Last days i've noticed a lot of movement against security sites like Spyware Warrior sitewith variety types of attacks as the sites admit. I decided to post a few things about Denial of Service Attacks (DoS) from my readings and archives (some may be a bit old ). Let's go:

You come home from work after a long day at the office and the phone rings. You pick up the phone and no one is there. So you hang up, and immediately the phone rings again. After several times of doing this, you stop answering the phone, but the person keeps calling over and over again. The next morning when you go to work your boss says, “I tried calling you last night, but the phone was busy.” You actually weren’t on the phone, but an attacker was able to use up all your resources, so that legitimate calls did not come through. This is an example of a Denial of Service attack. In this case, the attacker kept your phone line tied up, so that your boss could not get through and legitimate users were denied access. As you can already see from this non-technical example, Denial of Service attacks can be very annoying and very difficult to protect against. In this simplified example, it would be difficult to protect against the attack. One solution to Denial of Service attacks is redundancy—you could put in a second line. However, that would not stop the attacker from launching an attack against both lines. As you will see throughout this chapter, Denial of Service attacks are extremely difficult to prevent, and from an attacker’s standpoint, they are very easy to launch.
To put Denial of Service attacks in perspective, let’s examine the three main areas of security: confidentiality, integrity, and availability. Denial of Service attacks are attacks against the third component, availability. Availability is preventing, detecting, or deterring the unauthorized denial of access to information and systems. Types of Denial of Service attacks range from crashing a user’s machine by sending them data they are not expecting, to overloading a machine by sending it too much information. No matter which type of attack is being performed, the end result of a Denial of Service attack is the same—a legitimate user cannot get access to the information he needs.

What Is a Denial of Service Attack?
A Denial of Service attack (DOS) is an attack through which a person can render a system unusable or significantly slow down the system for legitimate users by overloading the resources so no one else can access it. This can also result in someone damaging or destroying resources, so they cannot be used. Denial of Service attacks can either be deliberate or accidental. It is caused deliberately when an unauthorized user actively overloads a resource. It is caused accidentally when an authorized user unintentionally does something that causes resources to become unavailable. An organization should take precautions to protect a system against both types of Denial of Service attacks.
Most operating systems (including NT and numerous variants of UNIX), routers, and network components that have to process packets at some level are vulnerable to DOS attacks. In general, DOS attacks are difficult to prevent. However, restricting access to critical accounts, resources, and files and protecting them from unauthorized users can hinder many DOS attacks.
It seems that the number of Denial of Service attacks are increasing every day. If an attacker is unable to gain access to a machine, most attackers will just crash the machine to accomplish a Denial of Service attack. This means that even though your systems may be patched and properly secured, an attacker can still do damage to your company.

Types of Denial of Service Attacks
There are two general types of Denial of Service attacks. The first type involves crashing a system or network. If an attacker can send a victim data or packets it is not expecting, and it causes the system to either crash or reboot, then in essence, the attacker has performed a Denial of Service attack because no one will be able to get to the resources. From an attacker’s standpoint, what is nice about these attacks is that you can render a system inaccessible with a couple of packets. In most cases, for the system to get back online would require intervention from an administrator to reboot or power off the system. So, this first type of attack is the most damaging because it requires little to perform and human interaction to fix.
The second type of attack involves flooding the system or network with so much information that it cannot respond. For example, if the system can only handle 10 packets a minute, and an attacker sends it 20 packets a minute, then when legitimate users try to connect to the system, they are denied access because all the resources have been exhausted. With this attack, an attacker has to constantly flood the system with packets. After the attacker stops flooding the system with packets, the attack is over and the machine resumes operation. This type of attack requires a lot more energy on the part of the attacker because he has to keep actively flooding the system. In some cases, this type of attack could crash the machine, however in most cases, recovering from this attack requires minimal human intervention.
It is important to note that both of these attacks can be launched from a local system or over a network.

What Is a Distributed Denial of Service Attack?
With a traditional Denial of Service attack, a single machine is usually launching the attack against a victim’s box. However, in the year 2000, a new type of attack was introduced—a distributed Denial of Service attack or DDOS. In this case, an attacker breaks into several machines, or coordinates with several friends, to launch an attack against a target machine or network at the same time. So, now it is not just one machine launching the attack, but several. This makes it difficult to defend against the attacks because the machine is not just receiving a lot of packets from one machine, but from any number of machines all at the same time. Also, because these attacks are coming from a wide range of IP addresses, it is much more difficult to block and detect because a small number of packets from each machine might slip under the Intrusion Detection Systems (IDS) radar. If a single IP address is attacking a company, it can block that address at its firewall. If it is 100 machines, this is extremely difficult.

Diagram of a distributed Denial of Service attack (DDOS)


As you can see, multiple systems from all around the world are launching an attack against a single victim. If DOS attacks are difficult to prevent when they are coming from a single source, think of how much harder it is to protect against DDOS attacks that are coming from multiple machines at multiple locations.

Why Are They Difficult to Protect Against?
DOS attacks are difficult to protect against because you can never totally eliminate the threat. If you are connected to the Internet, there is always the chance that an attacker may send you too much data that you are not able to process. Therefore, you can minimize your threat my increasing your bandwidth, however an attacker can always use additional resources to flood your network.
Let’s look at another example. You come home from work and you live on a cul-de-sac, which means there is only a single road to get to your house, and there is currently a truck blocking that road. Very easily, someone has just launched a Denial of Service attack, denying you access to your house. One way to protect against this attack is to build a second road, so you have an alternate route to your house. First, this is very expensive, and second, it does not completely eliminate the threat. Now, someone could just get two trucks and block both roads. You could then build a third road, but they could still block that route. The bottom line is that there are things that can be done to minimize the threat, but if an attacker has enough time and resources, he can still be successful.

Now that we understand what Denial of Service attacks are and why they are such an insidious threat, let’s look at several known DOS exploits.

Types of Denial of Service Attacks

At this point, we understand what a DOS attack is and why they are so difficult to protect against. Now let’s look at several types of DOS attacks to get a better idea of how they work. The following are the exploits we explore in this chapter:

• Ping of Death
• SSPing
• Land
• Smurf
• SYN Flood
• CPU Hog
• Win Nuke
• RPC Locator
• Jolt2
• Bubonic
• Microsoft Incomplete TCP/IP Packet Vulnerability
• HP Openview Node Manager SNMP DOS Vulnerability

Some of these attacks have been around for a while, however, they are included because they cover very important concepts of how DOS attacks work, and they give you an idea of the range of services or protocols that can be attacked, to cause a Denial of Service attack. For example, the exploit Ping of Death is covered because it is one of the “classic” DOS attacks, and it shows how simple an attack can be. Others, such as smurf, have been around for a while, but they are still widely used, for example in the DDOS attacks that occurred February of 2000.
This is not meant to be a complete list because new Denial of Service attacks are coming out daily, however it is meant to show you the wide range of attacks that exist. Now, let’s start covering each exploit in detail.


Ping of Death
A Denial of Service attack that involves sending a very large ping packet to a host machine.
Exploit Details
Name: Ping of Death
Operating System: Most Operating Systems
Protocols/Services: ICMP Ping

The ping of death attack is a category of network-level attacks against hosts with the goal of denying service to that host. A perpetrator sends a large ping packet to the victim’s machine. Because most operating systems do not know what to do with a packet that is larger than the maximum size, it causes most operating systems to either hang or crash. For example, this causes the blue screen of death in Microsoft NT.
Protocol Description
Ping of death uses large Internet Control Message Protocol (ICMP) or ping packets to cause a Denial of Service attack against a given system. To understand how ping of death works, you need to have a basic understanding of ICMP. This exploit operates at the network layer, which is layer 3 in the OSI model. This is the same layer that IP operates at. ICMP was developed to test connectivity to various machines on the Internet. ICMP handles error and exchange control messages. ICMP can be used to convey status and error information, including network transport and network congestion problems.
Ping is a program that uses ICMP to see if a machine connected to a network is responding. It does this by sending an echo request packet to a particular address. If the machine successfully receives the packet, it sends an ICMP echo reply. ICMP, and especially ping, can be a valuable tool for troubleshooting and diagnosing host or network problems.
The following is a successful ping request showing that the destination host is active:

Pinging 10.159.90.17 with 32 bytes of data:
Reply from 10.159.90.17: bytes=32 time=4ms TTL=255
Reply from 10.159.90.17: bytes=32 time=2ms TTL=255
Reply from 10.159.90.17: bytes=32 time=2ms TTL=255
Reply from 10.159.90.17: bytes=32 time=2ms TTL=255
Ping statistics for 10.159.90.17:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 2ms, Maximum = 4ms, Average = 2ms

Notice that the ping packets have a size of 32 bytes. By using the command-line options, you can specify a different packet size for the ping program to send. In Microsoft, to send a larger ping packet, you use the –l (letter l) option. So, by typing ping –l 500 10.159.90.17, you would get the following results:

Pinging 10.159.90.17 with 500 bytes of data:
Reply from 10.159.90.17: bytes=500 time=3ms TTL=255
Reply from 10.159.90.17: bytes=500 time=3ms TTL=255
Reply from 10.159.90.17: bytes=500 time=3ms TTL=255
Reply from 10.159.90.17: bytes=500 time=3ms TTL=255
Ping statistics for 10.159.90.17:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 3ms, Maximum = 3ms, Average = 3ms

Notice now that the packet size is 500 bytes instead of the default 32 bytes.

