Slashdot Mirror

Ever heard of FBI's Carnivore and its litigation. ??? This is been happening from a long long time. In todays modern and small planet you cannot expect privacy even inside your toilet. Somebody is already out there.

The proper checks and balances are in place via a search warant.

To think that criminal communication wouldn't be encrypted, is niave. Given that, why extend law enforcement's powers, other than to allow then to snoop where they clearly don't belong.

If they have a judge's blessing, its simple enough to place a keylogger So if its reasonable to expect that communication to be encryped, and if there are already tools, to perform surveillance on unenrypted communications.

If you look at this and this perhaps you'll consider changing your viewpoint?

Canadians would appreciate it, as we'll undoubtedly be pressured into the same costly (both in dollars and in freedom) legislation up here.

And it says:

"Controversy: The computer-enthusiast community does not like using "hacker" to describe malicious people; they prefer "cracker". The security-community restricts the use of the word "cracker" to some who breaks encryption and copy-protection schemes.

Consequently, a journalist who writes about cybercriminals cannot use either word without hate mail from the opposing community claiming they are using the word incorrectly. If a journalists writes about hackers breaking into computers, they will receive hate-mail claiming that not all hackers are malicious, and the that the correct word is "cracker". Likewise, if they write about crackers breaking into computers, they will receive hate-mail claiming that crackers only break codes, but its hackers who break into systems. The best choice probably depends upon the audience; for example one should definitely talk about malicious crackers in a computer-enthusiast magazine like Linux Today."

This is one I've always been confused about too. But I reckon I'm on the side of "Crackers".

In normal tort and contract law, there is a notion of 'reasonable' behavior and well understood 'duty.' Not so here. Thus, attempts at analogy do poorly.

In the 'real' world, it's clear who is supposed to do what. And if everyone is a good citizen, then everyone is pretty safe.

Example: If I sell you a sandwich, I have a duty to not poison it. I even have a duty to take reasonable steps to ensure that other people don't put poison into it. For example, if I saw someone lick it and put it back on the counter, it's reasonable to expect me to throw it away, and not resell it (and for me to get the perpetrator to pay me for it).

But that duty has reasonable limits. It is not reasonable to expect me to erect Fort Knox level security around my store, just to keep people from breaking in at night and adulterating the sandwiches.

These simple concepts apply to millions of practical applications, from product liability involving millions of consumers to simple traffic accidents. A few simple rules can actually implement a lot of what is required by 'common sense' or 'justice' or 'fairness' (thus, tort law is pretty efficient code).

But these concepts -- and our hence our analogies -- don't apply well to the internet, for two reasons. First, there is a notable lack of consensus as to what the duties of each party should be. Second, we have not identified what duties will actually protect us. As Graham and Staniford, Paxson, Weaver have pointed out, the pallative 'we all have a duty to keep everything patched' does not really help with fast worms. Even with a lot more patching going on, we remain very vulnerable to fast worms.

So, even if we are all good citizens, bad things can still happen (like expensive bandwidth being consumed by a fast worm). Thus, normal tort analogies will fall short. There are some extraordinary tort analogies that might work, like who pays for what after a tornado or other Act of God. (Your cow flew through my window, who pays?) But even those will rely on consensus views of what constitutes 'reasonable precautions' - views that have been forged over generations and generations. So that will take time.

In the meantime, we should consider new public services to protect society in ways that mere 'good citizens' cannot - like we do with epidemics, fires, and other Acts of God. Staniford, Paxson, Weaver have proposed a CDC of cyberspace. Seems like a very good idea.

Get one of the food patches discussed on here a while ago, and hack it to include some of these.

Instant success. Really. Really you won't die. Oh yeah IAMAD (doctor) or anything. Really, my knowledge of the human body is limited to the parts that give me pain. So try at your own risk :)

A 10baseT patch cable with the TX wires clipped will get you a whole lotta nothing because the TX wires are used for heartbeat signals. You need to corrupt the outgoing frames instead, which is a PITA.

The easier method is to use a 10 Mbit AUI adapter with the TX pins cut. You can probably even find a 10baseT -> AUI adapter at a computer junk shop for a buck or three.

For more about creating a receive-only ethernet adapter check out http://www.robertgraham.com/pubs/sniffing-faq.html #receive-only or read up on Antisniff (weird, I can't find anything about it on @stake's site).

Isn't this what carnivore is already doing?

