Vista's TCP/IP Promises and Perils

boyko.at.netqos tips us to a new writeup on Vista's TCP/IP stack, which is called Compound TCP/IP (CTCP). From the article: "...security policy will come from a centralized source. When you get your DHCP lease, your computer will report to the stack what OS you're using, what version level, what patches, what anti-virus software that's active — all that kind of stuff. It will have the ability to restrict your network access if you have a down-level machine... We could see a lot of our customers with much higher WAN network utilization because of this new TCP/IP stack... CTCP can be enabled/disabled from the command prompt but there has been no mention of tuning parameters which leads us to ask the question: How are you supposed to configure this setting in Vista?... What worries us... is that Microsoft is basing this on packet round trip time. The round-trip time from the client-side will have the server processing time in it; but the clients aren't likely going to be the running the CTCP at first. If you have a server-to-server backup running, for example, CTCP may think its part of the round-trip time and it'll throw the delay window through the roof..."

Sure, ask the client

When you get your DHCP lease, your computer will report to the stack what OS you're using, what version level, what patches, what anti-virus software that's active -- all that kind of stuff. It will have the ability to restrict your network access if you have a down-level machine

So my trojan will be reporting values honored by the DHCP servers. This system is still relying on the information sent by the (possibly infected) machine, so it is not secure in any way.

Re:Sure, ask the client

I think the idea here is to cut off net access for an unpatched machine so it doesn't get infected in the first place.

So, assuming you are not a huge corporate customer, how exactly *do* you get updates at this point?

Why build it into the stack?

I don't get it. If you're just going to be querying the OS for information about its configuration (antivirus, patch state, version level, etc.) why don't you just implement it at a higher level? I don't see any reason to bury this sort of stuff down in the network stack. It could just as easily run as an application-level service rather than being built in down on the transport level. (And in fact I know of systems which do this sort of thing running as userspace tools.)

The goal here seems to just be a way to allow corporate networks like WANs to restrict access based on the version of Windows that's running and the security software being implemented on the client. Setting aside how a rootkit would just fake the responses (and I don't believe for a second that there won't be rootkits for Vista once it gets mainstream), why does this have to be in the network stack? It could be easily implemented as part of the higher-level networking services like WINS or Active Directory, as a requirement before the user is allowed access to particular network resources.

This whole concept seems rather flawed, unless there's some large part of it that I'm missing, and it just seems like it's going to require other OSes to rewrite their perfectly good TCP/IP stacks in order to inter-operate with Windows networks. Maybe that's the whole point?

Re:Why build it into the stack?

Thats exactly the point. It's a bastardization of the TCP/IP standard by M$. They want everything to operate to the M$ standard not the approved W3C/ISO standards. Which means that if someone implements an opensource version then M$ sues them. This should be a Security Service that runs in the background and annoys the user that they may be using an "insecure" connection.

The first time the CEO can't get his email because his laptop wasn't patched to the right level all hell will break loose and this will be turned off.

It's also insecure as hell, someone could write a virus that does nothing but shut off this checking and then erases itself. Then you got a lot of time spent by the Help Desk and/or Techs trying to figure out why no one can connect! And unless the techs are ultra sharp about how the "new" TCP/IP stack operates they are going to be really puzzled and frustrated.

Re:Why build it into the stack?

There shouldn't be. The DHCP specification explicitly allows you to embed arbitrary information in the request, and a server can filter based on any of this information. The 'options' field of the DHCP request (known as 'vendor extensions' in BOOTP, on which DHCP is based) is provided for this exact purpose. There's also nothing stopping an open source DHCP client from populating these fields saying 'I am a fully patched Windows machine,' or, indeed stopping an unpatched Windows machine doing the same thing, making it somewhat useless.

Linux

What about when ISPs need this "CTCP" and your running linux, will it kick you or, will linux once more, added some code to the TCP/IP Stack to send some bogus CTCP repely

Article summary

Article summary:

We haven't used Vista.
We haven't tested the features we're talking about.
We think they're actually probably very good.
We don't know (and nor does anyone) because we haven't tested them.
They could be bad.
They could do nasty stuff to your networks.
But we don't know because we haven't tested anything.
Sounds good in theory though.
And all the MS guys that have ever wrote about it say it works.
We don't think it'll work perfectly first time.
But we don't know because we haven't tested anything at all in any way.
We advise others to test before they make any decision.

