DoS attack reveals (yet another) crack in net's core

Security experts say they have discovered a flaw in a core internet protocol that can be exploited to disrupt just about any device with a broadband connection, a finding that could have profound consequences for millions of people who depend on websites, mail servers, and network infrastructure.

The bug in the transmission control protocol (TCP) affords attackers a wealth of new ways to carry out denials of service on equipment at the heart of data centers and other sensitive points on the internet. The new class of attack is especially severe because it can be carried out using very little bandwidth and has the ability to paralyze a server or router even after the flood of malicious data has stopped.

"If you use the internet and you serve a TCP-based service that you value the availability for, then this affects you," Robert E. Lee, chief security officer for Sweden-based Outpost24 told The Register. "That may not be every internet user, but that's certainly any IT manager, that's certainly any website operator, mail server operator, or router operator."

Lee said he and Outpost24 colleague Jack Louis discovered the bug in 2005, but decided to keep their finding secret while they tried to devise a solution. After largely hitting a wall, they decided to go public in hopes that a new infusion of ideas will finally get the problem fixed.

Other security experts have already weighed in on the TCP bug and said it appears Outpost24 isn't overstating its severity. Robert "RSnake" Hansen, who has been briefed by Lee, told El Reg it's "the most serious thing I've heard of in a month or two."

Robert Graham, CEO of Errata Security, said here that after listening to this interview with the researchers, he's inclined to believe the threat is real.

"They have been working deep withing TCP stacks," he wrote. "If such problems exist, then they would have certainly come across them."

The discovery is similar to several other bugs that have come to light over the past few months that reside in a network-wide system rather than in a single product. In July, researcher Dan Kaminsky unearthed a fundamental flaw in the design of the internet's address system that made it trivial to spoof websites and email addresses. And at the Defcon hacking conference a month later, researchers laid out a technique to surreptitiously hijack huge chunks of the internet and tamper with unencrypted traffic before it reaches its intended destination.

Last month, Lee and Louis began notifying unnamed makers of operating systems, routers, firewalls, and other TCP-enabled wares with the help of the Computer Emergency Response Team in Finland. So far, Outpost24 has shared multiple attack scenarios with them, and Lee said vendors were only in the early stages of grasping the problem.

"They're still trying to do triage and understand the individual attack types that we've identified for them," Lee said during a phone interview. "We're still trying to get them to back up a step. It's a class of attack, not necessarily individual things that the vendors need to be focusing on."

At the moment, there are no work-arounds other than forbidding anonymous connections, a solution that isn't an option for most net-connected devices.

Lee declined to identify the specific makers whose products that are vulnerable, but he indicated they read like a comprehensive list of companies involved in wares related to the internet.

"We haven't found anybody who has a TCP stack that runs TCP based services that isn't vulnerable," he said. "If they make a TCP stack then it's probably still going to be vulnerable to one or all of these attacks because this is something fundamental in how TCP works."

To streamline the execution of the multiple attack scenarios developed, Outpost24 has built a test kit they've dubbed Sockstress. So far, they've used it on 15 different TCP stacks, and all have been found to be vulnerable, Lee said.

Outpost24 is being vague with details about the vulnerability to prevent giving miscreants information that would enable them to carry out attacks. Lee will say only that the class of attack takes advantage of the way resources are allocated immediately after TCP-enabled devices complete the three-way handshake (syn, syn-ack, ack) that is required for two internet-connected devices to interact.

Once exploited, the attack allows miscreants to consume so many system resources that the device essentially crashes.

"It basically self thrashes, and the only recovery after about two to four minutes worth of attack flow, even after the attack stops, is to reboot the machine," Lee said. "There's almost a tipping point that happens when it gets to that self thrashing point." ®