First of all, the FBI gets a warrant for the DATA. If the ISP is unable to get the DATA themselves, the FBI can then insist that they install the Carnivore box. On the other hand, courts have ruled that if the ISP can indeed get the data, then Carnivore isn't needed.

Second of all, the reason the FBI created Carnivore was because existing tools could not get the data. This encryption device is based upon existing tools, and therefore does not help get the data at all. For example, if the warrant requires the ISP to deliver copies of the suspect's e-mail, this device cannot do it.

Third, people persist in believing that Carnivore is a keyword search engine like the rumored Echelon. This is false: no judge would grant a court order allowing the FBI the ability to search for keywords. (This encryption device is based upon a keyword search engine). A typical court order would be one that allows the FBI to get all e-mail to/from a named e-mail account. Another example would be a lesser court order allowing the FBI to record the e-mail addresses to/from the specified account, but not the contents.

I have written a Carnivore engine that has previously been written up in /. It, and a Carnivore FAQ, is at: http://www.robertgraham.com/altivore/.

One great thing about it is that it is a cross-platform solution. I can use it under WinBlows and linux; both with GnuPG and the same keyring. <grin>

One thing I like the sound of is Herbivore. Putting transparent, seamless and automatic encryption and signing into MUA's is the best solution to problems like Carnivore.

I urge people in light of the recent "demise" of PGP to lend their time & support to projects like Enigmail and Ägypten. Even if all you do is report bugs or make suggestions for improvements you'll help with getting these products ready for non-geek end users.

Come on guys & gals! Pitch in!

Craig.

Random NYTimes login form

The online New York Times site (http://www.nytimes.com) requires registration in order to access the site. However, I keep forgetting my registration information. Therefore, I have created this page to help me re-register. This webpage uses JavaScript to randomly fill in a form with new information.

http://www.robertgraham.com/tools/random-user.html

Found in a basic FAQ about firewalls at www.robertgraham.com:

Q: I've seen many DNS requests from many low port numbers below 1024. Aren't they supposed to be reserved? Aren't they supposed to use 1024-65535 range?
A: These are coming from machines behind NAT firewalls. A NAT doesn't necessarily have the concept of reserved port numbers.

Maybe they only have to examine the DNS packets looking for source ports below 1024?

In order to combat this, the FBI designed their keylogger to go innactive while the modem was connected. I still have some lingering questions about this. E-mail is asynchronous. With many e-mail services (Eudora, Outlook, and AOL), the underlying software lets you compose e-mail offline and store it to disk, automatically transferring it at a later date. Personally, I compose a lot of my e-mail when my computer is offline -- these days, I spend half my time on airplanes, it is when I get the most e-mail written, I sync when I land at the next destination.

Another worrisome trend is that the hearings were "ex parte in camera" -- meaning in the judges private chambers without the presence of defense attornies. The FBI claims the details must remain a secret for national security reasons. The defense attornies are only provided a sanitized summary of the keylogging features, not the full details. This is worrisome because it prevents the public from understanding the details of what is really going on. As we saw in the Carnivore case, the FBI was free to define its own boundaries. For example, when Carnivore grabs e-mail summaries, I would interpret the court order as allowing capture of only the SMTP "envelope" containing the TO/FROM addresses -- the FBI interprets this as capturing the full e-mail headers. I think this is a gross violation of civil liberties, but there is no way to challenge this. Likewise, the keylogger details may show similar gross violations of civil liberties, but the FBI hides behind its cloak of "national security".

The thing is, there are no important details to keylogging. You can go to http://www.keyghost.com for your own hardware-based keylogger, or you can download numerous keyloggers off the Internet. There are some difficult problems. For example, PGP 6.0 introduced a keyboard driver that intercepts your keystrokes: when you type your password, this driver routes them around Windows. Thus, while it appears that you are typing in a dialog box, this is only an illusion. Standard software keyloggers for Windows will not capture the passwords. (This is why PGP 6 doesn't work well with Win2k -- it doesn't have the power management features, so it prevents Win2k from going into "suspend/hibernate" mode).

Anyway, I'll be posting some more detailed analysis later this month on my personal website. In addition, I'm providing a $10,000 bounty for anybody PC containing an "interesting" keylogger -- maybe one from the mafia doing industrial espionage, maybe one from the FBI, I don't care. I'll be posting the full details to my website (http://www.robertgraham.com).