Detailed Description
The TCP/IP specification (the basis for many protocols used on the Internet) allows for a maximum packet size of up to 65536 octets (1 octet = 8 bits of data), containing a minimum of 20 octets of IP header information and 0 or more octets of optional information, with the remainder of the packet consisting of data. It is known that some systems will react in an unpredictable fashion when receiving oversized IP packets. Reports indicate a range of reactions including crashing, freezing, and rebooting.
In particular, most attacks show that the ICMP packets issued through the ping command have been used to trigger these attacks. As discussed in the previous section, ICMP is a subset of the TCP/IP suite of protocols that transmit error and control messages between systems. Two specific instances of ICMP packets are the ICMP ECHO_REQUEST and ICMP ECHO_RESPONSE datagrams. A local host can use these two instances to determine whether a remote system is reachable through the network, and they are commonly achieved using the ping command. A host sends a machine an ICMP_ECHO-REQUEST packet, and if the machine is active, it processes the packet and replies by sending an ICMP_ECHO-RESPONSE.
Attackers use the ping command to construct oversized ICMP datagrams (which are encapsulated within an IP packet). Many ping implementations send ICMP datagrams consisting only of the 8 octets of ICMP header information by default, yet they enable the user to specify a larger packet size if desired. With this exploit, an attacker uses this feature to send an oversized ping packet or one that is larger than the 65536 byte specification.

Signature of the Attack
The following is the output from a TCP dump when the ping of death is run against a victim’s machine:
10:03:14..690000 192.168.15.5 > 192.168.20.10: icmp: echo
request (frag
11267:1480@0+)
10:03:14.690000 192.168.15.5 > 192.168.20.10: (frag
11267:1480@1480+)
10:03:14.690000 192.168.15.5 > 192.168.20.10: (frag
11267:1480@5920+)
10:03:14.690000 192.168.15.5 > 192.168.20.10: (frag
11267:1480@7400+)
10:03:14.690000 192.168.15.5 > 192.168.20.10: (frag
11267:1480@8880+)
........
10:03:14.740000 192.168.15.5 > 192.168.20.10: (frag
11267:1480@65527)

As you can see, the source IP address sends the destination IP address (victim’s machine) a ping packet that is 65527 in size.

Source Code/Pseudo Code
Most operating systems come with a version of ping as part of the standard operating system. Based on this fact, it is very easy to perform an attack using this program because all the tools needed are already installed by default. For example, from a Windows machine, an attacker would open up a DOS window and issue this command:
ping -l 65527 [followed by the IP address of the victimsmachine]

On a UNIX machine, an attacker would issue the following command:
ping –s 65527 followed by the IP address of the victim'smachine.
Because ping is such a popular program, there really is no source or pseudo code for this exploit.

How to Protect Against It
The best way to fix this problem is to apply the latest patch from the appropriate vendor. Most operating systems that have been impacted by this exploit have patches that will remove the vulnerability.
If applying the patch is not an option, or additional protection is desired, large ping packets can be blocked at routers or firewalls, which stops them from getting to the victim’s machine.

Additional Information
The following sites contain additional information on the ping of death exploit:
http://www.cert.org
http://microsoft.com

The CERT keeps track of most security vulnerabilities and provides detailed information on how to protect against them. The CERT Coordination Center studies Internet security vulnerabilities, provides incident response services to sites that have been the victims of an attack, publishes a variety of security alerts, researches security and survivability in wide-area-networked computing, and develops information to help you improve security at your site.
Microsoft also provides detailed information on its operating systems’ vulnerabilities and what can be done to protect those vulnerabilities from exploit.

SSPing
A Denial of Service attack that involves sending a series of highly fragmented, oversized ICMP data packets.

Exploit Details
Name: SSPing
Operating System: Microsoft Windows
Protocols/Services: ICMP Ping

SSPing is a program that uses ICMP data packets to freeze any computer connected to the Internet or on a network running Windows 95, Windows NT, and older versions of the MAC Operating system. SSPing is based on old code that freezes old SYS V and Posix implementations. Because of this, it is possible to use SSPing against systems that are also running these implementations.

Protocol Description
SSPing uses fragmented ICMP packets to cause a Denial of Service attack. To understand how SSPing works, you need to have a basic understanding of ICMP and how fragmented packets work. Because ICMP was covered in the previous section, let’s look at fragmented packets.
If a machine attempts to send a large packet on a network or over the Internet, there is a good chance that one of the routers that processes the packet will break it up into smaller pieces, so it can be properly routed to its destination. When this occurs, the destination machine receives the pieces and puts them back together. This process occurs all the time on the Internet and is called fragmentation. As you will see in this section, by tinkering with the fragmentation options, you can cause certain machines to crash.

Detailed Description
SSPing is a program that can freeze any computer connected to the Internet or on a network running Windows 95, Windows NT, or older versions of the MAC OS before version 6.
The SSPing program sends the victim’s computer a series of highly fragmented, oversized ICMP data packets over the connection. The computer receiving the data packets locks when it tries to put the fragments together. Highly fragmented packets require the TCP/IP stack to keep track of additional information to reassemble the packets. If the TCP/IP stack was not built properly, when it tries to keep track and put together several packets, the result is a memory overflow, which in turn causes the machine to stop responding. Usually, the attacker only needs to send a few packets, locking the victim’s computer instantaneously. When the victim restarts his computer, the connection with the attacker is lost, so in some cases, the attacker is able to remain anonymous.
Jolt and Jolt2 are two more exploits that take advantage of fragmentation.

Signature of the Attack
Because this is a relatively simple attack, requiring only a few packets, there is really only one main symptom to look for, and that is ICMP packets that are large and highly fragmented.
Because SSPing only uses a few packets, and because ICMP packets are fairly common, it is hard to detect this exploit by either the protocol or frequency. Also, large, fragmented packets occur on the Internet, however, it is very rare for large, highly fragmented ICMP packets to occur, so it is only when you put these two pieces together that you can detect the attack.
To run this attack, the source IP address sends highly fragmented ICMP packets to the destination IP address (victim’s machine). The following is the TCP dump output from running this exploit:

10:03:14.690000 192.168.10.5> 192.168.20.10: icmp: echorequest (frag11267:1480@0+)10:03:14.690000 192.168.10.5 > 192.168.20.10: (frag11267:1480@5920+)10:03:14.690000 192.168.10.5 > 192.168.20.10: (frag11267:1480@44400+)10:03:14.690000 192.168.10.5 > 192.168.20.10: (frag11267:1480@7400+)10:03:14.690000 192.168.10.5 > 192.168.20.10: (frag11267:1480@37000+)10:03:14.690000 192.168.10.5 > 192.168.20.10: (frag11267:1480@8880+)10:03:14.690000 192.168.10.5 > 192.168.20.10: (frag11267:1480@48840+)10:03:14.690000 192.168.10.5 > 192.168.20.10: (frag11267:1480@56240+)10:03:14.690000 192.168.10.5 > 192.168.20.10: (frag11267:1480@53280+)

This packet dump shows the signature of an SSPing attack. The first packet tells you this is an ICMP packet. By looking at the far right of each of the remaining lines, you can see that the packets are fragmented. By looking at the sequence order, you can also see that they are not in order, which requires additional resources for the TCP/IP stack to track.

Source Code/Pseudo Code
Because this attack is relatively straightforward, there is source code available at the following address: http://newdata.box.sk/neworder/xforces/sspingeggdrop.zip/.
Also, aggressor is a program you can use to launch several Denial of Service attacks, including the SSPing attack, and is available from http://neworder.box.sk/.
The pseudo code for this is extremely straightforward. Anyone can use a packet generator program to create an ICMP packet that is fairly large and highly fragmented.

How to Protect Against It
Because this attack mainly impacts Microsoft operating systems, the only way to protect against this attack is to download the latest patches from its web site.
To prevent this type of attack, Microsoft has updated the TCP/IP protocol stack. Updates and instructions can be downloaded from Microsoft’s ftp site. To find out additional information and download the patches, you can search for SSPing under Microsoft’s Knowledge Base, which is located under Support on its main page.

Additional Information
Additional information can be found at the following sites:
http://www.cert.org
http://microsoft.com
http://www.winplanet.com

Because this attack mainly affects Microsoft operating systems, most of the patches are available from its web site. Winplanet also provides adequate details on the exploit and additional information on how to apply and download the patches.

Land Exploit
A Denial of Service attack in which a program sends a TCP SYN packet where the target and source address are the same and the port numbers are the same.
Exploit Details
Name: Land
Variants: none
Operating System: Most Operating Systems and routers
Protocols/Services: IP

The land attack is a program used to launch a Denial of Service attack against various TCP implementations. The program sends a TCP SYN packet (which is the first part of the three-way handshake) where the source and destination addresses are the same and the source and destination port numbers are the same.

Protocol Description
IP packets are used to send information across the Internet. IP packets contain information that specifies who the recipient and sender of the packets are. IP packets also contain port numbers that specify which TCP service the packet should be sent to. The following are the key fields that an IP packet contains:
Source address
Source port number
Destination address
Destination port number

The above information as a whole is also referred to as a socket because this is what is needed to make a successful connection to a remote host. It is important to point out that the destination port number also indicates what protocol is being used. Under normal circumstances, the source and destination address and source and destination port numbers are different. In these cases, IP works as designed. Unfortunately, when IP packets contain unconventional information, most TCP/IP stacks do not know how to handle it and they crash. One instance where this is true is when someone sets the source and destination addresses and source and destination ports to the same value.

Detailed Description
Some implementations of TCP/IP are vulnerable to SYN packets when the source address and port are the same as the destination. For this to occur, an attacker has to spoof both the source address and port number. The following are the properties of a land attack:
Source and destination address have the same value
Source and destination port numbers have the same value

TCP is a reliable connection-oriented protocol that operates at layer 4, the transport layer. Because TCP is reliable, it requires a three-way handshake to initiate new connections. When a new connection is opened, it uses SYN packets to synchronize the two machines. SYN packets are similar to normal packets, except they have the SYN bit set, which means it is one of the first packets in a new connection. Because land attacks occur when a new session is opened, attackers use SYN packets.
When an attacker wants to attack a machine using the land exploit, he sends a packet to the target machine opening a new connection. The packet has the source address and port number spoofed by setting the source address and port number to be the same as the destination address and port number.
The destination machine receives the packet and replies to the source address and port number. Because this is the destination machine, most machines will crash or hang because they do not know how to handle it.

