Slashdot Mirror
Microsoft Patches 1990s-Era 'Ping of Death'
CWmike writes "Microsoft on Tuesday issued 13 security updates that patched 22 vulnerabilities in Internet Explorer, Windows, Office and other software, including one that harked back two decades to something dubbed 'Ping of Death.' While other patched vulnerabilities we more serious, one marked 'CVE-2011-1871' brought back memories for nCircle's Andrew Storms. 'This looks like the Ping of Death from the early-to-mid 1990s,' he said. 'Then, when a specially-crafted ping request was sent to a host, it caused the Windows PC to blue screen, and then reboot.' Two decades ago, the Ping of Death (YouTube video demonstration) was used to bring down Windows PCs remotely, often as a way to show the instability of the operating system."
better late then never!
newton62 (56617) Karma: Bad
Just FYI, the POD doesn't affect any modern OSes. It used to bring down Windows NT (and earlier), early linux kernels, as well as Mac OS 7 back in the day.
The ping of death didnt cause your computer to blue screen, it caused it to become a picture frame. Everything, including the mouse pointer, would just stop.
Monstar L
When I used to host LAN parties after the DoS attacks became well publicized, we'd all start out playing the game nicely, be it Warcraft II or Quake or whatnot, but when someone would feel they were wronged (how one would be wronged in a game with fairly inflexible rules I still don't understand) or were doing far worse than everyone else, they'd quit and start attacking whoever they felt deserved it.
I started running Warcraft II under MS-DOS only, using DOS networking with only IPX, so that I couldn't be knocked out, but friends who chose to run it under Windows disappeared from the game frequently.
As for Quake, if I didn't set up a dedicated server on the Linux box then I'd host it, so they'd usually leave me alone. I guess my friends were altruistic enough to not try to take the whole game down, just the player they took exception to...
Do not look into laser with remaining eye.
If your friend was on dialup why not just do the ++ATH0 ping? Oh the fun I had with that.
NO CARRIER
When the copyright term is "forever minus a day", live every day like it's the last.
You could run WC2 with IPX under Windows as well.. shouldn't be affected by the issue
I remember a few variations.
One, of course, was ping -f from a sufficiently fast pipe (or just an equally-slow pipe with better buffer management). I had a custom REXX script under OS/2 which took a username as input, and would finger each of the terminal servers of a local ISP, derive the IP address of that user, then issue a ping -f for that particular dialup user.
It would cause their PPP sessions to timeout, at which point they'd disconnect. And it was fun, because I actually knew the people who I was disconnecting.
Tougher (or farther) targets at other hosts would get a ping -f from a blistering-fast (hah!) shared FreeBSD machine with a T1 connection. If -f didn't do it alone, increasing the packet size always did. Sometimes, it seemed that different packet sizes (not just larger ones) would make it happen sooner.
Around the same time, it was discovered (not by me) that sending an ICMP ping packet containing "+++ATH0" would instantly disconnect any user with a cheap modem by very neatly instructing their modem to do exactly that.
This worked because Hayes (rest their souls) had a patent on requiring a one second delay between +++ (aka "enter command mode") and any subsequent commands (ATH0 hangs up the modem). Makers of cheap modems wanted to pay as few royalties as possible, and they got their wish.
On most premium modems, or most old modems, it wasn't a problem, since it was required to have a delay between "+++" and any other command. But during the early winmodem days, it was a blast: Those cheap modems instantly dropped to command mode, and immediately executed anything after that.
You tell it to hang up, and that's just what it does.
It wasn't even really necessary to use ATH0, either: any old AT command would work, and would leave the modem in command mode instead of data mode. +++ATLM2L3, for instance, would result in a lot of noise from the modem speaker until their session timed out...
The ATH0 trick could be accomplished with IRCII using /ctcp [target] PING +++ATH0 or more generally with ping -p 2B2B2B41544829 [target IP or hostname] from a suitable *nix host.
It was fun being a kid back then, with OS-agnostic ways to be annoying. (I've grown up just slightly since then...)
Kid-proof tablet..
The bug exists in Windows Vista, Server 2008, Windows 7 and Server 2008 R2, Microsoft said, but not in Windows XP or Server 2003.
My favorite of them all ... /topic #l33t Press Alt + F4 for Ops.
There are actually a lot of "Windows Kiddies" on IRC. Not a majority by far, but still some. I was surprised that a libSDL channel I recently got into was almost all Windows folks.
