»±»é£ééé£éé????éÇ¿?é?éhtShX9Uhjdßhjdß hû^?>*jh? ?0JUh? ?jhû^?0JUhû^?jh{ù0JUh{ùh{ùhjdß5h{ùhjdß5>*
hUxhUx hjdß5hUxhjdß5hUxhjdßhpA?5CJ(aJ(hjdß5CJ(aJ(2 !"4DZ[\x?«ÂÛ , a b z ? ôôôôôôôôôôìááááÖááááììË
& Fdàgdjdß
& Fdàgdû^?
& Fdàgdjdßdàgdjdß
$dàa$gdjdßä -!R!ýýý? ? Ã ä
MSWord (.doc) version with rich formatting, created with ease of view
in mind.
Regards...
----------
RLA
("Remote LanD Attack")
2005
As discovered by:
Justin M. Wray
(jayizkool (at) gmail (dot) com [email concealed])
Devices/Vendors Vulnerable:
- Microsoft Windows XP, SP1 and SP2
- Linksys Routers
- Westell Routers/Modems
- Motorola Modems/Routers
- Cisco Firewalls, Switches, and Routers
- DSL Modems
- Cable Modems
- Consumer Routers
- All Central Connectivity Devices (any manufacturer)
Devices/Vendors Tested:
- Linksys BEFW11S4
- Linksys WRT54GS
- Westell Versalink 327W (Verizon Modem)
- Cisco Catalyst Series (Multiple)
- Scientific Atlantic DPX2100 (Comcast Modem)
Definition:
A LAND attack is a DoS (Denial of Service) attack that consists of
sending a special poison spoofed packet to a computer, causing it to
lock up. The security flaw was first discovered in 1997 by someone
using the alias "m3lt", and has resurfaced many years later in
operating systems such as Windows Server 2003 and Windows XP SP2.
(http://en.wikipedia.org/wiki/LAND_attack)
Explanation of LanD:
LanD uses a specially crafted ICMP echo packet which has the same
source and destination address. The receiving system stalls due to
the erroneous packet and not having instructions to handle the unique
packet. In Windows 9x variants, the systems will "blue screen. " On
modern NT variants, the systems will hang for approximately 30
seconds with full CPU usage before discarding the packet. With a
looped script, the attacker can render the system useless. UNIX
variants have been able to use a firewall rule to drop LanD packets ?
leaving most systems patched.
Microsoft originally released an initial patch that secured Windows 9x
variants ? causing the exploit to lose popularity and become somewhat
obscure. Later, when Windows NT variants were released, Microsoft
neglected to patch the security flaw; this caused Windows XP Service
Pack 2 to remain susceptible to such an attack. Within the last four
(4) months, Microsoft has released a patch for Windows NT variants.
LanD versus Remote LanD:
LanD was originally introduced in the late 1990s and was very popular
with educational and business networks. The original LanD attack had
to be executed internally on the local network ? thereby giving rise
to the name "LanD" (indicating that access has been granted to the
local premises). However, with a remote attack (Remote LanD),
crafting special packets and spoofing the destination and source IP
addresses will cause the attack to be carried out remotely against the
central connectivity device.
Exploit / Proof of Concept:
There is no handwritten code needed to exploit this vulnerability.
The only requirement is an IP packet creation utility (such as HPing2
or IPSorcery). Below are some HPing2 examples:
Victim's IP Address: 63.24.122.59
Victim's Router IP Address: 192.168.1.1
hping2 -A -S -P -U 63.24.122.59 -s 80 -p 80 -a 192.168.1.1
Remote LanD Specifications:
Although the exploit will work without the Ack, Syn, Push, and Urg
(flags), the device does not seem to shut off without these flags.
Sending just the LanD part of the packet seems to only create high
amounts of latency on the victim's end. The spoofed source address
must be the address of the central connectivity device; although the
normal default is 192.168.1.1, some manufacturers use different
addresses (such as 192.168.1.100 or 192.168.0.1). As a result, the IP
address should be checked prior to initiating any test. Additionally,
a broadcast address will work for a source address as well, thereby
flooding the network with responses from all the machines connected to
the network. Although it will not stale the Central Connectivity
Device, it will maximize the entire network usage - crippling the
network with extremely high latency.