Good article. (That was sarcasm. At least I think it was but I haven't tested it myself yet).

Re:Article summary

I read some interesting stuff that came out of Microsoft research a while ago. They worked out an algorithm for scanning the structure of an ethernet network. Every Vista box on the network will participate in scanning the ethernet topology periodically, using spoofed MAC addresses. This process can determine the logical structure of the hubs, switches and wireless networks that are between machines. Using methods like this it will be perfectly reasonable for each machine on the network to know the total bandwidth that is available. Some further reading on the new QOS features in Vista also suggests this information can be fed back into applications to allow them to change codecs or otherwise notify the user of networking issues that may be degrading application performance.

Altogether these are some very interesting concepts, and I hope that they pan out in practice. (I too haven't tested any of this myself).

Promising...

But, alas, falls short of implementing the "Evil Bit."

the whole point...

apart from providing some "security" measures, is to lock Linux out of the corporate network. As soon as a Longhorn server goes into a network, then Linux boxes will have all sorts of problems. And there won't be any way to legally get around it as Microsoft will have all the required patents to wave in the faces of anyone who attempts to do so.

Re:the whole point...could happen

... until the Linux `dhcpcd` starts faking answers. Which will be Zero-day. A bigger problem will be when the servers does encoded challenge/response ala "Trecherous Computing". As an adjudged monopolist, MS will have be be enjoined from invoking the DMCA.

I love ...

... complex things especially when they plan to be very cumbersome, slow, error prone and possibly non working.
Many thanks to the big brains in Redmond!

What the load of misinformation

I haven't read TFA, but based on blurb it will be horrible.

Compound TCP is not a TCP/IP stack! It's congestion avoidance/recovery algorithm for TCP streams. It's one of many (Vega, Reno, BIC, CUBIC etc. etc.). It's also available for Linux (but was removed from standard kernel some time ago).

Other things mentioned are parts of Network Access Control, which is already deployed in many companies. There are many software and hardware solutions available, Vista isn't special. It becoming must-have in corporate environment, praising Vista for having it is like claiming that DHCP client in OS is innovation.

Re:What the load of misinformation

1. Didn't even read the article

  I was commenting blurb, not article itself.

2. What does the design of the tcp/ip stack in any other OS have anything to do with this?

Compund TCP is not stack design. It's one of congestion algorithms for TCP.

It will have the ability to restrict your network

"It will have the ability to restrict your network access if you have a down-level machine."

Ehm... and who decides what is a down-level machine?

Re:It will have the ability to restrict your netwo

The network admins. Won't apply patches? You don't get network access. Won't run AV software? You don't get network access. Infected with known malware? You lose network access until it's cleaned up.

Or you could go with the paranoid conspiracy theory and assume that MS will shoot themselves in the foot by trying to close out competing OSes at the network level; that would be the slashdot way, after all.

Microsoft security man...

which is called Compound TCP/IP (CTCP). From the article: "...security policy will come from a centralized source.

Yeah, trust a blind man to invent a new pencil...

Stream of conciousness babblling?

Is it just me, or does this article sound like random babbling? Nowhere did I see any explanation of what CTCP is, what it does, how it does it, or why it's a good or bad thing. Instead there's lots of uninformed speculation. Apparently it has something to do with bigger TCP windows and/or better or throttled thruput. But we end up more mystified than when we came in.

Key phrase: "restrict your network access"

"It will have the ability to restrict your network access if you have a down-level machine..."

Translation: "You WILL upgrade all of your machines to Vista, or Microsoft will artificially degrade their performance." It's called "market development."

Those M$ asshats are actually going to try to sell this as a NAC feature, when it's nothing but another license fee grab. Piss on them: I'm still running several totally stable, bullet-proof web servers on NT4 with 128Mb (albeit behind a good firewall), and I have neither the need nor the intention to "upgrade" them anytime soon (or ever, for that matter).

obligatory abbreviation joke

CTCP is also a portion of the core IRC protocol, which was a goofy way to extend command set.