By my estimation, in my experience (freenode and efnet), most people on IRC are running some form of older-school Linux distribution, such as Debian or Slackware. There are some Ubuntu peeps but I think a lot of them use something more 'modern', i.e. skype or pidgin. I see BSD folks in my BSD channels, but they only barely edge out the Windows guys overall.
Now that USENET has gone down the shitter, I still enjoy IRC, and will continue to do so until it goes away.
do() || do_not();
It really didn't do much unless your bombing your buddies dialup server, and thus tying up your dialup line. I guess it could be slightly annoying if you could get a shit ton of people to do it today.
I don't know what you are talking about, but it certainly isn't the ping of death. Maybe ping flooding? I personally wrote the patch for a now long defunct unix variant which fixed the actual "Ping of Death" vulnerability.
The way it worked was to send a ping with a 65536 byte payload - technically out of spec for the ICMP protocol by about 30 bytes in length. Since it was out of spec, most IP stacks were written with the assumption that it could never happen. But when it did happen, you got a buffer overflow that would usually panic the OS immediately. At the time, almost every OS on the net was vulnerable even the guys who didn't have BSD-derived stacks like MS Windows.
So all it took was one single oversized-sized icmp ping to crash just about any computer on the net. Imagine being able to take down all of google's internet presence with just a few thousand packets. Of course, at the time, there was no google.
When information is power, privacy is freedom.
Since Windows XP SP2 I think it was the firewall is turned on by default(or at least really really encourages you to do so) and blocks ping responses and was released August 25, 2004.
So all it took was one single oversized-sized icmp ping to crash just about any computer on the net. Imagine being able to take down all of google's internet presence with just a few thousand packets. Of course, at the time, there was no google.
Technically, you needn't send the whole thing. You couldn't send the whole thing, anyways, as there are limits on the size of an IP packet. You sent the packet in IP fragments. You needn't even send all of the fragments. Merely sending the last fragment, the one that overflowed the IP packet size.
Also, IIRC, it wasn't 65536. It was bigger. Maximal size was ~65506+your MTU (which was never less than 536, and was often 1500) which caused the overflow. 65536 total size is still okay (or is it 65535?)
Shachar
Doesn't work if it's Hayes-compliant, because of the guard timer after +++. They needed a crappy out-of-spec (usually win)modem for that, and some people had them, but just being on dialup didn't guarantee it.
at 127.0.0.1 they'll find out it's armored beyond anything they can come up with
Technically, you needn't send the whole thing. You couldn't send the whole thing, anyways, as there are limits on the size of an IP packet. You sent the packet in IP fragments. You needn't even send all of the fragments. Merely sending the last fragment, the one that overflowed the IP packet size.
Yeah, it was really just convenience to use ping since anyone could run it and most OSes would happily do the illegal fragmentation for you.
When information is power, privacy is freedom.
[...] (how one would be wronged in a game with fairly inflexible rules I still don't understand) [...]
Well, there are a lot of games out there that have various flaws that can be exploited to your advantage which is generally considered to be something you don't do outside of a strictly competitive environment. Then there are "house rules" (one I remember fondly was playing various RTS games 2v2 on maps that had one or more rivers crossing the map with a stated rule that no one was allowed to cross the river within the first n minutes of the game, really cut down on the number of games that just turned into tank/zerg rush wins in a few minutes) that aren't coded into the game but which are agreed upon by the participants (and there's always that one ass who sends half a dozen tanks and a couple of APCs loaded with engineers across the river a little early).
Greylisting is to SMTP as NAT is to IPv4
At first, I read that as Microsoft patents "Ping of Death". And it didn't surprise me.
Who would win this election: Andrew Weiner vs Andrew Weiner's weiner.
The Ping of Death had nothing to do with bandwidth flooding, it was a packet that would instantly just crash Windows as is quite clearly mentioned in the summary. It wouldn't matter if you were on a 14.4 modem, or a 1gbps pipe. It'd still crash vulnerable versions of Windows straight away.
I've never seen someping so delightfully evil.
Be relentless!
That was actually one of the early patent problems. Hayes wanted a significant royalty to implement the guard timer.
It works even better if you provide 127.1.37.8 as your ip address! Some people start to recognize 127.0.0.1 :)
Had I only known......;-)
The pure, unadulterated anarchy, and beautiful chaos of this mentality(in regards to the AT commands) is absolutely stunning and awesome.
