SI
SI
discoversearch

We've detected that you're using an ad content blocking browser plug-in or feature. Ads provide a critical source of revenue to the continued operation of Silicon Investor.  We ask that you disable ad blocking while on Silicon Investor in the best interests of our community.  If you are not using an ad blocker but are still receiving this message, make sure your browser's tracking protection is set to the 'standard' level.
Technology Stocks : Novell (NOVL) dirt cheap, good buy?

 Public ReplyPrvt ReplyMark as Last ReadFilePrevious 10Next 10PreviousNext  
To: Jim McCormack who wrote (19540)1/12/1998 11:17:00 PM
From: Scott C. Lemon   of 42771
 
Hello Jim,

> Scoop On TCPIP Attacks
>
> These attacks are very easy to do because all of the TCPIP specs
> are detailed in the RFCs.

Yep ... very familiar with the RFCs ... I've reviewed many and have read most of the protocol RFCs. (Yeah ... it's sick but true!)

> If hackers continue to concentrate on them they will in all
> probability continue to think up ways to exploit the "Cooperative"
> nature of network protocols. After all the goal is to connect
> devices - so the protocols are very patient with errors and attempt
> to process the packets. They give out information too freely
> as well in the interest of forging a connection...

It's interesting to follow what the hackers are doing as they learn. Many of the denial-of-service attacks (such as the SYN attack) are based around tying up all the available connections on your server. There are work-arounds for this.

This new class are taking advantage of both the public nature of TCP/IP, and the way that vendors write their code. As Microsoft is finding, a vendor can reduce the overhead in a poorly written TCP/IP stack by minimizing error checking. This increases performance because when a packet arrives, you just trust that "it's a good packet" ... but the attacks are sending purposely corrupt or bad packets at these servers. That's when you see these effects ...

> Get a firewall and implement packet filtering and then remove the
> "Trust" relationships to hosts outside the LAN on the Internet.....

Yep ... BorderManager can do that! ;-)

> A step by step how to "Attack" and how to "Prevent Attacks"
> fc.net

Details on the current attacks is available from:

cert.org

> Enjoy...

Good URL ... I'll have to read the whole thing in more detail, but it looks like a poor man's guide to some IP principles ...

> God I'm bored....

I'm buried! Busy day tomorrow ...

> Jim McCormack

Scott C. Lemon
Report TOU ViolationShare This Post
 Public ReplyPrvt ReplyMark as Last ReadFilePrevious 10Next 10PreviousNext