/CTCP ACTION slaps Microsoft around with a large trout.

I can see a niche for a benign rootkit here...

Specifically, something to tell the CTCP stack that you're running the very latest version of everything, so that you don't get penalized by other nodes.

Of course, that would be bad news for everyone else on the network, if in fact your old, unpatched OS (which you are reporting as new and patched to avoid having to upgrade to Vista 2.5.9.396) _is_ infected. But then, that's part of the problem with including features that work AGAINST the person buying/using them.

To sum up: malicious/hijacked computers will report that everything's OK. Computers controlled by savvy users who don't want hassle will report that everything's OK. Computers that really have nothing interesting about them will report that everything's OK. There'll be a thin band of computers that really do have old OS versions but that nobody cares about enough to doctor -- these will report that everything's not OK, until they become an issue and are considered a painful extra cost of MS-based networks. The remaining 90% of all computers will have this feature disabled, thus saving all the bother at a very very low cost in security.

It's not that this feature is evil, it just comes from the wrong mindset. I think MS's misconception that it's good to start from the question 'how can we restrict or coerce customers', rather than 'how can we empower and help customers', is likely to prove permanent.

damn microsoft

They're always engineering crappy half-solutions that are worse than nothing at all, and always involve using more resources and sending out more personal information.

When are they gonna engineer something properly? If nearly every open-source/linux programmer can do it, why can't Microsoft?

Trojan'd Box? What about hacked DHCP Server?

People keep saying that your trojan'd box could report false information, but what about a rooted DHCP server (like in a coffee shop, or any area with free WIFI)? You computer would be telling an unknown system its exact patch level. Screw brute force attacks, it would know exactly where you're vulnerable. didn't microsoft learn anything about offering too much information?

Raises questions

"It will have the ability to restrict your network access if you have a down-level machine."

That raises some questions. Does this mean that the stack itself on the system in question will place some kind of access restriction? Are they trying to wedge this into layer 4? Have they devised some kind of MS client-server extension to DHCP that sends a data structure to a server which in turn pushes a policy out to the stack? Or is this intended to be part of an 802.1x based scheme?

less than half the story

DHCP embrace-and-extend (MS patent) to OS/pl/sw reporting isn't entirely stupid, however, the smarts will have to be in gateway/proxy machines that will have to recognize the extended DHCP requests and reconfigure their routers appropriately.

One big problem is that few of these gateways are MS-Windows machines. Most are Criscos that get fried up by the heavy traffic :) I doubt an x86 box could service a full-speed OC-3 if the table look-ups get extensive.

TCP/IP stack embrace and extend?

Microsoft is famous for its "Embrace and Extend" philosophy of locking people into their products by corrupting open standards. This looks to be the same thing once again.

I have to admit, it's been a while since I've read the TCP/IP protocol specs, but I don't remember there being any provisions for communicating things like OS type, version, or patch lists over the TCP/IP headers.

This brings up a major compatibility question as to how this is going to work with routers, linux servers, printers, and other devices on a network who either don't know about CTCP or don't give a shit about CTCP. This scheme also seems to be extremely vunerable to spoofing.

If M$ would spend half as much effort in securing their OS as they do coming up with these hare-brained schemes, then we wouldn't need such contrived solutions to security.

Wait there is malware for Windows?

[A]ssuming malware doesn't turn this feature against the user somehow.

[sarcasm] Because features of an application or operating system (not just MS based applications/OSes) have never been used to write malware before. [/sarcasm]

On the plus side, this is a nice smoking gun, when something goes wrong just blame the TCP/IP implementation.

Okay so on to my point. For the home user, CTCP is disabled by default. I don't anticipate many home users will turn this feature on. For the corporate user it is enabled by default. I can see the DISA/NSA/NIST or any other security STIG indicating the first step after installing is to turn off CTCP. It's kind of like any other feature, if you don't need it turn it off! I can't see anyone that uses SMS, WSUS, or any other good patch management program needing this from a security standpoint (no comment on speed issue as I am not an expert in TCP/IP, nor do I know all the details about how CTCP works). Maybe for laptops but that is a stretch. Unless there is something beyond patching that this could benefit.