You may find it boring, but here are some of my cyberanarchy papers: http://www.robertgraham.com/cyberanarchy/. I put a lot of work into the speaker notes for this presentation.

Check out the FAQ at http://www.robertgraham.com/pubs/firewall-seen.htm l. It explanes a lot of the detritus that washes up on the shores of firewalls.

grab it here http://www.robertgraham.com/altivore/

Source compiles on Windows and Linux, binaries available, works with libpcap, can respond back to a range of addressses.

BTW, this technique has been used since the early-1990s (i.e. I wrote a plugin for the ProTools sniffer that did something like this).

As a more casual defense, I've written stuff that causes the worm to hang in its receive function: http://robertgraham.com/tools/deredoc. It's kind fun, I've got hundreds of worm threads waiting for me to respond back to them.

You can create benign anti-worms. You can setup a worm to only counterattack when attacked itself. Such a worm would not bother innocents, and would only spread to infected systems, cleaning as it went. In other words, it wouldn't be 'scanning' -- it only responds upstream to infected systems. There are two problems to that approach: the first is that CodeRedII self-DoS itself, so the systems cannot be exploited, either with the .ida attack or the backdoor. The second problem is that a heck of a lot of these systems are behind firewalls, and you cannot directly contact them on port 80 (CodeRedII has been extremely effective about worming its way around firewalls).

You can evade legal constraints. Post the source of your anti-worm to Usenet as an example how an anti-worm is constructed. This is legal free-speech -- as long as you don't encourage others to run it.

CodeRedII is raging inside corporations. It would be extremely ethical to put something on your own machine to help stop it. One example would be a script (CGI, PERL, PHP, ASP) named /default.ida on your system that did something like "/scripts/root.exe?/c+net+stop+w3svc" back at the attacker.

There are a vast number of differences between ASN.1 and XML. To think that ASN.1 is in any way related to XML demonstrates that they just don't "get it".

1. Why not XDR or just raw binary?
Why not just specify your own binary format for you application? The thing that the ASN.1 bigots don't understand is that in most real-world applications, the ASN.1 formatting provides only overhead but no realworld value. This happens in XML, too, but the value proposition for XML is much clearer. A good example is the H.323 series PER encoding which is just plain wrong: well-documented custom encoding would have been tons better.

2. DTD or no DTD
The ASN.1 language is essentially a DTD; it gets encoded in things like BER. The trick is that I can parse "well-formed" XML content without knowing the DTD. This is impossible with current ASN.1 encoding. The idea of DTD-free "well-formed" input and DTD-based "valid" input is at the core of XML. Yes, both ASN.1 and XML both format data, but proposing ASN.1 as being a valid substitute means you just don't grok what XML is all about

3. Interoperability
The Internet grew up in an environment that parsers should be liberal in what they receive. This was important in early interoperability, but now is a detriment. For example, it is impossible to write an interoperable HTML parser. XML took the radical zen approach of mandating that any parser that excepts malformed input is BAD. As a result, anybody writing an parser knows the input will be well-formed. There is one-and-only-one way to represent input (barring whitespace), so writing parsers is easy. ASN.1 has taken the opposite approach, there are a zillion ways to represent input.

As a result, non-interoperable ASN.1 implementations abound. For example, most SNMP implementations are incompatible. They work only "most" of the time. Go to a standard SNMP MIB repository and you'll find that the same MIB must be published multiple times to handle different ASN.1 compilers.

The long and the short of it is that ASN.1 implementations today are extremely incompatible with each other, whereas XML libraries have proving to extremely interoperable. Right now, XML has proven the MOST interoperable way to format data, and ASN.1 has proven to be the LEAST.

4. Bugs
Most XML parsers have proven to be robust, most ASN.1 parsers have proven to be buggy. You can DoS a lot of devices today by carefully crafting malformed SNMP BER packets.

5. Security
You can leverage ASN.1's multiple encodings to hack. For example, my SideStep program shows how to play with SNMP and evade network intrusion detection systems: http://robertgraham.com/tmp/sidestep.html At the same time, ASN.1 parsers are riddled with buffer-overflows.

Anyway, sorry for ranting. I think XML advocates are a little overzealous (watch carefully your possessions or some XMLite will come along and encode it), but ASN.1 is just plain wrong. The rumor is that somebody through it together as a sample to point out problems, but it was accidentally standardized. It is riddled with problems, it should be abandoned. An encoding system is rarely needed, but if you need one, pick XDR for gosh sakes.