Signature of the Attack
The signature of the attack is fairly simple. Any packet that has the following properties is a land attack:
Source and destination address having the same value
Source and destination port numbers having the same value

These characteristics do not occur in normal packets, so any packets that have these features should be flagged and dropped. The following is TCPdump output from running two different land attacks:

12/03/97 02:19:48 192.168.1.1 80 -> 192.168.1.1 80 12/03/97 02:21:53 192.168.1.1 31337 -> 192.168.1.1 31337

A key point to remember is that a variety of operating IP stack implementations are unable to process packets sent from themselves to themselves using the same source and destination ports. Remember TCP replies to the source address and source port.

Source Code/Pseudo Code
Because this attack is relatively straightforward, there is source code available at the following addresses. However, if a hacker wanted to launch such an attack, it would be very easy to write code to do so:
Source code: http://www.insecure.org/
Aggressor: http://neworder.box.sk/
Spike: http://hackersclub.com/

Aggressor and spike are two programs you can use to launch several Denial of Service attacks, including the land attack.
The pseudo code for this is extremely straightforward. Anyone can use a packet generator program to create a packet with a spoofed source address set to the destination address, and a spoofed source port number set to the destination port number.

Also, juggernaut, which is a Session Hijacking type of attack has a built-in packet generator program. This enables an attacker to craft a packet that launches the land attack against a victim host.

How to Protect Against It
The easiest way to protect against this type of attack is to apply the latest patches from your vendor. This exploit has been out for a while, so most vendors have patches that fix the problem. Most vendor’s web sites contain sections on security patches for known exploits. If you go to the appropriate web site, you can download the proper patch and apply it to your system.

If applying the latest vendor patch is not an option, there is a workaround. Any packet that is coming into your network from the Internet should not have a source address from your internal network. This is the case because (as mentioned earlier) any packets originating on your internal network never come in on the external interface of your router. Therefore, your router can block all incoming packets that have a source address that matches an address on your internal network. However, this does not protect against an attacker who breaks into an internal host and launches an attack against another internal host.
The fix that uses router filters is the same fix used to stop IP spoofing attacks on networks.

Additional Information
Additional information can be found at the following sites:
http://www.cert.org
http://www.insecure.org
http://www.phrack.com
http://www.cisco.com

Smurf
A Denial of Service attack involving forged ICMP packets sent to a broadcast address.
Exploit Details
Name: Smurf
Variants: Papa Smurf and Fraggle
Operating System: Most OSs and routers
Protocols/Services: ICMP Ping

The Smurf attack is a category of network-level attacks against hosts with the goal of denying service to the hosts. A perpetrator sends ICMP echo requests (ping) traffic to an IP broadcast address using a spoofed source address of a victim. On a multi-access broadcast network, there could potentially be thousands of machines to reply to each packet.
The Smurf attack’s cousin is called “fraggle”, which uses UDP echo packets in the same fashion as the ICMP echo packets. Currently, the machines most commonly hit are IRC servers and their providers. Because Smurf is a Denial of Service attack, it impacts most devices that process packets.

Protocol Description
Smurf uses forged ICMP packets to cause a Denial of Service attack. To understand how Smurf works, you need to have a basic understanding of ICMP and broadcast addresses. Because ICMP was already covered, let’s look at how broadcasts addresses work. A broadcast address is a single address used to send a packet to all hosts on a network segment. This is done by making the host portion of an IP address all ones. For example, the IP broadcast address for the 12.0.0.0 network is 12.255.255.255. In binary, eight 1’s or 11111111 is equivalent to 255. This address then sends the packet to all machines on the 12 network. If there are a large number of machines on a network segment, using a broadcast address will use up a lot of network bandwidth because the system will generate individual packets for each machine on that network segment.

Detailed Description
The two main components of the Smurf attack are the use of forged packets and the use of a broadcast address. In the Smurf attack, attackers are forging or spoofing the source address on ICMP echo requests and sending them to an IP broadcast address. This causes every machine on the broadcast network to receive the reply and respond back to the source address that was forged by the attacker. With this type of attack, there are three parties involved: the attacker, the intermediary (the broadcast address to which the packets are sent), and the victim (the forged source IP address). In this type of attack, the intermediary can also be a victim. This is the case because when all the machines on the intermediary start replying back to the forged address, it can generate so many packets that it uses up all the bandwidth of the intermediary network.
To start this attack, the attacker generates an ICMP echo request (which is the same as a ping) using a forged source address and a broadcast address as the destination. The intermediary receives the ICMP echo request, which is directed to the broadcast address of its network. This causes the packet to be sent to all machines on that network segment, with each machine replying to the request and sending an ICMP echo reply back. When all the machines on the network reply, this could potentially result in degraded service or Denial of Service for that network segment due to the high volume of traffic generated.
Because the source address on the packets was forged, all the replies go back to the source address that was specified, which now becomes the victim’s machine. Because a large number of packets are being sent to the victim’s machine, this could cause network congestion or potentially make the network inaccessible.

Description of Variants
Fraggle is a simple variation of the Smurf attack. Fraggle works the same way as Smurf, except it uses UDP echo packets instead of ICMP echo packets. Based on their similarities, performing a fraggle attack only requires a simple re-write of Smurf.
Papa Smurf is an improved and optimized version of Smurf, yet it works the same way.

Signature of the Attack
The point of the Smurf attack is to make the network inaccessible. Therefore, one general signature of the attack is degraded network performance both on the local internal network and on the connection to the Internet. At some point in the attack, performance should degrade to the point that the network cannot be used. From an Internet server provider (ISP) standpoint, a significant stream of traffic can cause serious performance degradation for small- and medium-sized ISPs that provide connectivity to either the intermediaries or the victim’s networks. Larger ISPs can also see degradation of service. Therefore, not only will this attack cause problems for a company, it could also cause problems for its ISP.
Two main signatures that someone can look for, or that most Intrusion Detection Systems (IDSs) look for to detect the Smurf attack, are a large number of ICMP requests coming from a specific host and an ICMP request sent to a broadcast address.

The following is TCP dump output from sending a Smurf attack to a class C broadcast address:
00:00:05 spoofed.net > 192.168.15.255: icmp: echo request
00:00:05 spoofed.net > 192.168.1.255: icmp: echo request

00:00:14 spoofed.net > 192.168.15.255: icmp: echo request
00:00:14 spoofed.net > 192.168.1.255: icmp: echo request
00:00:19 spoofed.net > 192.168.15.255: icmp: echo request

Here is another attack sent to a class A address:
00:00:05 spoofed.net > 12. 255.255.255: icmp: echo request
00:00:05 spoofed.net > 12. 255.255.255: icmp: echo request

00:00:14 spoofed.net > 12. 255.255.255: icmp: echo request
00:00:14 spoofed.net > 12. 255.255.255: icmp: echo request

00:00:19 spoofed.net > 12.255.255.255: icmp: echo request
As you can imagine, the attack sent to the class A address will generate a lot more traffic.
The TCP dump output previously shown illustrates that the source IP address is spoofed and the echo requests are addressed to a broadcast address. The point is simply to chew up bandwidth.

Source Code/Pseudo Code
Because this attack is relatively straightforward, there is source code available at the following addresses. However, if an attacker wanted to launch a Smurf attack, it would be very easy to write code to perform the task.
Source code: http://www.insecure.org/
Aggressor: http://neworder.box.sk/
Spike: http://hackersclub.com/

Aggressor and spike are two programs you can use to launch several Denial of Service attacks, including the Smurf attack.

The pseudo code for this is extremely straightforward. Anyone can use a packet generator program to create a packet with a spoofed source address and send it to a broadcast address. Another way to use this attack is to directly break in to the victim’s network and issue the command from their network to a broadcast address. Because the attacker already has access to the victim’s network, there would be no need to spoof the address. This type of attack only requires a standard ping program, which comes with most operating systems.

Smurf Amplifiers
As you can imagine with the large number of machines connected to the Internet, and the lack of security that most companies have, there are a large number of companies that can be used as smurf amplifiers. A smurf amplifier is a company whose network not only accepts ICMP echo requests sent to a broadcast address, but it allows the ICMP echo replies to be sent out. As you will see in the next section, there are several ways a company can protect against this. Because this is becoming a widespread problem on the Internet, there is a site that lists companies that can be used as smurf amplifiers. The site is: http://www.pulltheplug.com. In 2000, there were over 150,000 offenders, which means that this is a very big problem.

Fyodor also came up with a way to use nmap to check a network to see if it can be used as a smurf amplifier. To check a system, run the following command using nmap:
nmap -n -sP -PI -o
smurf.log'209.12.*.0,63,64,127,128,191,192,255'

It is key that you not only check to make sure your company cannot be used as a smurf amplifier, but also that you are not on the pulltheplug list.

How to Protect Against It
Protection against this type of attack can be broken down into two categories: solutions for the intermediary, and solutions for the victim.
Solutions for the intermediary can also be broken down into two preventative measures: disable IP-directed broadcasts at your router, and configure operating systems to prevent responding to ICMP requests sent to a broadcast address.
Solutions for the Intermediary
One solution to prevent your site from being used as an intermediary in this attack is to disable IP-directed broadcasts at your router. By disabling these broadcasts, you configure your router to deny IP broadcast traffic onto your network from other networks. In almost all cases, IP-directed broadcast functionality is not necessary. If an intruder compromises a machine on your network, he may try to launch a Smurf attack from your network using you as an intermediary. In this case, the intruder would use the compromised machine to send the ICMP echo request packet to the IP broadcast address of the local network. Because this traffic does not travel through a router to reach the machines on the local network, disabling IP-directed broadcasts on your router is not sufficient to prevent these types of attack for the long term.
Some operating systems can be configured to prevent the machine from responding to ICMP packets sent to IP broadcast addresses. Configuring machines so they do not respond to these packets can prevent your machines from being used as intermediaries in this type of attack.