Any word on what happens for backward compatibility? What if my brand spanking new VISTA box wants to pull down content over TCP that is hosted on a *nix/*BSD box that doesn't implement this CTCP. I'd hope the handshake defaults to something they can both use....

Asking the Google for more info...

I discover NAC/NAP. Network Admission Control and Network Access Protection. While the idea is noble, its going to be costly (for customers) to implement in mixed networks. They also don't discuss non PC network clients (Printers, Scanners, hand held etc). Even worse (see below), your going to have to pay for a 3rd party network stack for Windows 2000.

White paper here: http://download.microsoft.com/download/d/0/8/d08df 717-d752-4fa2-a77a-ab29f0b29266/NAC-NAP_Whitepaper .pdf [microsoft.com]

Interesting chat transcript here: http://www.microsoft.com/technet/community/chats/t rans/network/06_0914_tn_network.mspx [microsoft.com]

From the transcript:

Q: NAP seems to fulfill the pre-admission health/integrity check very well. Can customers use the same NAP infrastructure to support post-admission NAC? e.g. with NAP today I can check a desktop PC is healthy when it joins, but what about 24 hours later?
A: Post-admission enforcement depends on the enforcement mechanism you're using. For instance, health will be re-evaluated when a client attempts to renew their IP address when using DHCP as the enforcement mechanism. For IPSec, it will happen when health certs expire. For 802.1x, it will happen when re-authentication occurs. For VPN, it will happen when clients reconnect. Any health change on the client will trigger re-evaluation of the health state, too.

Q: What is the likelihood of a NAP agent for Windows 2000 clients in the network?
A: We are not planning to implement a Windows 2000 NAP client. However, we are licensing our protocols to 3rd party companies so that they can offer NAP clients on Windows 2000 (and other OS's like Mac, Linux, etc.)


Enjoy,

What I can't figure out

is while I see a lot of verbiage in the terms of "asume", "think" and "suspect" that hard facts are left out. Maybe it is just that silly engineer notion I have to do a repro on an issue and get some real-to-life metrics before I cry wolf and make an ASS out of U and ME.

Better Existing Alternatives

CTCP is like that 'finger' protocol. Useless, alone. You eventually get poked from and into unexpected places.

To all home, business and corporate admins, you want control? Of which PC can connect to your LAN? Complete with OS versioning and all?
Best existing methods are in combo:

1. IEEE [wikipedia.org] 802.1X [ieee802.org] (wlan_supplicant) [linux.com]
2. VLAN [wikipedia.org] (IEEE 802.1Q)
3. IPSec (various IEEE RFCs [wikipedia.org])
4. THEN finger protocol

These options gives LAN administrator absolute power to allow which PC can join their own precious LAN or not.

Every protocol "enhancement" that came out of Redmond has been demonstrably disruptive and rarely beneficial to the general network community (i.e., evil bit in MIT Kerberos), not to mention, highly inefficient. This stems largely because Microsoft repeatedly failed to engage or brusquely abuse the power of various standards community without proper and sufficient in-depth review of the professional network standard community.

Vinton Cerf said it best.

"Be liberal in what you receive and conservative in what you send."

Use the standard, Luke.

Not all patches are for security

Some MS patches are made to add hard DRM (WMP10) or police liscenses (GenuineAdvantage) and maybe there are some other tinfoil-needy reasons.

MS and the next-gen DVD consortium for that matter treat the customer as a potential criminal and require the ability to disable functionality in whole or in part. In other words, "security" to these people, including Microsoft, means keeping things secured against the user.

As a real security scheme it looks quite weak and vulnerable. But engineering a way to get user's machines to spy on them and report not only compliance with security policies but also use of arbitrary applications seems quite useful both for pushing OS upgrades and conversions to Windows down people's throats and for providing ammo to content liscensing organizations. Vista will be able to tell centralized servers who you are, whether you comply with some policy, and whether you can withstand an arbitrary network attack. Doesn't sound too secure to me. Wonder how SuSE will "interoperate" with this.

Easy fix

CTCP can be enabled/disabled from the command prompt

So then no worries, right? The first virus I get will surely disable CTCP for me, no sweat...

What if your not using DHCP?