Really. (no sarcasm intended)
*apply sarcasm/maybe offtopic, also
Thanks to you, I now have the proper incentive to continue research and development on on my iTIME Traveler® software for your iPhone! (soon coming to an APP Store near you!)
Depending on various IP lawsuits, my be also soon ported to Android and Win 7 mobile, or none of the above, including IOSx... YMMV.
Down With Slashdot BETA!!! I've been around the corner and seen the oliphant; you can only abuse me from your perspecti
Really?
That won't ever work unless your friend was using some brain damaged modem.
Maybe Computers will never be as intelligent as Humans.
For sure they won't ever become so stupid. [VR-1988]
Wow!
What a revelation for me.
I say this as a former n00b-troll.
I will say that this 'lesson gave to me' in my ms- spent[sic] [1]youth had a profound positive influence on my internet behavior, except when i 'drink while posting' here on /., sad to say.
Again, wow.
Thanks very much, BTW, really.
[1] Some habits are hard to break. ;-)
As my wife has said about me many times, "At least he's house-broke, but he's not domesticated. But, I've never shopped at 'Normal-Boys-R-Us'. Ever!"
Down With Slashdot BETA!!! I've been around the corner and seen the oliphant; you can only abuse me from your perspecti
The main difference being that when the Ping 'o Death became public knowledge, patches were available for all the free OSes... I read about it on BUGTRAQ, tested it against random Linux boxes in my office, then had every public-facing system patched and re-tested before lunch (which, those days, was about 50 minutes after I made it to the office).
The POD was one of the first incidents where the suits I worked with started looking at this open source model as maybe being a bit more than just something to "explore" to keep the geeks amused.
Log in or piss off.
Brain damaged == Any modem under $50
I miss the olden times. I can't remember how many times I sent that to friends to fuck with them.
I am Bennett Haselton! I am Bennett Haselton!
There used to be a Macintosh Application called WIN-NUKE, and we'd use it to crash NT-based web-servers. I think this was during the days of NT3.5, and Macs were still running System 7.1 or something like that.
Anyhow, we were a Mac/Linux shop at the time, and during the dot-com boom, there was this dopey company called "muffinhead", we thought that was a dumb name, so we'd win-nuke them constantly.
We'd ping them from the linux box, see a continuous stream of replies, run win-nuke, and then... the pings would stop, and we'd know they were down.
Back in the early days of the web, you could easily take down half your competition in New York if you were interested enough in doing that. Generally though, my company had enough work that we weren't all that interested - that is, until the boom went bust, and then we were hunting for scraps of work like everyone else.
If telephones are outlawed, then only outlaws will have telephones.
I used to run Quake and Doom on Linux for the same reason...
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
clearly in the summary that also states "something called the ping of death" what they are calling the ping of death isnt the ping of death on the other side of the country, and it didnt have much to do with bandwidth flooding it was about dumping so much shit into their system at once it would crack and possibly give you an entry vector, but it was worthless a decade ago cause post 486 days you had enough horsepower to just chew through it
And when ping of death got fixed, we just found that other vulnerability in the IP fragmentation stack, when sending two forged IP packets fragmented to be just larger than the MTU when reassembled, all hells were loose. Worked on pretty much anything this one...
Pingflooding dialup users was like shooting ducks in a barrel.
Personally, I loved messing with my friends by echoing TTY control codes into their (heh) world-writable dev/tty file. If you wanted to be a dick, you could just pipe a binary file into it, which basically made their session unusable, but it was much more fun to change their font or temporarily blank their screen.
Xwindows games were fun, too. Very little security back in the day meant you could play audio files to come out of their speakers (always fun to play embarassing songs when they're near other people) or launch xv with a photo of Mike Tyson biting off an ear when they're chatting up a girl. Xscreensaver was always fun to launch, too, on someone else's session.
By my estimation, in my experience (freenode and efnet), most people on IRC are running some form of older-school Linux distribution, such as Debian or Slackware. There are some Ubuntu peeps but I think a lot of them use something more 'modern', i.e. skype or pidgin. I see BSD folks in my BSD channels, but they only barely edge out the Windows guys overall.