Solutions for the Victim
Unfortunately, there is no easy solution for victims receiving the potentially large number of ICMP echo reply packets. ICMP echo reply traffic (the traffic from the intermediary) could be blocked at the victim’s router; however, that will not necessarily prevent congestion that occurs between the victim’s router and the victim’s Internet service provider. Victim’s receiving this traffic may need to consult with their Internet service provider to temporarily block this type of traffic in the ISP’s network. The point with DOS attacks is this: Whatever point at which you try to block the attack causes a DOS attack against that component. For example, let’s say an attacker is launching a DOS attack against your web server by sending it a large number of packets. If you try to block the attack at the router, then the attacker has caused a DOS attack against the router. So, you can move the focus of the attack, but the net result will be the same.

Additional Information
Additional information can be found at the following sites:
http://www.cert.org
http://users.quadrunner.com/chuegen/smurf.txt
http://www.phrack.com

SYN Flood
A Denial of Service attack in which an attacker deliberately violates the three-way handshake and opens a large number of half-open TCP/IP connections.
Exploit Details
Name: SYN Flood
Variants: none
Operating System: Most Operating Systems
Protocols/Services: IP

SYN flooding is an attack that impacts most operating systems because it takes advantage of the reliable fashion of TCP/IP by opening a large number of half-open TCP/IP connections.

Any system connected to the Internet and providing TCP-based network services (such as a web server, FTP server, or mail server) is potentially subject to this attack. Note, that in addition to attacks launched at specific hosts, these attacks could also be launched against your routers or other network server systems if these hosts enable (or turn on) other TCP services (for example, echo). The consequences of the attack may vary depending on the system; however, the attack itself is fundamental to the TCP protocol used by all systems.

Protocol Description
IP packets are used to send information across the Internet. IP packets contain information that specifies who the recipient and sender of the packet is. IP packets also contain port numbers, which specify to which TCP service the packet should be sent.

When a system (called the client) attempts to establish a TCP connection to a system providing a service (the server), the client and server exchange a set sequence of messages known as a three-way handshake. This connection technique applies to all TCP connections—telnet, web, email, and so on.
The client system begins by sending a SYN (synchronization) message to the server. The server then acknowledges the SYN message by sending a SYN-ACK (acknowledgement) message to the client. The client then finishes establishing the connection by responding with an ACK message. The connection between the client and the server is then opened, and the service-specific data can be exchanged between the client and the server.

The potential for abuse arises at the point where the server system has sent an acknowledgment (SYN-ACK) back to the client, but it has not yet received the final ACK message. This is what is meant by a half-opened connection. The server has in its system memory a built-in data structure describing all pending connections. This data structure is of finite size, and it can be made to overflow by intentionally creating too many partially-opened connections.
The following is a summary of the three-way handshake:
A sends a SYN packet to B.
B sends a SYN-ACK packet back to A.
A sends an ACK packet back to B.

Detailed Description
Creating half-opened connections is easily accomplished with IP spoofing. The attacker’s system sends SYN messages to the victim’s server that appear to be legitimate, but in fact, the source address is spoofed to a system that is not currently connected to the network. This means that the final ACK message is never sent to the victim server.

The half-opened connections data structure on the victim’s server system eventually fills, and the system is unable to accept any new incoming connections until the table is emptied out. Normally, there is a timeout associated with a pending connection, so the half-opened connections eventually expire and the victim’s server system recovers. However, the attacker’s system can simply continue sending IP-spoofed packets requesting new connections faster than the victim’s system’s pending connections can expire.

In most cases, the victim of such an attack will have difficulty accepting any new incoming connections for the given service under attack. In such cases, the attack does impact a given service, however the buffers for other services are still available. However, in other cases, the system may exhaust memory, crash, or be rendered otherwise inoperative.

The location of the attacker’s system is obscured because the source addresses in the SYN packets are often set to an IP address that is currently not online. This way it is not able to reply to the SYN-ACK request sent by the server. Because the source address is spoofed, there is no way to determine the identity of the true attacker when the packet arrives at the victim’s system.

Signature of the Attack
The signature of the attack is fairly simple. When a large number of SYN packets appear on a network without the corresponding reply packets, you are probably under a SYN flood attack.

To hide his identity, the attacker can use IP spoofing. IP spoofing is where an attacker puts in a fake source address, so someone thinks the packet came from somewhere else other than the true sender.

In this case, the attacker sends a TCP/IP packet to the victim’s machine with the source address spoofed to a machine that is not currently on the network. Because this is the first packet in a new connection, it has the SYN bit set. The victim’s machine receives the packet and sends a packet back with the SYN and ACK bit set. At this point, the victim’s machine sits and waits for a reply, but it never receives one because the spoofed IP address of the machine that initiated the connection is not online. The following output shows what this traffic looks like on the network:
10:27:10.880000 spoofed.net.1191 > 192.168.20.10.23: S
70894115:70894115(0) win
8192 <mss 1460>
10:27:10.880000 192.168.20.10.23 > spoofed.net.1191: S
1737393897:1737393897(0)
ack 70894116 win 4288 <mss 1460>

10:27:14.610000 spoofed.net.1192 > 192.168.20.10.23: S
70897870:70897870(0) win
8192 <mss 1460>
10:27:14.610000 192.168.20.10.23 > spoofed.net.1192: S
1741139606:1741139606(0)
ack 70897871 win 4288 <mss 1460>

10:27:17.740000 spoofed.net.1193 > 192.168.20.10.23: S
70897952 : 70897952(0) win
4288 <mss 1460>
10:27:17.740000 192.168.20.10.23 > spoofed.net.1193: S
1741139642:1741139606(0)
ack 70897952 win 4288 <mss 1460>

The attacker keeps doing this process until the buffer fills up. In this case, a Denial of Service attack is being launched against the telnet service, but it could be done against any service running on TCP. The output only shows three of several half-opened connections that would be sent. The following is a summary of what is shown in the previous output. The source IP address is spoofed to a machine that is not on the network, so it cannot reply. Then the destination IP sends back an ACK packet to each SYN packet, but it does not receive the third packet needed for the three-way handshake to be completed.

Source Code/Pseudo Code
Because this attack is relatively straightforward, there is source code available at the following addresses. However, if an attacker wanted to launch such an attack, it would be very easy to write code to perform a SYN flood attack.
Source code Synflood.c: www.hackersclub.com
Synful.c and synk4.c SYN flooders: www.anticode.com

There are two general ways to launch a SYN flood attack. First, you can send several SYN packets to a target machine and make sure the sending address does not reply to any of the SYN-ACK packets. This requires watching for the packets and blocking them either at the host or the router. The second way, which is much easier, is to send SYN packets to a target machine with the source address spoofed to a machine that is not active. This way when the target machines replies, there is no machine to answer.

How to Protect Against It
Currently, there is not a generally accepted solution to this problem with the current IP protocol technology. However, proper router or firewall configuration can reduce the likelihood that your site will be the source of one of these attacks.
A router or firewall can block this type of attack by allowing only a limited number of half-opened connections to be active at any given time. For example, if the server can only handle 50 connections, than the router or firewall should block it at 20 connections. This way, if a hacker tries this attack, the packets are blocked and never fill up the target machine. However, this approach is not perfect because legitimate user’s requests could still be blocked. It just reduces the chances of the destination machine crashing.

By using netstat, you can look for a large number of half-opened connections to try to detect such an attack. Many experts are working together to devise improvements to existing IP implementations to “harden” kernels to this type of attack. Currently, there are solutions for Linux and Solaris systems, but after these improvements become available on other platforms, we suggest that you install them on all your systems as soon as possible. Until then, you will have to rely on routers to filter the traffic.

As stated, Linux and Solaris have come out with a solution to SYN flooding known as SYN cookies. The way SYN cookies work is after a machine’s queue starts getting full with half-open connections, it stops storing the information in the queue. It does this by setting the initial sequence number as a function of the sender’s IP address. For example, if machine A sends machine B a SYN packet and the half-open connection queue is getting full, then machine B replies to machine A, but it does not store the half-open connection in the queue. It does this by setting the initial sequence number for machine B to a hash of the time and the IP address and port number. Now if the exploit is a SYN flood attack, it will not be successful because the machine does not get overloaded with half-open connections because they are not stored in the queue. If it is a legitimate connection, then when the third leg of the three-way handshake comes in, machine B checks the sequence number, minus one, and runs the information through the hash. If they match, then it completes the connection. If the hash information does not match, then the connection is dropped.

Additional Information
The following sites contain additional information on the SYN flood exploit:
http://www.cert.org
http://www.hackersclub.com
http://www.anticode.com
http://www.cisco.com

CPU Hog
A Denial of Service attack that causes an NT machine to crash by using up all the resources.
Exploit Details
Name: CPU Hog
Operating System: Microsoft NT
Protocols/Services: Application priority levels

CPU Hog is an exploit that takes advantage of the way in which Windows NT schedules concurrently running applications. It is a simple, yet effective, Denial of Service attack. It works by causing an NT machine to either lock up or crash by using up all its resources.

The flaw is particularly serious because it does not require physical access to the machine, and it can be run through an ActiveX control or by a Netscape plug-in. Therefore, it would be easy to set up a malicious web site that crashes the victim’s machine when it connects.