It was a case of IP spoofing against Shimomura. While he couldn't see results (IP spoof after all) the ability to guess ISN's allowed him to play the role of one of the computers involved in the transaction.

Not my original source, but it does make mention of the story

Check here for other commonly trojan'ed ports.

Sunrpc is remote procedure call, which is a VERY DANGEROUS service to leave open. It is used primarily for NFS(Network Failure^H^H^H^H^H^H^ile System)and NIS(Network Information System), which is basically the same as windows file shares. Usually you don't have NFS mounts available by default, but on some systems you might. Yes you should learn about IP chains. Here is a great site that will custom-build you a firewall on the fly. Firewall Forensics is also a great page to find out what port scans are looking for. Be careful, I see quite a few scans for RPC in my logs, if you leave it open, you will be comprimised sooner or later.


Enigma

If you can't differentiate between a ping request and a portscan, maybe you need to read up a little on TCP/IP. Here is a great place to start: The firewall forensics page It is chock-full of commonly scanned ports (and tasty goodness!).


Enigma

I've documented similar experiences at: http://www.robertgraham.com/pub s/firewall-pr0n.html

• (does this sort of low-tech communication still have a place in today's espionage?)

IANASA, but there's an infinite number of covert channels available via the internet that would allow for instant communication that's almost undetectable, so I don't know why they wouldn't use something in meatspace that's slow and more detectable.

I agree that anyone who is knowledgeable and wants to remain undetected can probably do so. My warning wasn't addressed to the hackers/crackers out there (who, after all, don't need me to tell them about the dangers) but rather those who out of curiosity might run out and install this software on their work machine running, for example, Win98. If their network administrator suddenly notices that they're sniffing the local net, there're are going to be some questions asked. And legitimately so. There a are a number of ways, some easier to implement than others, to tell when there's a packet sniffer on your net. For a list, take a look here (scroll down to 2.5 - "How can I detect a packet sniffer?").

A great resource that I refer to alot:
Sniffing (network wiretap, sniffer) FAQ

There was a recent post on regarding security courses. The poster was kind enough to reply back to the list with a list of responses to his question. I've included some of that list below.. my hands hurt from typing all day, so I don't feel like typing out the rest. Maybe I will tomorrow..

http://www.isc2.org/
http://www.brainbench.com/
http://www.robertgraham.com/
http://www.r00tabega.com/
http://www.sans.org/
http://www.csc.com/
http://www.ey.com
http://www.securityfocus.com/
http://astalavista.box.sk/
http://neworder.box.sk/
http://blacksun.box.sk/tutorials.html
http://www.prosofttraining.com/

Don Head
Linux Mentor

It seems that you just tossed out the most outrageous things you could think of, and are amused that people read more into it than is there. But, can you cite any philosophical influences of your work? Zen? Nietsche?

No. Here is a good explanation.

Some good links on the sublect:

http://www.robertgraham.com/pubs/network-intrusion -detection.html#11

http://www.sans.org/newlook/resources/IDFAQ/ID_FAQ .htm

No. Here is a good explanation.

Some good links on the sublect:

http://www.robertgraham.com/pubs/network-intrusion -detection.html#11

http://www.sans.org/newlook/resources/IDFAQ/ID_FAQ .htm

The confusion stems from ESR's guide. He insists that the proper word for cybercriminal is "cracker", not "hacker". This is true in the geek community, but it is not true in either the general community or the security community. In the security community, the word "crack" has specific connontations about breaking passwords and/or copyright restrictions.

Journalists who use the word "hacker" to refer to the recent DDoS attacks gets flames from nerds insisting that they use "cracker". When they use "cracker", they get flames from security people who tell them what an idiot they are for using the wrong word since no passwords were cracked in these attacks. Most journalists I know try "cracker" a few times before they get sick of the complaints from the security other side. They also realize that their audience (the general population) just doesn't understand the word cracker as well as hacker.

I only post this because I'm tired of religious wars on the "meaning" of words. Words don't have any particular meaning; there is only what people understand when they hear a word. By creating a dictionary that defines a word contrary to how most people use it, ESR is perpetuating a religious war.

One might want to consider this alternate definition of "hacker".

You should check out the IDS FAQ. It has tones of easy to understand, but technical information. The site has a bunch of other infosec information.

You should check out the IDS FAQ. It has tones of easy to understand, but technical information. The site has a bunch of other infosec information.