Test Environment:
- Test One
- Attacker: hping2 on Comcast Cable connection behind Linksys Router
- Victim: DSL Modem/Router on Verizon DSL connection
- Test Two
- Attacker: hping2 on Comcast Cable connection behind Linksys Router
- Victim: Linksys Router on Comcast Cable connection
- Test Three
- Attacker: hping2 on Comcast connection behind Linksys Router
- Victim: Comcast Cable Modem
- Test Four
- Attacker: hping2 on Comcast connection behind Linksys Router
- Victim: Cisco Router on T1 connection
- Test Five
- Attacker: hping2 on Comcast connection behind Linksys Router
- Victim: Cisco Pix Firewall, on T1 connection
Test Results:
Test One:
Connection Latency - followed by the modem physically turning off.
Time elapsed: approximately 10 seconds (from beginning of packet
flooding to complete shutdown).
Test Two:
Connection Latency, router reset, then connection lost. Reset needed
before router would communicate online again.
Test Three:
Modem lights flickered; the modem lost connection and sat with the
Data light completely out.
Test Four:
Router lost connection to the internet.
Test Five:
Firewall lost network connection.
Conclusion:
It appears that central connectivity device manufacturers need to
release firmware updates and/or patches to protect against LanD and
remote LanD attacks. The LanD attack is no longer simply a local
attack but has now evolved into having the capability of being
launched remotely.
Acknowledgements:
- Casey O'Brien, M.S.
- Assisted with test trials
- Matthew Wines
- Assisted with test trials
- Yvonne M. Wray, M.S.
- Report editor
Submitted: 12/14/2005 by Justin M. Wray
--
Regards,
SynSyn
Netowork Manager, Server Administrator, Security Specialist
(http://www.teamtrinix.com)
ÐÏࡱá>þÿ VXþÿÿÿUÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
ÿÿÿÿÿÿÿÿÿÿÿì¥Á` ø¿S!bjbjËsËs sD©©äI%ÿÿÿÿÿÿ¤ÂÂÂ4ö( $B???PÚT.4Bw.2n?ð"
íííö-ø-ø-ø-ø-ø-ø-$©/h2L . ? íí? ? . Û1.P P P ? ö-P ? ö-P P rÆ+T Æ,b?]±NxÆ? |,ö-G.0w.(,?]2 Ê]2 Æ,]2 Æ,0í®?|P d{ííí . .æ jíííw.? ? ? ? BBBÄ?BBBBBB
ÿÿÿÿRLA
(?Remote LanD Attack?)
2005
As discovered by:
Justin M. Wray
(jayizkool (at) gmail (dot) com [email concealed])
Devices/Vendors Vulnerable:
Microsoft Windows XP, SP1 and SP2
Linksys Routers
Westell Routers/Modems
Motorola Modems/Routers
Cisco Firewalls, Switches, and Routers
DSL Modems
Cable Modems
Consumer Routers
All Central Connectivity Devices (any manufacturer)
Devices/Vendors Tested:
Linksys BEFW11S4
Linksys WRT54GS
Westell Versalink 327W (Verizon Modem)
Cisco Catalyst Series (Multiple)
Scientific Atlantic DPX2100 (Comcast Modem)
Definition:
A LAND attack is a HYPERLINK "http://en.wikipedia.org/wiki/Denial-of-service_attack" \o "Denial-of-service attack" DoS (Denial of Service) attack that consists of sending a special poison HYPERLINK "http://en.wikipedia.org/wiki/Spoofing_attack" \o "Spoofing attack" spoofed HYPERLINK "http://en.wikipedia.org/wiki/Packet" \o "Packet" packet to a computer, causing it to lock up. The security flaw was first discovered in 1997 by someone using the alias "m3lt", and has resurfaced many years later in HYPERLINK "http://en.wikipedia.org/wiki/Operating_system" \o "Operating system" operating systems such as HYPERLINK "http://en.wikipedia.org/wiki/Windows_Server_2003" \o "Windows Server 2003" Windows Server 2003 and HYPERLINK "http://en.wikipedia.org/wiki/Windows_XP" \o "Windows XP" Windows XP SP2. ( HYPERLINK "http://en.wikipedia.org/wiki/LAND_attack" http://en.wikipedia.org/wiki/LAND_attack)
Explanation of LanD:
LanD uses a specially crafted ICMP echo packet which has the same source and destination address. The receiving system stalls due to the erroneous packet and not having instructions to handle the unique packet. In Windows 9x variants, the systems will ?blue screen.? On modern NT variants, the systems will hang for approximately 30 seconds with full CPU usage before discarding the packet. With a looped script, the attacker can render the system useless. UNIX variants have been able to use a firewall rule to drop LanD packets ? leaving most systems patched.