I'll go with that. I'm one of the few folks left who still uses IRC, and I used Slackware until very recently... I am afraid I have moved to the dark side; using MacOS on the desktop. I think if there are hackers on IRC who still use windows, most of them are at least smart enough to use an *ix-based proxy, such as BNC.
As a long time DALnet user; I can't say too much about Freenode/Efnet. But I have not observed many Windows "hackers" anymore. Sure, there are still windows users. Not the types who would engage in PoD competitions.
I use the hyperbole as one of the "5 users left" on IRC, because since I started using IRC on DALnet in early 1995; I have watched the average peak online number of users counts grow well into 130,000+ users, and then in later years drop way back to 15,000. I can't help but mourn that IRC in many respects may be past its prime; i'm afraid networks will slowly erode , as soon as the current generation of IRC server admins retire, and ISPs can no longer be found that want to run IRC servers for free. :-/
I use the hyperbole as one of the "5 users left" on IRC, because since I started using IRC on DALnet in early 1995; I have watched the average peak online number of users counts grow well into 130,000+ users, and then in later years drop way back to 15,000. :-/
I can't help but mourn that IRC in many respects may be past its prime; i'm afraid networks will slowly erode , as soon as the current generation of IRC server admins retire, and ISPs can no longer be found that want to run IRC servers for free.
It's been a few days, but I hope you've come back to read this...
I've used the same "last 5 people on IRC" joke myself. IRC still exists, but I think you're right in that it's slowly dying. I first connected BitchX to efnet in 1998 (on my Caldera OpenLinux system!), and it was an insane, vibrant, dangerous and beautiful experience. I later moved over to freenode but there was still a very active community. I took a break, and have come back to it recently, and all the old channels are 'dead'. Even the channels that have 150+ users in them, they're all lurkers, and all of them are lurking in 49 other channels as well. I used to log 200K of real dialogue in logs on a daily basis, but nowadays you'll get about 20K of system messages and nobody saying anything.
It's sad. I really miss being able to connect with intelligent, like-minded people on such a deep and nerdy level. The infrastructure is still there, but there's no content or people left.
do() || do_not();
Pingflooding dialup users when you, yourself, were on dialup was not always the most trivial thing in the world: Theoretically, I only had a 28.8 or 33.6 upstream, and they the same. It should not have worked at all, but it did at least for Linux and Windows [Trumpet Winsock] users.
I had other OS/2 using friends, back then, and we couldn't really touch eachother...whether with the same ISP, or a different one: Things would get very slow, but not fail. (I did not have the tools or knowledge to sort out this OS-dependent discrepancy back then.)
ANSI / VT100 codes were also fun, on IRC at least, but a clever person would quickly figure out how to restore things to sanity. (Most didn't, but the social aspects of IRC made it have limited utility since I usually liked the channels in which I was abusing folks.)
I never tried dumping stuff into another user's /dev/tty: Though I'm sure it would've been interesting, I really liked the FreeBSD shell account I was using and it had competent admins who I didn't want to give a reason to get rid of me. )
But X, with sound? Dude: It's half-past 2011, and audio with X are still completely different entities, with sound being a complete crapshoot. I don't want to doubt you, so I'll just ask: How did you make that work? Have I missed something in the past 16 years?
Kid-proof tablet..
>>But X, with sound? Dude: It's half-past 2011, and audio with X are still completely different entities, with sound being a complete crapshoot. I don't want to doubt you, so I'll just ask: How did you make that work? Have I missed something in the past 16 years?
This was in a workstation lab, where people are all sshd into a unix host. You do a who, see what host they're on, then you ssh into their individual host, and then xaudio by default will play things right out of their speakers. To launch xwindows apps, you just added the -display 0:0 tag to xv or whatever.
>>I never tried dumping stuff into another user's /dev/tty: Though I'm sure it would've been interesting, I really liked the FreeBSD shell account I was using and it had competent admins who I didn't want to give a reason to get rid of me. )
Yeah, the ttys were traditionally world-writable to enable programs like talk to work. So you could just cat files right into people's ttys, or just type small messages ("I love you" or "}}}" appearing in the middle of their code was always amusing) and they couldn't do anything about it. The sysadmins eventually set things up so that you couldn't just write into a tty directly, but IIRC they made talk suid 0, so if you wanted to piss off your buddy, you could just write a small shell script to constantly spawn talk requests to his console.
My friends and I had a lot of fun in computer labs. Woe unto the person that didn't xlock their console. =)