You should check out the IDS FAQ. It has tones of easy to understand, but technical information. The site has a bunch of other infosec information.

First of all, there already is a wiretapping standard called RMON. In particular, RMONv2 provides most of what law enforcement would want. RMON allows filtered packet capture, so it would be easy to configure the system to filter for a specific IP address and shunt it over to a buffer. One could easily monitor dialups this way. RMONv2 allows for fairly efficient monitoring (in its alMatrixTable) of source-destination address pairs along with an identification of the protocol (Something Japan requires, and which could easily be used to track down hackers who attempt to bounce attacks through chains of machines designed to conseal the true source).

A non-RMON solution would presumably copy packets destined to a certain IP address to be copied to another location. Presumably, this would entail simply encapsulating the IP packet inside another and shipping it off to FBI headquarters.

It seems interesting that most /.ers are against it. It seems that natural geek paranoia is winning out over geek superiority. I generally would support it, simply because I use encryption, but I know that stupid people don't. Stupid criminals really annoy me, and such constraints have no effect on ubergeeks who use encryption anyway.

Finally, there is a really good FAQ on the technology of wiretapping at: http://www.robertgraham.com/pubs /sniffing-faq.html. The information in this document could help you wiretap your own network and spy on your neighbors, though of course such activity is completely illegal and I would never encourage it.

Network IDS FAQ
This document explains how network intrusion detection systems works and how to use them.

firewall-seen FAQ
This document answers the age old question "I'm seeing XXXX on my firewall, what does it mean?". It also applies to intrusion detection system, it describes today's most common attacks, why the attacker is doing them, and which ones may be false-positives.

Sniffing/wiretap FAQ
Describes how "sniffing/wiretap/eavesdropping" works, which is the technology that IDS is base upon. Also describes how to analyze packets in detail, because when you get attacked, you NEED to be able to pull out a protocol analyzer and look at the attack.

Network IDS FAQ
This document explains how network intrusion detection systems works and how to use them.

firewall-seen FAQ
This document answers the age old question "I'm seeing XXXX on my firewall, what does it mean?". It also applies to intrusion detection system, it describes today's most common attacks, why the attacker is doing them, and which ones may be false-positives.

Sniffing/wiretap FAQ
Describes how "sniffing/wiretap/eavesdropping" works, which is the technology that IDS is base upon. Also describes how to analyze packets in detail, because when you get attacked, you NEED to be able to pull out a protocol analyzer and look at the attack.

Network IDS FAQ
This document explains how network intrusion detection systems works and how to use them.

firewall-seen FAQ
This document answers the age old question "I'm seeing XXXX on my firewall, what does it mean?". It also applies to intrusion detection system, it describes today's most common attacks, why the attacker is doing them, and which ones may be false-positives.

Sniffing/wiretap FAQ
Describes how "sniffing/wiretap/eavesdropping" works, which is the technology that IDS is base upon. Also describes how to analyze packets in detail, because when you get attacked, you NEED to be able to pull out a protocol analyzer and look at the attack.

The upshot is that it looks like most people won't/can't encrypt their data so that we can walk around with notebooks sniffing everyone else's connections. There are several companies building Internet-connected base-stations in airports charging connect-time to surf the web (I just got back from Atlanta which had one). Instead of paying them, you can have fund sniffing what everyone else is doing.

I'm not sure what other people feel is the philosophical basis for taxation. It seems to me perfect taxes are basically usage taxes: what you pay exactly matches the benefit you get. For example, rich people should probably pay for for police protection because they have more to lose in a theft. Another philosophical basis might be to "adjust" society to be more like one would we like to live in (i.e. we don't like others around us to suffer in poverty). Combining those two mean we'd prefer gasoline taxes to toll roads, for example (we don't want usage toll booths every mile, and gasoline taxes approximate the benefit AND encourage lower pollution etc.).

For example, if I go to the local store and buy something, the local government probably has the right to levy a sales tax. It maintains the roads I use, it provides police protection, etc. However, when I buy from the Internet, the local government is much less involved. Does my city or state government have the right to tax transactions at the same rate as before? (BTW, the federal government is much more involved, i.e. tracking hacking, fraud, and the lot, but they don't see the money).

Currently, taxes are pretty much a blunt instrument. In the above example, much of what I pay for in the sales tax isn't related to the transaction, but the theory is that it "correlates". Richer people benefit from government services such as fire protection on more expensive homes, and they tend to buy more. Therefore, we think it ok to charge a "fee" for the transaction even though the "benefit" as nothing to do with the transaction.