Microsoft originally released an initial patch that secured Windows 9x variants ? causing the exploit to lose popularity and become somewhat obscure. Later, when Windows NT variants were released, Microsoft neglected to patch the security flaw; this caused Windows XP Service Pack 2 to remain susceptible to such an attack. Within the last four (4) months, Microsoft has released a patch for Windows NT variants.
LanD versus Remote LanD:
LanD was originally introduced in the late 1990s and was very popular with educational and business networks. The original LanD attack had to be executed internally on the local network ? thereby giving rise to the name ?LanD? (indicating that access has been granted to the local premises). However, with a remote attack (Remote LanD), crafting special packets and spoofing the destination and source IP addresses will cause the attack to be carried out remotely against the central connectivity device.
Exploit / Proof of Concept:
There is no handwritten code needed to exploit this vulnerability. The only requirement is an IP packet creation utility (such as HPing2 or IPSorcery). Below are some HPing2 examples:
Victim?s IP Address: 63.24.122.59
Victim?s Router IP Address: 192.168.1.1
hping2 -A -S -P -U 63.24.122.59 -s 80 -p 80 -a 192.168.1.1
Remote LanD Specifications:
Although the exploit will work without the Ack, Syn, Push, and Urg (flags), the device does not seem to shut off without these flags. Sending just the LanD part of the packet seems to only create high amounts of latency on the victim?s end. The spoofed source address must be the address of the central connectivity device; although the normal default is 192.168.1.1, some manufacturers use different addresses (such as 192.168.1.100 or 192.168.0.1). As a result, the IP address should be checked prior to initiating any test. Additionally, a broadcast address will work for a source address as well, thereby flooding the network with responses from all the machines connected to the network. Although it will not stale the Central Connectivity Device, it will maximize the entire network usage - crippling the network with extremely high latency.
Test Environment:
Test One
Attacker: hping2 on Comcast Cable connection behind Linksys Router
Victim: DSL Modem/Router on Verizon DSL connection
Test Two
Attacker: hping2 on Comcast Cable connection behind Linksys Router
Victim: Linksys Router on Comcast Cable connection
Test Three
Attacker: hping2 on Comcast connection behind Linksys Router
Victim: Comcast Cable Modem
Test Four
Attacker: hping2 on Comcast connection behind Linksys Router
Victim: Cisco Router on T1 connection
Test Five
Attacker: hping2 on Comcast connection behind Linksys Router
Victim: Cisco Pix Firewall, on T1 connection
Test Results:
Test One:
Connection Latency - followed by the modem physically turning off. Time elapsed: approximately 10 seconds (from beginning of packet flooding to complete shutdown).
Test Two:
Connection Latency, router reset, then connection lost. Reset needed before router would communicate online again.
Test Three:
Modem lights flickered; the modem lost connection and sat with the Data light completely out.
Test Four:
Router lost connection to the internet.
Test Five:
Firewall lost network connection.
Conclusion:
It appears that central connectivity device manufacturers need to release firmware updates and/or patches to protect against LanD and remote LanD attacks. The LanD attack is no longer simply a local attack but has now evolved into having the capability of being launched remotely.
Acknowledgements:
Casey O?Brien, M.S.
-Assisted with test trials
Matthew Wines
-Assisted with test trials
Yvonne M. Wray, M.S.
-Report editor
Submitted: 12/14/2005 by Justin M. Wray
Unpatched systems only
As recently posted on BugTraq.
Pix firewalls with a rule dropping LanD packets are not affected.
This is a theoretical view point of the author; not all devices/vendors have been tested.
Internet Control Message Protocol
Includes Windows 95, Windows 98, and Windows ME
Also known as the ?blue screen of death,? this is a common Microsoft Windows error that causes the need for the system to be manually re-started.