Protocol Description
In Windows NT, when an application runs, it can set its own priority level. The higher the number, the higher priority that application has on the system. An application or process with a higher priority level takes precedence over one with a lower level. For example, if one application is running with a priority of 10 and is competing for a resource with another application that has a priority of 5, the priority 10 application wins and gets access to that resource.

Applications that run with administrative privileges have 32 priority levels while applications running with normal user privileges have 16 priority levels. By giving 16 additional levels to administrative privileges, it enables these processes to run at a higher level than normal user privileges. In theory, this means that even if a user process sets its priority to the highest level, 16, the system can still gain control because it can set its priority level as high as 32.

Detailed Description
CPU Hog works by exploiting the vulnerability in the way Windows NT schedules the execution of processes. Applications can set their own priority level, which could impact how often Windows NT allows those applications to run. An application running under a user account with administrative privileges can set its priority to any of 32 levels, with the highest level giving it more time slices. Applications running under accounts without administrative privileges can set their priority to any of the first 16 of those levels.

The exploit works by having the CPU Hog program set it’s priority to the highest level available, which is level 16 when run by a normal user. Windows NT attempts to deal with CPU-hogging applications by boosting the priority of other applications. However, Windows NT only boosts applications as high as level 15. Thus, all other applications, even system utilities such as Task Manager, never get a chance to execute while CPU Hog is running. This happens because CPU Hog is running at a level of 16 while all other applications are running at a priority of 15. The only way to regain control of the machine after CPU Hog has been run is to reboot the machine.

Hogging the CPU is one of the oldest known forms of Denial of Service attacks. So old in fact that most operating systems have developed a defense against these types of attacks. Many forms of UNIX enable administrators to set limits on CPU usage by user, limiting any one user to 50 percent of available CPU cycles, for example. Almost all forms of UNIX automatically decrease the priority of the highest-priority process when applications become starved for CPU time, which is the opposite of what Windows NT does.

Microsoft could get around the problem fairly easily in one of two ways: increase the maximum priority given to other, CPU-starved applications above level 15, or increase the priority of the Task Manager above level 16, so it can be used to end CPU-hogging applications.

Signature of the Attack
Because most user applications do not set their priority level to 16, whenever an application does this, it should send up a flag. Also, as soon as NT starts boosting the priority of all other applications and processes to 15, it is usually a symptom that another application is running at a priority of 16.

The final symptom is when the computer locks up and all processes stop responding, but it is probably too late at this point.
To detect whether an attacker has used the CPU Hog exploit, security auditing must be turned on. The events that need to be audited are security policy changes and process tracking. When the appropriate auditing is turned on, the following event occurs in the secu rity log and can be viewed with Event Viewer in NT.

A new process has been created:New Process ID: 2154627104
Image File Name:Creator Process ID: CPUHOG.EXE 2155646112
User Name: Eric
Domain: EricNT

Logon ID: (0x0,0x26CE)

The previous system shutdown at 6:59 PM on 9/1/99 wasunexpected.
The easiest way to detect this is to see that the CPU Hog file has been run. However, it would be very easy for an attacker to change the name of the program prior to running it.

This is one of the main reasons why it is so important to review the audit files on a daily basis and to fully understand what is being run on any of your systems.

Source Code/Pseudo Code
This attack is simple and can be launched with a basic C/C++ or Perl program. It can also run from the Active X control of a plug-in. The key component of the code is the SetThreadPriority command. This enables you to set the priority to 16. After that is done, the program goes into an endless loop, which is shown on the line with the while(1) statement. This loop does not execute any code, all it does it put the program into an endless loop and (because it has the highest priority) there is no way to regain control of the machine except to reboot. The following is the source code:



Running CPU Hog
The CPU Hog version 1.0 is used for this attack. To run this program, download the zip file and extract the executable. When you double-click the executable, the main screen shown



appears to let you know what program you are running. As soon as you start the program, the entire computer freezes or crashes, and the only way to recover is to reboot the machine.

How to Protect Against It
To patch a machine, so it is not vulnerable to this attack, you must apply the latest patches from Microsoft. You have to be very careful, because if you do not apply the appropriate service pack prior to applying the new patch, it could crash your machine. So, before you apply this patch, make sure you locate and apply the latest service pack.

Another way to protect against CPU Hog is to set the priority for Task Manager to 16. Because Task Manager is also running at a priority of 16, if someone launches this attack, you can still regain control of the machine and stop the application.

To change the priority of an application, you need to go in and edit the registry. Unless you are very familiar with what you are doing, it is highly recommended that you do not edit the registry. The reason for this is if you accidentally delete or add a key, you could crash your entire system, and you might have to reload NT to get it running again.

Additional Information
Additional information can be found at the following web sites:
http://neworder.box.sk
http://www.microsoft.com

Win Nuke
A Denial of Service attack that involves sending out of band data to a Windows machine.
Exploit Details
Name: Win Nuke
Operating System: Most Microsoft OSs
Protocols/Services: Port 139 NetBIOS

The Win Nuke is a category of network-level attacks against hosts with the goal of denying service to that host. A perpetrator sends out of band data to a victim’s machine on port 139, which is NetBIOS. Because this is data that the machine is not expecting, it will either cause the machine to crash or hang.
Currently, Win Nuke effects most versions of Microsoft Windows, mainly Windows NT.

What Is a Nuke?
Nukes exploit bugs in operating systems, especially Windows95 and Windows NT. The idea is to send packets of data that the operating system cannot handle or is not expecting. This causes the machine to either hang or reboot. In most cases, it causes the blue screen of death.

Protocol Description
IP packets are used to send information across the Internet. IP packets contain information that specifies who the recipient and sender of the packet is. IP packets also contain port numbers that specify to which TCP service the packet should be sent.

IP packets contain flags that communicate information about how the packet should be handled by routers or processed by computers. Flags are basically bits that can either be 0 (off) or 1 (on). Some common flags are:
SYN Synchronization used to setup a new session
ACK Acknowledgement used to acknowledge receipt of a packet
URGENT Specifies a packet contains urgent data, such as OOB (out of band data)

Detailed Description
To exploit a machine using Win Nuke, an attacker sends a special TCP/IP command known as out of band (OOB) data to port 139 of a computer running Windows 95 or NT. An easy way to think of OOB data is that it is data the host operating system is not expecting. An attacker could target users’ PCs by using one of several programs for Windows, UNIX, and Macintosh available on the Internet. With the main program called Win Nuke, a hacker simply types a user’s Internet protocol address and then clicks the program’s “nuke” button to crash a PC over the Internet or a local network.
Microsoft’s original patch for Windows NT prevented attacks using the original Win Nuke program, but not manual attacks. The reason is that the original fix from Microsoft just filtered hits on port 139 looking for a keyword included in the first ‘winuke’ script, which was “nuke me.” By changing that word, Microsoft operating systems were once again vulnerable. So, attackers quickly came out with a new program that enables them to specify the IP address and also the phrase that is sent to the victim’s machine. By using a phrase other than “nuke me,” attackers could once again crash Windows machines, even if the patch was applied. Microsoft has since come out with a new patch that correctly fixes this problem.

When users are “nuked” by a hacker, their computer screens often display an error message known as the “blue screen of death.”

Signature of the Attack
The main signature for this exploit is out of band data that is sent to port
139. Notice that it is both of these properties together that indicate someone is launching a Win Nuke attack against your system. Port 139 traffic is normal on a network and so is out of band data. It is only when the two are combined that you have to be cautious.

With the Win Nuke exploit, the source IP address sends out of band data to the destination IP address (victim’s machine) on port 139. The following is the TCP dump from running this exploit:

10:05:15.250000 192.168.10.5.1060 > 192.168.20.10.139: S
69578633:69578633(0) win
8192 <mss 1460> (DF)
10:05:15.250000 192.168.10.5.139 > 192.168.20.10.1060: S
79575151:79575151(0) ack69578634 win
8760 <mss 1460> (DF)
10:05:15.250000 192.168.10.5.1060 > 192.168.20.10.139: P
1:5(4) ack 1 win
8760 urg4 (DF)

Source Code/Pseudo Code
This attack is simple and can be launched with a Perl program. Basically, an attacker creates a packet with out of band data (data that the machine is not expecting) and sends it to port 139.
Pseudo code:
Generates packet with out of band data
Sends it to port 139

Source code:


The following sites are where you can download the executables and source code for the Win Nuke exploit:
Exe for winnuke: http://www.jaydee.cz/filfree.htm
Source code: www.rootshell.com
Win Nuke source code and executable: www.anticode.com

Win Nuke Program
This first version of Win Nuke sent a packet with a data field containing the phrase “Nuke Me”. So, the first patch that Microsoft released filtered packets based on the string “Nuke Me” and stopped the attack. Well, attackers quickly figured this out and released a version where they could customize the string, so Microsoft had to release another patch.

To patch a machine so it is not vulnerable to this attack, you must apply the latest patches from Microsoft. You have to be very careful, because if you do not apply the appropriate service pack prior to applying the new patch, it could crash your machine. So, before you apply this patch, make sure you find and apply the latest service pack.

Additional Information
Additional Information can be found at the following sites:
http://www.cert.org
http://hackersclub.com
http://net-security.org
http://www.microsoft.com
http://www.phrack.com

RPC Locator
A Denial of Service attack that causes 100 percent CPU utilization by sending data to port 135.
Exploit Details
Name: RPC Locator
CVE Number: CVE-1999-0228
Operating System: Microsoft NT
Variants: Inetinfo (port 1031) and DNS (port 53)
Protocols/Services: RPCSS.EXE, port 135

RPC Locator is a Denial of Service attack that causes 100 percent CPU utilization when an attacker telnets to port 135 on a victim’s machine. Depending on the configuration and whether other programs are running, this exploit can either cause the machine to run really slowly or cause it to stop responding. Either way, to get the machine to continue operating at its normal speed requires a reboot of the machine. Because most NT servers run critical applications, having to reboot them at any time can cause a Denial of Service for the company.