From this perspective, the government currently subsidizes Internet transactions. The FBI tracks down credit card fraud, which effectively lowers your credit card fees, but you don't pay for that protection. Likewise, shipping your books from Amazon.com creates wear-and-tear on the roads, but you don't pay for that.

Personally, I like the idea of a tax-free Internet zone precisely because taxes across International borders gets difficult. For example, the company I work for sells a $39.95 product that we've sold over the net to Europe, Canada, Asia, South America, etc. We simply cannot handle a country-by-country tax problem. It would cost much more than $39.95 to sell a single copy to Venezuela, for example. Direct Internet taxation will stifle lots of business activity.

As a consequence, I'd like to search for other ways to indirectly tax Internet transactions. A fuel tax springs to mind (which I like for other reasons) to tax shipments. A credit-card tax would also be a good thing (since the government is already subsidizing credit card transactions anyway). In other words, rather than stifle all the small businesses which aren't equiped to deal with the taxes, why not shift the burden onto the big companies that can?

Anyway, those are my thoughts.

A lot of posters to Slashdot have the same qualities :-) A lot of it is simple "maturity", younger people rarely have it, but usually think they do. Another part of it is understanding a concept from another person's point of view, which few geeks are willing to do.

Business reasons are often like peacock feathers: utterly stupid and wasteful from any logical perspective, yet somehow evolution seems to favor them. Businesses that survive do things in a "business" manner. Geeks in a business environment are always telling management how stupid they are for putting such big feathers on a peacock, when better solutions exist. And geeks know they are absolutely right, thus the problem.

Marc was simply one of those geeks (making assumptions by extrapolating from my own experience). BTW, so were Steve Jobs and Bill Gates. Jobs got pushed out of Apple for much the same reasons. In Jobs' case, he conflicted with management until he was pushed out. It wasn't an issue if Jobs was right or wrong, only that his geekness made him incompatible with those who ran the company. However, once geeks like Jobs and Gates start running the place, they actually prove that their non-business-practices have merit.

The problem for geeks/nerds everywhere is that business is much like the military: to become a leader, you have to prove that you are a good follower, even those two skills aren't directly related. For geeks to get into a position of power (in order to implement the ideas that they know are right), they have to stop being so difficult and arrogant, even when it is obvious that management are idiots.

Of course, OpenSource often does an end-run around business, but it doesn't mean you'll get the $$$ or the babes going that route :-)

The whole process gives a whole new dimension to e-mail and general communication, with this posting as an example. I've started to think and communicate in hypertext.

The whole process gives a whole new dimension to e-mail and general communication, with this posting as an example. I've started to think and communicate in hypertext.

Most people put a copyright notice on their work that also states that any copy must contain the copyright notice. This what I do on my documents (example: http:// www.robertgraham.com/pubs/network-intrusion-detect ion.html#copyright).

I go futher and track my document. I put a 1-bit GIF file embedded in my document that links back to my server. This tracks people who simply mirror the document through the Referer field.

Then, I put interesting spelling and wording in the document. This allows me to track the document via AltaVista and other search engines.

The philosophical standpoint here is that any document you create is the start of a meme. I use these techniques to shepard my meme through the web. From this perspective, the Copyright notice is important for works that you want to be essentially in the public domain: it still gives you control over the basic process.

...expecting accuracy and facts and stuff. Another poster put up an article with some analysis.


Now I'm going to spend all night reading flames from people who were smart enough to skip the article. :)

The buffer overflow is only run on WIN32 clients.

The clients tell the server what version they are long before the server sends the buffer overflow packet. Microsoft chooses to emulate the WIN32 client because it has a lot more features than other clients.

To verify, take a sniffer and capture a trace file of the connection sequence. Only when connecting with the v2 Win32 client will you see this particular packet contents being sent.

Read the technical analysis at http://www.robertgraham.com/pubs/aol-e xploit

The full geeky explanation is at http://www.robertgraham.com/pubs/aol-e xploit. Basically, in one of the login packets, AOL sends more data than the client expects, causing the buffer overflow, which then changes some of the values in response packet.

Yes, it is a buffer-overflow exploit. The article had a factual error in it. The server sends more data than the client expects; a field 0x0100 bytes long is sent 0x0118 bytes of data. To read the original technical analysis, go to http://www.robertgraham.com/pubs/aol-e xploit.