Includes Windows NT 4, Windows 2000, Windows 2000 Server, Windows XP (Home and Professional), Service Pack 1, and Service Pack 2
PAGE
PAGE 7
"%/345CDYZ\vwx???ÂÙÚÛáìôõ , @ M O R S ] _ ` a b x z ? ? ? ¢ £ ³  öíéåéåéÝØåÑéÇ¿Ç»±»é£ééé£éé????éÇ¿?é?éhtShX9Uhjdßhjdß hû^?>*jh? ?0JUh? ?jhû^?0JUhû^?jh{ù0JUh{ùh{ùhjdß5h{ùhjdß5>*
hUxhUx hjdß5hUxhjdß5hUxhjdßhpA?5CJ(aJ(hjdß5CJ(aJ(2 !"4DZ[\x?«ÂÛ , a b z ? ôôôôôôôôôôìááááÖááááììË
& Fdàgdjdß
& Fdàgdû^?
& Fdàgdjdßdàgdjdß
$dàa$gdjdßä -!R!ýýý? ? Ã ä
º
»
Ð
«¬ÅÁÂÞ?»å"#???§°ôôôôìììììììììììììììììììììá
& Fdàgd1dàgdpA?
& FdàgdjdßÂ Ã É Ñ ã ä
#
0
1
?
?
?
?
Ý
Þ
- . 5 6 7 8 u v | } op???ãä÷øýþC
üøñøüíéßÒËÁ˶˶©¶Ë¶Ë¶?¶Ë¶Ë¶?¶Ë¶Ë¶?¶Ë??p?? h=¥h=¥0J>*B*phh=¥
h=¥B*ph jh=¥h=¥B*Uph h=¥h=¥0J>*B*phÿh=¥h=¥0JB*phÿ
jh=¥h=¥Uh=¥h=¥5\h=¥h=¥h{ùh=¥5B*phh{ùh=¥5>*hpA?hû^?hX9UhX9UhX9Uhjdß,C
D
N
O
V
W
?
·
¸
¹
º
»
Î
Ð
ò
ó
2¥¦³´»½ÉÊÌÏÝÞàáðáðÖðÖÃðáðÖ»³¥?yqyyiyiyayRyq jhnj0J
B*Uphh1!§B*phh´Y¬B*phh-b?B*phhnjB*ph jhË'?0JB*Uph
hK¾B*phh{ùh?45B*phh{ùh?45>*B*phh=¥B*phh -¨B*
ph$jh=¥h=¥B*Uphh=¥h=¥B*ph h=¥h=¥0J>*B*ph jh
=¥h=¥B*Uph áëíîõ÷]¯²´Ë
;Pbhijª«¬°ÃÅÙ÷ïàïØïØïÐØÐÈÐÀ¸°¨ ? ? ?ugZRh¤MÅB*phh{
ùh=¥5B*phh{ùh¤MÅ5>*B*phh{ùh=¥5>*B*phh?4>*B*p
hh?4h?hdB*phh+}qB*phh{ùB*phheB*phh?hdB*phh?4B*ph
hc@B*phh jB*phh-b?B*phh´Y¬B*ph jhË'?0JB*Uphhri?B*phhnjB*ph Ù
äõúþLÁÒçc?¯¿ÀÁÂÜçèì÷ø
!"#=>÷ïçßç÷ß÷×Ï×Ç¿ÇÏ·Ï©Ï?????~?Ïvk^Vh1B*phh1h15B
*phh15>*B*phh¡RþB*phhÅ|6B*phh#i¸6B*phhÇPßhÇPß6
B*phh?;6B*phhÇPßhÇPß5>*B*phh=¥B*phhF+B*phh åB
*phhÇPßB*phh>5¾B*phh+}qB*phhç?B*phh¤MÅB*phh B*ph
???)*67hipq}~??ÁÂÙÛÜÝ<Sa?£©¬Þê8<=
Q_`gj??¥¦§°¹ô÷ï÷ï÷ï÷ïçïçïçïçïçïçïçïçïçßçßçßçß×ßÊ¿×ß×ß×·¯¡?