RPC stands for remote procedure call and enables an attacker to execute known system calls on a remote machine.

The service that is exploited is the RPCSS.EXE service, which runs on port
135. There are variants of this attack that affect other services, mainly ISS and DNS services.

Detailed Description
Overall, this is a simple exploit not only to run, but to understand. Telnet is a program that comes with most operating systems that enables attackers to connect to various ports on a remote machine. Normally, the attacker would just type telnet followed by a machine name or IP address, and he would connect to port 23, which is the telnet port. By doing this, he can navigate the operating system as if he were sitting at the local machine.

Typing telnet followed by a different port number enables the attacker to use telnet to connect to any service running on a remote machine. In this case, by typing telnet <IP address> 135 he can connect to the RCP port or port 135. By typing random or garbage text that the service is not expecting, an attacker can cause the service to get confused and utilize 100 percent of the CPU. At this point, the attacker would exit the telnet sessions because the attack has been successful. To recover from this attack, the remote administrator must reboot the machine to restore system performance.

Description of Variants
This exploit also works if the attacker telnets to the ISS service, which is port 1031 (inetinfo.exe) or the DNS service, which is port 53 (dns.exe). The following is a summary of the different variants:
IIS service:
INETINFO.EXE
port 1031

DNS Server:
DNS.EXE
port 53

In both cases, the services will stop responding and the machine will need to be rebooted.

Signature of the Attack
The only way to detect this type of attack is to watch for someone connecting to port 135 and sending it garbage or random text. In this case, garbage text is any command that the system is not expecting.
This first output shows an attacker connecting to port 135 on a remote machine and initiating the three-way handshake.

15:12:50.100000 client-20-15-9-22.1352 > client-20-15-9-
23.15: P 41:43(2) ack 1
win 8760 (DF)15:12:50.270000 client-20-15-9-23.135 > client-20-15-9-
22.1352: . ack 43 win 8717
(DF)
15:12:50.490000 client-20-15-9-23.135 > client-20-15-9-
22.1352: . ack 46 win 8714
(DF)
15:12:50.710000 client-20-15-9-23.135 > client-20-15-9-
22.1352: . ack 48 win 8712
(DF)
15:12:53.290000 client-20-15-9-22.1352 > client-20-15-9-
23.15: F 48:48(0) ack 1
win 8760 (DF)

Once connected, the attacker sends random data to the victim’s machine:

15:12:53.290000 client-20-15-9-23.135 > client-20-15-9-
22.1352: F 1:1(0) ack 49
win 8712
(DF)
15:12:54.660000 0:10:7b:0:33:7 0:10:7b:0:33:7 loopback 60:

0000 0100 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000
15:12:54.990000 0:10:7b:0:33:7 > 1:0:c:cc:cc:cc sap aa ui/Clen=289
a700 0100 0c45 5249 4343 4f4c 4500 0200
1100 0000 0101 01cc 0004 cf9f 5a11 0003
000d 4574 6865 726e 6574 30

Pseudo Code/Source Code
This attack is simple and can be launched with a Perl program or by running a telnet program that comes with most operating systems. To perform this attack, an attacker just connects to port 135 using a telnet program, types about 10 characters of random text, and disconnects.

The following is a Perl program that runs this attack. It just initiates a connection to port 135, sends the remote system random data, and disconnects.



The following are web sites from which the source code can be downloaded:
http://www.Ntsecurity.com
http://www.njh.com
http://www.pancreas.com
http://www.iss.net/xforce

Running RPC Locator
From Windows, to launch this attack, go to a DOS prompt and type telnet followed by the domain name or IP address of the victim’s machine followed by 135. After you hit enter, the telnet screen shown in. At this point, the attacker types random text, which causes the remote machine to crash.

How to Protect Against It
To protect against this attack, apply the latest Windows NT 4.0 Service Pack on Windows NT 4.0. To apply the latest Windows NT 4.0 Service Pack, follow these steps:
1 Open a web browser.
2. Go to
http://support.microsoft.com/support/ntser...ent/ServicePack s/ and follow the directions to download the appropriate service pack for your computer.
2 Find the installation program, and download it to your computer.
3 Double-click the program icon to start the installation.
4 Follow the installation directions.

Additional Information
Additional information can be found at the following sites:
http://www.securityfocus.com
http://www.windowsitpro.com/WindowsSecurity
http://www.microsoft.com

Jolt2
Vulnerable systems enable a remote attacker to cause a Denial of Service by sending a large number of identical fragmented IP packets.
Exploit Details:
Name: Jolt2.c
CVE Number: CVE-2000-0305
Variants: None
Written by: Joe Church
Operating System: Windows 95/98/NT4/2000, Be/OS 5.0, Cisco 26xx, Cisco 25xx, Cisco 4500, Cisco 36xx, Network Associates Gauntlet, Webshield, Firewall-1 from Checkpoint on Solaris, NT, Nokia firewall, Bay router (Nortel) firewall, Fore

Protocol Description
Jolt2 enables remote users across different networks to send IP fragment-driven Denial of Service attacks against multiple operating systems by making the remote (victim’s) machine utilize 100 percent of its Central Processing Unit when it attempts to process the illegal IP packets.

This attack, which uses identical fragmented IP Packets, causes the remote (victim’s) machine to lock up for the duration of the attack. The Central Processing Unit exhausts 100 percent of its processing time trying to process the packets, which causes both the user interface and the network interface to lock up.

How the Exploit Works
By utilizing Jolt2, an attacker can prevent a machine from performing work by utilizing the CPU of the selected machine. It is important to note that the machine is unusable and the attacker is not able to compromise data on the machine or gain administrative privileges. Jolt2 relies on IP fragmentation, in which IP datagrams are divided into smaller data packets during transit. Because the maximum frame size varies from network to network, fragmentation may be required because every network architecture carries data in groups called frames. Fragmentation occurs when an IP datagram enters a network whose maximum frame size is smaller than the size of the datagram. At this point, the datagrams are split into fragments. The fragmented packets then travel separately to their assigned destination. Then the destination computer re-assembles the fragmented packets and processes them.

In Windows 9x, NT4, or 2000, vulnerabilities exist because of a flaw in the way the system performs IP fragment re-assembly. When malformed IP fragments are directed against a targeted host, the work factor associated with performing IP fragment re-assembly can be driven extremely high by varying the data rate at which the fragments are sent. If fragmented packets are transmitted at a rate of 150 packets per second, the CPU of the target machine is forced to exhaust 100 percent of its resources, causing the machine to halt. Windows does not correctly perform IP fragment re-assembly. The targeted machine is affected as long as the attacker is sending malformed, Jolt2 packets. The target machine returns to normal after the packet storm is completed.

If using the Gauntlet Firewall, the Denial of Service affects Hyper Text Transport Protocol Web traffic. The daemon crashes and dumps a core file, thus preventing the HTTP proxy from checking policy, resulting in new connections failing.

If you are using the Checkpoint Firewall-1, Jolt2 uses the fact that this firewall does not usually look at or log fragmented packets until the packets are re-assembled. With this attack, the Checkpoint Firewall-1 is forced to exhaust 100 percent of its CPU power to attempt to re-assemble the packets. By trying to re-assemble these malformed packets, the firewall denies service to other services and requests.

The data sent is 29 bytes (20 IP + 9 data), which is valid because it is a last fragment (MF=0). However, the total length reported by the IP header is 68 bytes. This malformed packet should fail structural tests if there are any in place.

Acknowledgement of a packet with a reported length larger than the actual received length is a normal occurrence. This happens whenever a packet is truncated during transport. Because the IP Header is 20 bytes, the amount of IP data is 48 bytes due to the packet size of 68 bytes. Because the offset is 65520, and the length of IP data is 48 bytes equaling 65568, this results in a IP packet length overflow because the maximum allowed length is 65535. Note, however, that the data sent (9 bytes) does not cause an overflow. Fragments are flagged as being “last fragments”.

The following is how the packets look traveling across a network from the attacker to the victim:

06:58:06.276478 attacker > 192.168.7.10: (frag 1109:9@65520)06:58:06.279297 attacker > 192.168.7.10: (frag 1109:9@65520)06:58:06.279625 attacker > 192.168.7.10: (frag 1109:9@65520)06:58:06.279939 attacker > 192.168.7.10: (frag 1109:9@65520)06:58:06.280251 attacker > 192.168.7.10: (frag 1109:9@65520)06:58:06.280563 attacker > 192.168.7.10: (frag 1109:9@65520)06:58:06.280876 attacker > 192.168.7.10: (frag 1109:9@65520)06:58:06.281189 attacker > 192.168.7.10: (frag 1109:9@65520)06:58:06.281501 attacker > 192.168.7.10: (frag 1109:9@65520)06:58:06.281814 attacker > 192.168.7.10: (frag 1109:9@65520)06:58:06.282134 attacker > 192.168.7.10: (frag 1109:9@65520)06:58:06.282448 attacker > 192.168.7.10: (frag 1109:9@65520)06:58:06.282752 attacker > 192.168.7.10: (frag 1109:9@65520)06:58:06.282942 attacker > 192.168.7.10: (frag 1109:9@65520)

How to Use It
The exploit jolt2.c can be located at http://www.antiserver.it/Denial-Of-Service/, and it can be downloaded in its source code form (also its mods). After the exploit is downloaded, the exploit must still be compiled on the operating system of choice, which must be a UNIX flavor, such as Redhat Linux, Mandrake Linux, or Slackware Linux. To compile the exploit, simply use the make command at a command prompt with the name of the exploit, excluding the “.c” at the end of the file name. For Example: # make jolt2
If the file compiles cleanly without any errors, you will have an executable file named Jolt2. To find out the syntax of the command along with the switches it uses, simply use the –h switch, and the syntax of the Jolt2 displays on the screen. When you use the –h option the syntax is:

./jolt2 <src address> -p <port number> <destination address>

Even before you launch the attack, you must make sure that the victim’s machine is susceptible against this sort of attack, and because we know that many Microsoft Windows machines are susceptible by conducting research on the web, we can scan the network first using nmap from www.insecure.org to find Windows machines located on the network. Nmap is a utility tool used to map networks and also scan hosts by telling the attacker what ports or hosts are alive. Nmap can also give an estimated guess on what type of operating system the machine is currently running.
After we have located a machine that matches our required results
(192.168.7.10 / Windows NT 4.0) we can use the attack, for example:

#./jolt2 192.168.5.1 -p 80 192.168.7.10

The above command launches the attack from the attacker’s machine with a spoofed IP address of 192.168.5.1 against IP address 192.168.7.10 (the victim’s Windows NT machine) on port 80 (HTTP). The Windows NT (victim’s Machine) CPU resources reach 100 percent and cause the system to lock-up. There is not a set number of packets sent, they are just sent as fast as the attacking machine can send them. Now at this point, there are several options the attacker can do. For instance, if the attacker had a sniffer on the network, so he was able to observe communications between two hosts on the network, and he wanted to take over the conversation, he could use Jolt2 to tie up one machine while he takes over the conversation and assumes the identity of the other machine. This type of attack is called session hijacking. To complete this task, the attacker must be able to properly guess the sequence number of the host for which he is taking over the conversation.

The Jolt2 exploit can also be used to make a targeted host on a network exhaust 100 percent of its CPU, which causes the machine to lockup. The user of the targeted machine may become frustrated and restart the targeted machine by turning the machine off at the power source. The attacker on the same network could use the L0phtcrack password sniffer to capture the login screen name and the password of the targeted Windows NT Client Machine as it logs onto the domain and authenticates through the Primary Domain Controller. L0phtcrack then cracks the password and now the attacker owns the machine. Also, if the user has been placed in a global group and is trusted in other domains, then the attacker now has access to other domains.
This attack can also be used to bypass Intrusion Detection Systems that may reside on the network. Tiny fragments attacks, such as Jolt2.c, are designed to fool IDS systems by creating packets that are too small and do not contain the source and destination port numbers. Because IDS systems are looking for port numbers to make filtering decisions, they could allow the tiny fragments through and do not alert the system of them.

Signature of the Attack
The following is the signature of the attack:

06:58:06.276478 attacker > 192.168.7.10: (frag 1109:9@65520)
06:58:06.279297 attacker > 192.168.7.10: (frag 1109:9@65520)
06:58:06.279625 attacker > 192.168.7.10: (frag 1109:9@65520)
06:58:06.279939 attacker > 192.168.7.10: (frag 1109:9@65520)
06:58:06.280251 attacker > 192.168.7.10: (frag 1109:9@65520)

The data sent is 29 bytes (20 IP + 9 data), which is valid because it is a last fragment (MF=0). However, the total length reported by the IP header is 68 bytes. As stated earlier, this malformed packet should fail structural tests, if there are any in place.
If a victim is attempting to block this attack, there are a couple signatures that detect this attack. In the packets you can see that the source and destination port numbers of the hosts are missing. You could design filters that would drop IP fragmented tiny packets that do not include TCP source and destination port numbers. You can see from the packets that the fragment ID number remains the same throughout the attack. The fragment ID number of 1109 could be used in a rule set to block fragments with the ID number of 1109.

How to Protect Against It
On stateful packet-filtering firewalls, the packet fails integrity tests. The reported length (68) is much larger than the received length (29). However, a broken router may decide to send 68 bytes when forwarding it (adding 39 bytes of random padding). This incarnation of the attack is also illegal because it wraps the IP packet size limit. The IP data length reported is 48, and the offset is 65520. If the firewall has any sort of fragment reassembly, it shouldn’t forward a single packet because there are no valid fragments preceding the attack sequence. If the firewall maps fragments to open connections, it should detect that there is no open connection for this particular packet, thereby discarding it.

On Proxy firewalls, a proxy function never passes this attack pattern to the protected network (assuming that there is no packet filtering functionality applied to the firewall). If the proxy firewall is running on a vulnerable OS, and it doesn’t have its own network layer code (relying on the MS stack), the attacks cause a DOS attack against the firewall itself, effectively crashing the entire connection.

On any other type of firewall, if the firewall does fragment reassembly in an incorrect way (maybe by trusting vulnerable MS stacks to do it), it is vulnerable to the attack, regardless of which type of firewall it is.

All manufacturers have produced patches for their products. Manufacturers have also suggested solutions outside of the patches.

In the case of Gauntlet, it is recommended to deny any connection to port 8999 on the firewall. For Checkpoint, it is recommended that console logging be disabled. Microsoft suggests installation of the patch. All other Routers should filter the fragmented IP packets, if possible.

In the case of network Intrusion Detection Systems, make sure they are up to date with the newest patches available. For sensitive machines, you should use a host-based IDS, and harden all systems by closing all unused service ports!
In the Windows environment, Microsoft has released several patches for its effected operating systems.

Checkpoint:
http://www.checkpoint.com/techsupport/alerts/ipfrag_dos.html
As taken from Check Point’s web site, “Check Point is in the process of building new kernel binaries that will modify the mechanism by which fragment events are written to the host system console, as well as providing configurable options as to how often to log. In addition and independent of the console message writing, with the new binaries FireWall-1 administrators will be able use the Check Point log file method for reporting fragmentation events. These binaries will be released shortly in Service Pack 2 of FireWall-1 version 4.1, for 4.1 users, and as a Service Pack 6 Hot Fix for FireWall-1 version 4.0 users.”
As an interim workaround, customers can disable the console logging, thereby mitigating this issue by using the following command line on their FireWall-1 module(s):

$FWDIR/bin/fw ctl debug -buf

This takes effect immediately. This command can be added to the $FWDIR/bin/fw/fwstart command to be enabled when the firewall software is restarted. It should be noted that although this command disables fragmentation console output messages, and standard log messages, (for example, Long, Short, control messages, and so forth.) they continue to operate in their traditional way. You can find out more at:
Network Associates: Gauntlet Firewall
http://www.tis.com/support/cyberadvisory.html

Additional Information
Additional information can be found at the following sites:
http://www.antionline.com
http://www.sans.org

Bubonic
Bubonic.c is a DOS exploit that can be run against Windows 2000 machines and certain versions of Linux (worked against an Ultra5 running Redhat Zoot). It works by randomly sending TCP packets with random settings with the goal of increasing the load of the machine, so that it eventually crashes.
Exploit Details:
Name: Bubonic
Variants: Many different types of Denial of Service exploits exist under different names.
Operating System: Windows 98, Windows 2000
Protocols/Services: IP & TCP
Written up by: Andy Siske

Protocol Description:
Bubonic utilizes the TCP/IP protocol stack to effect its Denial of Service. The Internet Protocol (IP) is the standard means by which data is transferred (through encapsulation) over the Internet. IP is a connectionless, datagram-oriented service that does not concern itself with reliability. The IP header (which operates at the Network Layer of the OSI model) contains several components to ensure it is delivered to the appropriate host.

Transmission Control Protocol (TCP) on the other hand, is a connection-oriented protocol that uses a series of sequence and acknowledgement numbers and flow control to ensure data is reliably delivered to its destination. TCP operates at the Transport layer of the OSI model. The TCP header contains the source and destination ports as well as the sequence and acknowledgement numbers. Because TCP does not contain the source and destination IP address, TCP must be encapsulated within the IP datagram to properly arrive at its destination. This IP datagram is then further encapsulated within an Ethernet frame (if it’s an Ethernet network), which operates at the Data Link Layer of the OSI model. All this is then transmitted into a series of bits that are sent across the physical media (the Physical Layer of the OSI model).
When the destination host receives the data, the opposite then takes place. First, the MAC address is read from the Ethernet frame, and the NIC card checks to see if it is the intended destination. If so, the data is then passed up the OSI stack to the Network Layer where the IP header is read. Contained within this IP header is specific code that designates what type of data is encapsulated within; in this case, TCP data. This process is then repeated until the data arrives at the designated application.
The exact specifications for the IP as well as the TCP can be found at http://www.rfc-editor.org. RFC0791 deals with IP, while RFC0761 deals with TCP.

Description of Variants
All Denial of Service attacks have the purposeful action to significantly degrade the quality or the availability of services a system offers. With respect to the abuse of the TCP/IP stack, there have been quite a large number of Denial of Service tools in existence for a number of years. Most other Denial of Service tools currently in existence tend to exploit the SYN, SYN/ACK, and ACK connection phases of TCP, which is known as the three-way handshake. Others implement such tactics as sending malformed fragmented packets in an attempt to crash the victim’s Operating System, while others merely attempt to overwhelm a target system by sending a tremendous amount of data. Regardless of the technique, all these exploits take advantage of inherent weaknesses with the TCP/IP protocol stack specification.

How the Exploit Works
Bubonic is a relatively simple Denial of Service tool that also gives the attacker the ability to spoof his IP address with the hopes of completely concealing his identity (or taking on someone else’s identity).

