Slashdot Mirror
New Windows Attack Can Disable Firewall
BobB writes to tell us NetworkWorld is reporting that new code released on Sunday could allow a fully patched Windows XP PC's personal firewall to be disabled via a malicious data packet. The exploit depends on the use of Microsoft's Internet Connection Service. From the article: "The attacker could send a malicious data packet to another PC using ICS that would cause the service to terminate. Because this service is connected to the Windows firewall, this packet would also cause the firewall to stop working, said Tyler Reguly, a research engineer at nCircle Network Security Inc."
Sure, it requires that you be on the internal LAN already, and that you be running ICS, and who runs ICS anyway? But what kind of shit design is this that lets you take down the firewall if you piss off the IP-masquerading software? Did someone cut their fuzz-testing budget? What's their excuse for having this kind of vulnerability?
Laws do not persuade just because they threaten. --Seneca
If the graphics applications you use require windows, and all of the major firewall vendors are bloated (symantec), worthless (keiro) or both (macaffee) then what can you do?
What those engineers were thinking? A data package, the thing a firewall is filtering to some point, can disable the firewall? Who thought it would be a nice feature to have that?
"We need a firewall of our own!""Why?"
"To keep our monopoly; those firewall and antivirus companies are making money that should be in our pockets."
"But antitrust..?"
"We say it's because we want to have a secure system, it should've been in the first place. Those companies have no case! >:D"
"But even we cannot access their systems anymore without logging our activity on our massive 'slave-farm'."
"We'll add a backdoor, so we can remotely disable it. Noone will ever find it >:)"
"Excellent..."
So for this attack to work, according to the article...
1) The attacker has to be on the LAN already, or executing code from a PC on the LAN
2) The LAN has to be connected to the internet through a PC using ICS, and
3) There can be no external firewall device such as a router sitting between the LAN and the internet
While this is certainly a valid attack... so are a lot of other attacks once you're already in the LAN. This one just happens to nuke a software-based firewall from the inside. Big deal.
-David
When they advertise that XP installations come with a firewall, they in fact mean that XP installations come installed with a wall of fire. The EULA clearly states that, somewhere near the bottom next to the pictures of cats and the sudoku puzzles, because no-one ever reads that far...
Task Mangler
Please see here:
http://isc.sans.org/diary.php?storyid=1809
MS Cluster Service will not work without ICS running, it is used for internal NAT handling.
So the problem is much more widespread than small LANs using ICS.
In theory, yes. But you'd need to reboot the OS into some kind of diagnostics otherwise you're asking the OS to attest to itself - and if it's been trojaned, you can't trust the OS because the first thing any sensible trojan will do is cover its own tracks.
In practise, if you want a 100% guarantee that any malware has been eradicated, the only solution is a rebuild.
You've most probably been been buying crap routers. D-link, Belkin, Linksys, Netgear - for chuff's sake, they might as well be branded "Barbie (or Action Man) My First Router". Treat yourself to a nice ZyXel router, and you might forget you even have a router in your network.
Je fume. Tu fumes. Nous fûmes!
Why did that annoy you?
Why does Windows get all the press? It's not fair! I want to see some coverage of stupid holes in Linux and the free BSDs!
Please correct me if I got my facts wrong.
Yep.
My old gateway with two 3com 3c905 and FreeBSD laughs at the measly bit torrent connections I throw at it. Before I set that up a few years ago, I had similar experiences with consumer grade networking gear.
I don't always use unix-like operating systems; but when I do, I prefer FreeBSD.
What makes you believe that a (home) router, which is a small microcontroller with some dedicated firmware running on it, will outperform a modern PC that has 10-20 times more CPU power available?
Actually, he's probably partly referring to the routers flooding their wireless connection which happens with Zyxel routers too./ index.html?chart=124
http://www.tomsnetworking.com/lans_routers/charts
You set up a p2p like bittorrent that is willing to use a lot of simulataneous connections and it floods your router and your connection drops.
Of course, it does sound like a lot of routers(1 a month?) to go through so if he's returning a lot of dead routers, a possible power problem in the home is possible.
according to this sans article the DOS attacks comes from outside.
If i understand it is with a corrupted DNS reply packet.
Eliza? That you?
AT&ROFLMAO
So I see dozens of comments about "Its no big deal, you have to be on the lan". Am I the only one that hasn't forgotten how common wireless networks are and how trivial it is to gain access to most of them?
The only change I can believe in is what I find in my couch cushions.
It's better to be the foot on the boot than the face on the pavement. ~~ tkx Kadin2048
I have a Linksys WRT54GL router (http://en.wikipedia.org/wiki/WRT54GL). It uplinks via 36-54mbit (depending on conditions) wireless connection, and acts as a router for a network of ~10 computers with quite heavy p2p traffic. It is stable and rarely slows down. Of course, I run a custom linux firmware on top of it (HyperWRT Thibor, original firmware sucks quite bad).
Oh, and it cost me ~70 USD.
--Coder
Because you can't meaningfully implement NAT on a single-machine "network"?
Justice is the sheep getting arrested while an impartial judge declares the vote void.
The smaller ZyXel routers use a traditional transformer power pack with 12V AC output. Judging by the temperature rise, the on-board regulator is most probably a switched-mode type. I'd guess this would be quite tolerant of power surges, just with the presence of a mains transformer (hefty inductance; doesn't like rapidly-changing current). The "surge suppressor coils" found in cheap, switched-mode power packs are laughable. A well-designed power supply should fail safely and protect the connected equipment, but cheap ones often aren't well-designed.
As for the wireless stuff, well, that's too bad. But your computer already needs one connection to the wall to get its power. Will one more for data kill you?
Je fume. Tu fumes. Nous fûmes!
As for the wireless stuff, well, that's too bad. But your computer already needs one connection to the wall to get its power. Will one more for data kill you?
No, but my girlfriend nearly did when I started laying bright yellow cat5 cable in the house...
It's official. Most of you are morons.