?ï}ïheLßh16B*phh¡Rþ5B*phh¡Rþh¡Rþ5B*phh¡Rþh¡Rþ5>*
B*phhdrB*phh£ áB*phhodBh6B*phhodBh6>*B*phhodBB*
phh6B*phh©}vB*phh1B*phhX:ÓB*ph1°ô(1u©´òW~
??Èö÷·¸Â6 ôôéôôéôôéôôáÙéôôÑÑÑÑÑÑÑÑdàgd1dàgdeLß
dàgd
& Fdàgd1
& Fdàgd1ôû'(1:<MS^tu|´¾òù"W^}~??ÈÏ
÷ü$&Wr}~??´µ·¸óëàëóëØëØëØóëóëóëóëóëÐÈëóëó뺯
¢??ëzëÈëzëzëzëzëzhçB*phh1h1B*phhxñB*phhxñhxñ5B*phh¡Rþh15B*ph
h15>*B*phh¡Rþh15>*B*phheLßB*phh
B*phh¡RþB*phh¡Rþh1B*phh1B*phheLßh16B*ph0¸ÁÂ6 7
; C P Z ¡ ¢ ® ¯ Õ Ö × Ø ä å + , - = > L R S T m n { | } ¥ «
¬ º » ÷ï÷ï÷ç÷ç÷ï÷ç÷ï÷ï÷ç÷ÜÒÊÂʺʲ§²?²?²}?}u}}hßOmB*phh?xB*ph
hAxÉB*phh}hAB*phh~}#B*phhÆAU5B*phhÆAU5>*B*phhÆAUB*
phhÊ B*phh«/B*phh¯rÚB*phh¯rÚ5B*phh¯rÚ5>*B*phhx
ñB*phhçB*phh1B*ph+6 7 C ¡ ¢ ¯ × Ø å , - ? S n | ? ¬ » ¼ ä ÷÷÷÷÷÷÷÷÷÷÷
÷÷ìàÕÉÕÉÁÁdàgdØ5" ?Ðdà^?Ðgd?x
& Fdàgd?x ?Ðdà^?ÐgdÆAU
& FdàgdÆAUdàgd1» ¼ Å Ç Ë Ì Ñ ã ä å ý þ b c ½ ¾ ¿ À ã
ä © ª ,!-!.!0!1!3!4!6!7!9!:!@!A!B!D!E!K!L!÷ìâ×÷×÷ÊÀ¼« ? « « ? À¼À¼À¼À¼????????
??|?|¼?|?
h?FÓ0Jjh?FÓ0JUjhªB{UhªB{h?FÓCJaJh@x×h?FÓCJaJ!j
h@x×h?FÓ0JCJUaJh?FÓjh?FÓ0JUhØ5"hØ5"5B*phhØ5"hØ5"B
*phhØ5"5B*phhØ5"5>*B*phhØ5"B*ph-ä ý b ¿ ã © ,!-!/!0!2!3!5!6!8!9!B!C!D!O!P!Q!R!÷ïïïççççåååååååååÙÐåÙÐåå?h]?hgd÷N
? ?øÿ?&`#$gdªB{dhgdË'?dhgd{ùdhgd{ùL!M!N!O!Q!R!S!
ôêäàÜÏhØ5"hØ5"5B*phhªB{h?FÓ
h?FÓ0Jjh?FÓ0JUhØ5"0JmHnHuR!S!÷dàgdØ5"9&P1h:pjdß
°Ð/ °à=!°"°# $ %°°Ð°Ð0Ð6&P1h:pjdß °Ð/ °à=!°"°# $ %°°Ð°ÐÐDÐÉêyùºÎ??ªK© )http://en.wikipedia.org/wiki/LAND_attackàÉêyùºÎ?
?ªK© Rhttp://en.wikipedia.org/wiki/LAND_attack??@@ñÿ@NormalCJ_HaJmH sH tH DA@òÿ¡DDefault Paragraph FontRi@óÿ³RTable Normal ö4Ö
l4Öaö (k@ôÿÁ(No List> @ò>û^?
Footnote TextCJaJ@&@¢@û^?Footnote ReferenceH*4U`¢4=¥ Hyperlink >*phÿ4 @"4÷N?Header
ÆàÀ!.)@¢1.÷N? Page Number?Ù_ò³ÝíS:~Ûÿ1ÅHK[S+D,ÿÿÿÿ+;D,ÿÿÿÿ !"4DZ[\x?«ÂÛ,abz??Ãä º»Ð « ¬ Å Á Â Þ ?»å"
#
?