A search of the Internet revealed several web sites that had the bubonic source code available for anyone to download. Most web sites had very little or no documentation or explanation of it. The following information was located within the source code:



After the code is downloaded, it must be compiled. The command used to compile the program is:

#make bubonic

This was done from the root directory where bubonic was downloaded. Next, the command ./bubonic was run, which displayed the built-in help:

Bubonic – sil@antioffline.comUsage: ./bubonic <dst> <src> <size> <number>
Ports are set to send and receive on port 179
should allow for xtra
Dst: Destination Address
Src: Source Address
Size: Size of packet which should be no larger than 1024

header info through routesNum: packets
For this experiment, there were four targeted machines. The first was a Windows 2000 machine with all current service packs installed as of December 28, 2000. The second was a Windows 2000 machine with no updates at all. The third was a Windows 98 machine with all current updates as of December 28, 2000, and the fourth was a Windows Millennium machine with all current updates as of December 28, 2000.
The bubonic Denial of Service tool was then executed against the first machine using this command:


# ./bubonic 192.168.1.50 10.1.1.10 100 100

There were no observable immediate effects against the updated Windows 2000 machine. The hub, however, indicated so many collisions on the LAN that the red collision light was a steady red. After several minutes, the targeted machine revealed sporadic freeze ups that lasted 3 to 4 seconds at a time. The bubonic attack continued for fifteen minutes with no other adverse effects.
The results were identical against the second machine (Windows 2000 with no updates).
The third machine (Windows 98) immediately froze up and was completely unusable. Even rebooting the machine (which required a hard reboot) resulted in the machine immediately freezing as soon as it reconnected to the network. The only way to avoid the ramifications of the bubonic Denial of Service was to physically disconnect it from the network or find a way to stop the network attack.
The Windows Millennium machine exhibited no adverse effects whatsoever.
The author of bubonic describes how the exploit works, “Randomly sends TCP packets with random settings, etc.” Network captures were done utilizing TCPDump, Snort, and Ethereal. Observation of the packets of data reveals the following:

Snort capture (one sample packet):
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
=+=+
01/06-20:37:51.972206 10.1.1.10 -> 192.168.1.50 TCP TTL:255
TOS:0xC9 ID:49832 Frag
Offset: 0x1B9E Frag Size: 0x14 50 00 EF C0 87 8E 61 15 6B 57
C6 4E 00 27 00 00
P.....a.kW.N.'.. 3D FB 00 00
=...=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
=+=+=+=+

Ethereal Capture (one sample packet):

Frame 1 (54 on wire, 54 captured)Arrival Time: Jan 6, 2001 20:37:51.9721Time delta from previous packet: 0.000000 secondsFrame Number: 1 Packet Length: 54 bytesCapture Length: 54 bytes
Ethernet II Destination: 00:20:78:cd:c2:de (00:20:78:cd:c2:de)Source: 00:00:c0:6f:d7:77 (00:00:c0:6f:d7:77)Type: IP (0x0800)
Internet Protocol Version: 4 Header length: 20 bytesDifferentiated Services Field: 0xc9 (DSCP 0x32: Unknown
DSCP; ECN: 0x01)1100 10.. = Differentiated Services Codepoint: Unknown
(0x32) .... ..0. = ECN-Capable Transport (ECT): 0.... ...1 = ECN-CE: 1
Total Length: 40
Identification: 0xc1a8
Flags: 0x00

.0.. = Don't fragment: Not set
..0. = More fragments: Not set
Fragment offset: 56560
Time to live: 255
Protocol: TCP (0x06)
Header checksum: 0x90da (correct)
Source: 10.1.1.10 (10.1.1.10)
Destination: 192.168.1.50 (192.168.1.50)

Data (20 bytes)
0 5000 efc0 868e 6115 d2d9 0949 0054 0000 P.....a....I.T.. 10 9451 0000 .Q..

As can be observed from this Ethereal capture, bubonic transmits an IP datagram that contains 20 bytes of random data. The IP datagram indicates that it contains TCP data (0x06), but in fact, there is no TCP data within the datagram. Obviously, this type of datagram is not following standard TCP/IP transmission standards, therefore, how each System handles this incoming datagram is dependant upon how that Operating System implements its TCP/IP stack. Further complicating this is the fact that bubonic sends out an extremely large quantity of datagrams (without regard for collisions). From this limited experiment, it appears that the Windows 98 Operating System is vulnerable to this exploit and Windows 2000 is only slightly affected. Windows Millennium was not affected at all.

A side effect of this exploit is that, although machines not targeted are unaffected, bubonic sends out such a large number of datagrams without regard to collisions that other machines residing on the affected network suffer decreased network performance as a result of the extremely high collision rate.

How to Use It
The bubonic program can be downloaded from several sources, including: http://www.antioffline.com/bubonic.c.
The source code must be compiled and run with the correct syntax as previously described.

Signature of the Attack
Certainly with this type of attack, the victim machine wants to find a way to block it as well as detect it. With this consideration in mind, an analysis of the network traffic must be done, so that certain peculiarities can be located. It has been found over time that when someone programs an exploit, certain values within the programming code will be defined either as an absolute or changing variable that increments/decrements by a fixed amount. With bubonic, the source IP address is a fixed value that is defined by the user when the exploit is initially run. Unfortunately, because of this fact, the victim cannot search for a known hostile IP address because the attacker can change this.

From an analysis of attacks that were run in a controlled environment, several possible signatures appear to surface. First, there is a fixed Time to Live (TTL) value of 255. Second, the Type of Service (TOS) field has a consistent value of 0xC9. Third, there are always exactly 20 bytes of data carried within the IP datagram. Lastly, the fragment ID value has consistent increments by a value of 256. Based on the above information, a sniffer can be used to effectively detect this type of attack as well as program a firewall to block such an attack.
With any type of attack, it is imperative that the network data be analyzed for any type of pattern that can be programmed into the router, sniffer, or firewall, so the network may be properly protected.

How to Protect Against It
One of the best ways to secure a network against any type of outside attack is to utilize a Network Address Translating router/firewall while using reserved, non-routable IP address schemes for the internal network. This type of network architecture makes it extremely difficult for an outsider to directly attack one of the inside hosts. Because this attack is run using a static source address, the firewall could be programmed to automatically shutdown any further incoming connections from the hostile IP address. Certainly, whichever operating system is being utilized, the newest patches and upgrades should be installed. Furthermore, vulnerable operating systems to this specific type of attack should not be utilized on any external systems that may be acting as a web server, ftp server, and so forth. In this limited experiment, Windows 98 was the most vulnerable OS, and it would be rare indeed for this operating system to be used on an external server. Certainly, if a host machine is not absolutely required to be on the network, there should be no connectivity whatsoever. The first step in any good security plan always should be physical security.

After host-based considerations have been implemented, network-based solutions must also be considered. Even if every host on the network is impervious to bubonic, it is entirely possible that (as is the case with most Denial of Service attacks) all network resources may be consumed by the Denial of Service attack. Therefore, it is imperative to have a defensive strategy in place at the network entry point to the Internet, which is usually a router. The judicious use of the router’s access control list may be enough to block such hostile traffic. Of course a good application gateway Firewall should also be used in conjunction with the router. Finally, a high-quality IDS should be implemented as well. By utilizing a good combination of router/firewall/ids, the three will work in concert to shun a perceived hostile connection, such as bubonic.

Source Code/Pseudo Code
The source code for bubonic can be found at http://www.antioffline.com/bubonic.c.

Microsoft Incomplete TCP/IP Packet Vulnerability
An attacker can send malformed packets to port 139 on a victim’s system that will affect network services and system operations.
Exploit Details:
Name: Microsoft Incomplete TCP/IP Packet Vulnerability
Operating System: Windows NT, ME, 9x
Protocols/Services: TCP/IP, Port 139

How the Exploit Works
If a malicious user sends a flood of specially-malformed TCP/IP packets to a victim’s machine on port 139, either of the following could occur. First, the flood could temporarily prevent any networking resources, on an affected computer, from responding to client requests. When the packets stop arriving, the machine would resume normal operation. Second, the system could hang and remain unresponsive until it was rebooted.

How to Use It
Any program that can send out multiple, fragmented TCP/IP packets to a specific target can be used to take advantage of this vulnerability.

Signature of the Attack
A signature of this attack is a large number of inbound TCP/IP packets destined for port 139 on a specific machine or group of machines.

How to Protect Against It
The following are the steps that should be used to prevent this type of attack:
1 Use a port blocking software to close port 139.
2 Disable the server service or File/Print sharing.
3 Apply the patch that is specified by Microsoft for your specific OS.

Additional Information
Additional information can be found at http://www.ciac.org


HP Openview Node Manager SNMP DOS Vulnerability
HP Openview Node Manager can be compromised due to an unchecked buffer that exists in the program code.
Exploit Details:
Name: HP Openview Node Manager SNMP DOS Vulnerability
Operating System: Sun Solaris 8.0, Sun Solaris 7.0, Sun Solaris 2.6, Microsoft Windows NT 4.0, Microsoft Windows NT 2000, HP HP¬UX 11.0, HP HP-UX 10.20
Protocols/Services: SNMP, HP Openview Network Node Manager 6.1

How the Exploit Works
If a specially-crafted GET request comprised of 136 bytes is sent to the web services on port 80 through the Overview5 CGI interface, the SNMP service will crash. This exploitation, depending on the data entered, allows the execution of arbitrary code by an unauthorized user.

How to Use It
Use any web browser with the given string.

Signature of the Attack
Watch for specific 136-byte GET requests sent to the HP Openview node manager by using a network sniffer. If the node managers SNMP service continually crashes, verify the given fix.

How to Protect Against It
To protect against this exploit, apply the patches from the company based on the system that is impacted.

Source Code/Pseudo Code
The following is the pseudo code for running this exploit:

http://target/OvCgi/OpenView5.exe?Context=Snmp&Action=Snmp&Host=&Oid=<string ofcharacters consisting of 136 bytes>

Additional Information
Additional information can be found at http://www.securityfocus.com.

just setting a forum with a fedora 3 OS on the server....how do i set the firewall to drop packets from a dos??

is there an easy way using the rules table??