Disclaimer: I have not RTFA, nor do I know all the fields of a DHCP request by heart.

From what I've read in the summary and comments if the system doesn't use DHCP,ie IP address of a machine is hard set, then this latest stunt by m$ won't do anything.

I could see a virus/trojan that sniffs some packets, determins the class and range of addresses used by a network and then picks one that will work, Hell I worked out an app that did this sort of thing years ago and I am a mediocre programmer at best, so it won't be too hard for a l337 programmer to automate it for a trojan.

It's Controlled by Longhorn's NAP

Network Access Protection - http://www.microsoft.com/technet/network/nap/defau lt.mspx which will leave some options open after researching it a bit.

Same as Cisco, Symantec, etc

There's nothing to see here really. MS is competing with something similar from Cisco, Symantec, McAfee, etc.

There are bound to be lots of problems. They escalate like so...

...the traveling salesman who hasn't updated in 6 months.

...the vp who restored his system with a 6 month old backup.

...the founder who just wants to surf the web during a board meeting.

Eventually they get poked with holes and become nothing more then background noise

I guess linux doesn't have this problem because everyone keeps their boxen up to date. But then there aren't any security problems with linux anyways, so really you don't even need to do that. If it's true for linux then it must be doubly true for mac. Har dee har har... I crack myself up.

Why a special TCP?

Why don't they just use TCP/IP fingerprinting as available in security packages like say NMap? It has been around for years (I've used it since NT 3) and works perfectly for what you want. So if the patch level changes the TCP/IP fingerprint or it embeds it in the DHCP request, we don't have to mess around with special software written to only run for Windows and screw the users/servers having Mac, Linux and other OS'es.

Vista users..

Will be pulling their hair out when they try to mooch wifi from my hacked router. No matter what they do it will say they are unpatched

Netreg

I've seen this before....http://netreg.sourceforge.net/ [sourceforge.net]

My university uses a custom netreg implementation that checks for patches and antivirus before it lets you on the network. Sounds a lot like this. I love innovation.

Really bad idea.

A virus gets on to the network and thinks, "Hmm, who should I try to attack next." Suddenly, a broadcast, "Hey, everyone! I'm running Vista version XYZ. You know, the one that came out before that big vulnerability patch? Yeah, if someone were to try to infect me, no need to waste time with technique B since I still have security flaw A from before that patch came out." Virus says, "Thanks for the tip," infects the machine, tells it to shut up about needing patches. Administrator comes by and looks at the setting reported by the network. "Hmm, looks like they're up-to-date. Good. Now it's safe for me to let my guard down."

Seriously, there is no chance of this helping security at all and a strong chance that it will set security back.

Quarantainenet

...is not a typo, but a Dutch company that offers solutions that claim to do the same thing Microsoft does with regard to detecting and quarantining (potentially) compromised hosts, except it's not limited to just windoze boxes. I'm not affiliated with them, but I know for a fact that the quarantining is being thoroughly stress-tested in the field at Twente University, where some 12,000 hosts are under continuous attack from the 'net (mainly due to their fat pipe to it).

Link: Quarantainenet [quarantainenet.nl]

Already done better by others.

If it's conjestion etc control, QoS and back-offs ought to fit the bill. If it's having a "jail" network, several vendors do that too. Also, it's called a VLAN stupid.

Jury's still out, but none of the features discussed seem worth a crap. Just more icing on a mostly icing cake..err cupcake.

I think this also renders a 30fps 1024x768 MPEG 4 video stream of bells and whistles to a non-existant loopback UDP listener...to keep the processor warm, also implements the little known while(1); algorithm.

People might prefer that.

Admittedly though, I think part of this is market-driven. Partially because people have just accepted that "Windows way" is just how computers in general are supposed to work, a lot of home users are frustrated with computers and would probably readily accept 'applianceized' computing.

A significant percentage of users only want a 'content delivery box' for their computer. That's what they use it for; that and as a game machine. Most people don't really use their computer for anything that wouldn't be provided as part of a Microsoft Communication Machine that would only run signed code and play DRMed media.

Not saying it's a good thing, but people bitch about their cable boxes far less often than they bitch about their computers, in my experience.