??§°ô(1u©´òW~??Èö÷·¸Â67C¡¢¯×Øå
,-?Sn|?¬»¼äý b¿ã©,-/0235689BCDOPQ
T?0???0???0???0???0???0???0???0???0???0???0??? 0??? 0??? 0??? 0??? 0??? 0??? 0??? 0??? 0???0???0??? 0??? 0??? 0??? 0??? 0???0???0???0???0???0???0???0???0???0???0???0???0???0???0???0???0???0??
?0???0???0???0??? 0??? 0§?? 0§?? 0??? 0(?? 0(?? 0??? 0©?? 0©?? 0??? 0?? 0??0???0??? 0??? 0??? 0???0???0???0???0???0???0???0???0???0???0???0???0???0???0???0???0???0?
??0???0???0???0??? 0???0??? 0???0??? 0???0???0???0???@0???@0???@0???@0???@0???@0???@0???@0??00
H?@0??h?00Ã?@0??h?00Ã?@0??h?00Ã?@0??h?00Ã?@0???@0????
@0????@0???@0???@0??h?00?Ã,az??Ãä °ô(©´òW
??Èö÷ä bTj?00Lj?00 j?00
j?000j?00?j?00?j?00?j?00?0??j?0
0j?0
0?0??j?0
0èçj?0
0?j?0
0?j?00pÆçj?00?j?00?j?00Ô6çj?00?j?00?j?0
?j?0??0??jË00jË00
0¨ $$$$$$$$$$$'Â C
áÙô¸» L!S! ? °6 ä R!S! !R!0??Ý-57u| o?ã÷ýCNV?·SXÿ?X
ÿ?Xÿ?Xÿ?Xÿ?Xÿ?Xÿ? '!?!ÿ??ð8ð@ ñÿÿÿ???÷ð?ðð0ð( ð
ððB
ðS ð ¿Ëÿ ?ðÿÿU?ÜT"U?|? U?¬"U?ÌñÈU?ļ"U?T!#U?¬EÏU
?"#U?ÄW" U?¤x U?|, U??!#
¸ ¸ ¿
#
#
*
T
¾ Ã Ã )
.
.
T
=
*?urn:schemas-microsoft-com:office:smarttags ?PlaceType?= *?urn:schemas-microsoft-com:office:smarttags ?PlaceName?9*?urn:schemas-microsoft-com:office:smarttags?place?à¹
?¢«²z???¢¤??ÊÎÐÔÞ⬠° ¿ Ã Å É A
E
£
§
kt*
.
j
m
o
r
~
×
Û
åìfm~?ãêHO¹À? ¤²¶ßãäæï CG--//00235
689QT
äèßäÿ --//00235689QT33
ããäý aabb??½¾¿,--//00235689
DNTßãä--//00235689Q
TQs¬@Õ,]ÿÿÿÿÿÿÿÿÿê0Q8è??nÿÿÿÿÿÿÿÿÿ
Ä?J2{Oÿÿÿÿÿÿÿÿÿg8~³pÿÿÿÿÿÿÿÿÿh?Ð??þ
ÆÐ^?Ð`??þOJQJo(?h?H·ðh? ??þÆ ^? `??þOJQJ^Jo(?h
?Hoh?p??þÆp^?p`??þOJQJo(?h?H§ðh?@ ??þÆ@ ^
?@ `??þOJQJo(?h?H·ðh???þÆ^?`??þOJQJ^Jo(?h?Ho
h?à??þÆà^?à`??þOJQJo(?h?H§ðh?°??þÆ°^?°`??þ
OJQJo(?h?H·ðh????þÆ?^??`??þOJQJ^Jo(?h?Hoh?P
??þÆP^?P`??þOJQJo(?h?H§ðh?Ð??þÆÐ^?Ð`??þOJQJo
(?h?H·ðh? ??þÆ ^? `??þOJQJ^Jo(?h?Hoh?p??þÆ
p^?p`??þOJQJo(?h?H§ðh?@ ??þÆ@ ^?@ `??þOJQJo(?h?H·
ðh???þÆ^?`??þOJQJ^Jo(?h?Hoh?à??þÆà^?
à`??þOJQJo(?h?H§ðh?°??þÆ°^?°`??þOJQJo(?h?H·ðh
????þÆ?^??`??þOJQJ^Jo(?h?Hoh?P??þÆP^?P`??þO
JQJo(?h?H§ðh?Ð??þÆÐ^?Ð`??þOJQJo(?h?H·ðh? ?
?þÆ ^? `??þOJQJ^Jo(?h?Hoh?p??þÆp^?p`??þOJQJo(
?h?H§ðh?@ ??þÆ@ ^?@ `??þOJQJo(?h?H·ðh???þÆ
^?`??þOJQJ^Jo(?h?Hoh?à??þÆà^?à`??þOJQJo(?h?H§ð
h?°??þÆ°^?°`??þOJQJo(?h?H·ðh????þÆ?^??`
??þOJQJ^Jo(?h?Hoh?P??þÆP^?P`??þOJQJo(?h?H§ðh
?Ð??þÆÐ^?Ð`??þOJQJo(?h?H·ðh? ??þÆ ^? `??þOJQ
J^Jo(?h?Hoh?p??þÆp^?p`??þOJQJo(?h?H§ðh?@ ??
þÆ@ ^?@ `??þOJQJo(?h?H·ðh???þÆ^?`??þOJQJ^Jo(
?h?Hoh?à??þÆà^?à`??þOJQJo(?h?H§ðh?°??þÆ°
^?°`??þOJQJo(?h?H·ðh????þÆ?^??`??þOJQJ^Jo(?h?Ho
h?P??þÆP^?P`??þOJQJo(?h?H§ðQs¬Ä?Jê0Q8g8~ÿÿÿÿÿÿÿÿÿÿÿ
ÿÿÿÿÿÿÿÿÿ FåEUxÅ|F+ «/1
ççZ
dre"?4¿S6Ê Ø5"~}#?;ri?c@}hAodBê4StS?UX9UÆAU?hdÑ*i jnjßOm+}qõrs©}vªB{-b?pA?÷N?I6?ç??x? ?»{?û^?Ë'?=¥1!§ -¨´Y¬#i¸øx½>5¾K¾¤MÅAxÉX:Ó?FÓ@xׯrÚeLßÇPßjdߣ á åpîx
ñ{ù¡Rþÿ@?ãã´óããS°@ÿÿUnknownÿÿÿÿÿÿÿÿÿÿÿÿG
?z ?ÿTimes New Roman5?Symbol3& ?z ?ÿArial?5 ?z ?ÿCourier New;?Wingdings"1?ðÐh¸m?Fap?f?jz )jz )±ð ´´
4dÙÙ2?QðHP ðÿ?äÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿjdß2ÿÿRLAUnknownUnknown þÿà??òùOh«?+'³Ù0l?¤°ÀÌØì ü
(4
@LT\dä RLA Unknown Normal.dot Unknown 63 Microsoft Office Word@îÁî@H~KbÆ@6@:xÆjzþÿÕÍÕ?.??+,ù®DÕÍÕ?.??+,ù®4ð
hp??? ¨°¸
ÀÐä Unknown) Ù¨ RLA Title, 8@_PID_HLINKSäAä*F< )http://en.wikipedia.org/wiki/LAND_attack
b (http://en.wikipedia.org/wiki/Windows_XP s" 1http://en.wikipedia.org/wiki/Windows_Server_2003 .http://en.wikipedia.org/wiki/Operating_system ?i $http://e
n.wikipedia.org/wiki/Packet R* -http://en.wikipedia.org/wiki/Sp
oofing_attack -D 6http://en.wikipedia.org/wiki/Denial-of-service
_attack
!"þÿÿÿ$%&'()*þÿÿÿ,-./0123456789:;<=>?@ABCDþÿÿÿFGHIJKLþÿÿÿNOPQRSTþÿÿÿýÿÿÿ
Wþÿÿÿþÿÿÿþÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿRoot Entryÿÿÿÿÿÿÿÿ ÀF??½NxÆY?Data
ÿÿÿÿÿÿÿÿÿÿÿÿ#1Tableÿÿÿÿ+y2WordDocumentÿÿÿÿsDSummaryInforma
tion(ÿÿÿÿÿÿÿÿÿÿÿÿEDocumentSummaryInformation8ÿÿÿÿÿÿÿÿMCompObj
ÿÿÿÿÿÿÿÿÿÿÿÿqÿÿÿÿÿÿÿÿÿÿÿÿþÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿþÿ
ÿÿÿÿ ÀF Microsoft Office Word Document
MSWordDocWord.Document.8ô9²q
[ reply ]