Researcher's Death Hampers TCP Flaw Fix 147
linuxwrangler writes "Security researcher Jack Louis, who had discovered several serious security flaws in TCP software was killed in a fire on the ides of March, dealing a blow to efforts to repair the problem. Although he kept good notes and had communicated with a number of vendors, he died before fixes could be created and prior to completing research on a number of additional vulnerabilities. Much of the work has been taken over by Louis' friend and long-time colleague Robert E. Lee. The flaws have been around for a long time and would allow a low-bandwidth 'sockstress' attack to knock large machines off the net."
Accidental Death? (Score:4, Funny)
Or was he silenced?
Re: (Score:1)
Re: (Score:2)
He was killed in a fire. Clearly his research led him to discover that TCP had a back door, created by fire Daemons who live on the Sun, due to jealousy over *BSDgirls' net-wide successes.
Re: (Score:2)
http://wigen.net/data/bsdmascots/ [wigen.net]
Re: (Score:2)
Geez (Score:2)
Re:Geez (Score:5, Funny)
Sincerely,
a smug Yankee.
But... (Score:5, Funny)
Re: (Score:2)
Re: (Score:2)
But they don't call it the Civil War, rather "The War of Northern Aggression," which apparently was fought for "States Rights."
Re: (Score:1)
Re: (Score:2)
T-shirt idea:
"Rebel Condoms - Because the South shall rise again." printed around a condom package with a rebel flag on it.
Re: (Score:3, Funny)
Re: (Score:1, Funny)
As opposed to the American uncivil war?
Re: (Score:2, Funny)
woooooooooosh! (Score:3, Insightful)
n/t
Re: (Score:2)
Both sides were Americans, that's why we call it the American Civil War.
It wasn't very civil. And we lost. The president used it as a way to usurp power from the states beyond question.
Re: (Score:1, Insightful)
... such as the right to own slaves.
Re: (Score:2)
... such as the right to own slaves.
Slavery would have ended on its own. It was on the way out in other major countries, and mechanization would've rendered slaves impractical by 1900.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
And now an appropriate response from a poem of that era, slightly modified to be relevant here.
Whoosh to right of them,
Whoosh to left of them,
Whoosh in front of them
Volley'd and whoosh'd.
Re: (Score:2)
I blame the CSA (Score:5, Funny)
Much of the work has been taken over by Louis' friend and long-time colleague Robert E. Lee.
Clearly this was the result of a conspiracy by veterans of the civil war. I hope the other researchers, Grant and Lincoln, hear about this.
Re: (Score:2)
Robert E. Lee (Score:2)
Re: (Score:2)
Robert E. Lee (Score:5, Insightful)
Was it necessary to refer to his colleague as Robert E. Lee? Now we're going to get a ton of "South will rise again" jokes.
Re: (Score:1)
Re: (Score:1)
But we've heard nothing of them since it happened (except for a few "coming soon" posts in the week or two afterwards), and now
Re: (Score:2, Informative)
I knew jack pretty well, this flaw is legit. Robert E. Lee (aka jrl) was in fact his partner, but in many people's opinions, he rode jack's successes.
This story is really very sad, jacks passing was something that happened in the middle of the night with no warning, he was in the prime of his life and a VERY bright guy.
Robert E Lee is a real name by the way.
Re: (Score:2)
Says right in the summary...
Re: (Score:2)
Re: (Score:2)
AS if saying "The South will rise again." isn't a big enough joke.
Re: (Score:2)
Now we're going to get a ton of "South will rise again" jokes.
I hope they do rise again. This time we'll let them go.
-- Another Smug Yankee
Re: (Score:2)
Me too.
I'll go with whichever side doesn't take Washington DC.
Now who gets to be smug? ;)
Re: (Score:2)
Robert E. Lee? Now we're going to get a ton of "South will rise again" jokes.
Sir, this is Slashdot. The only way you'll get any rise in the south is with hot grits.
Dang low bus factors! (Score:5, Interesting)
Original /. story (Score:3, Informative)
New Denial-of-Service Attack Is a Killer [slashdot.org] (01 October 2008)
Re: (Score:2)
Still waiting for it to kill something ...
Re: (Score:2)
The one person who was going to fix the flaw was killed under mysterious circumstances. COINCIDENCE? I THINK NOT!! :P
Its been around for a while (Score:1)
Beware the Ides of March! (Score:2, Funny)
Suspect is a guy name Brutus, last seen wearing a plain white bedsheet.
Now you know... (Score:1, Funny)
It's not a joke when you tell someone to DIAF on the Internet. What if someone told him that before he died? Think of how guilty they'd feel now!
What the fuck (Score:5, Insightful)
My high regard for the Slashdot community is obviously misguided.
It's a great loss for the research community and my condolences go to his family. And really, that's a nasty way to go...
Re:What the fuck (Score:5, Funny)
High regard for the Slashdot community? Wow, dude, you seriously are misguided.
Re: (Score:2, Insightful)
I see history repeat it self as it happened with Digg, the only difference - Digg started from level which slashdot is currently at.
I think it might be a good time for me too look for new web 2.0 news source which has for instance some kind of IQ level discrimination. Or drop this unproductive habit of
Re: (Score:2)
PS/2? That machine sucked!
Re: (Score:1)
"I see history repeat it self as it happened with Digg, "
Digg wasn't the first time either. Long ago, there was usenet, then the endless summer when the idiots showed up. Slashdot reached the endless summer long ago, and now it's just getting stupider.
Re: (Score:2)
It wasn't endless summer, it was eternal September. As in the month when students got their first computer and decided to let the Internet know that they knew nothing.
Re: (Score:2)
I think a lot of the unfunny jokes and trolls and "first posts" are from actual children, and perhaps some mentally ill adults in the mix. Seriously who else would think some of the crap they write is funny or even worth the effort to write. It looks like the Internet has replaced the TV as the "universal babysitter." All of the "think of the children" idiots say we should censor the Internet, but really we should keep the children off the Internet. It wasn't built for them.
If I ever get my forum going, I
Re: (Score:2)
Web 2.0? With IQ? Sorry, lost cause.
Re: (Score:2)
Re: (Score:2)
Whoring out for +1 Funny Mods... (Score:2)
Comment whoring for +1 funny mods is like pimping out your girlfriend for monopoly money.
Re: (Score:2)
Re: (Score:2, Interesting)
On the utter downside, we all seem to be losing bright minds. We lost Hans Reiser [wired.com], Rick752 [slashdot.org], PCLinuxOS lost N1PTT (Robert Green) [pclinuxos.com] just to name a few more.
It just goes to show you how fragile life really is. Some chose to celebrate it with us other geeks and share some code and what not. I thank you all that do!
Shitty year
Re:What the fuck (Score:5, Insightful)
150,000 strangers died today. Picking 5 of them and feeling bad about it is awful damn close to insanity.
Re: (Score:1)
Re:What the fuck (Score:4, Insightful)
People react in different ways to news like this. There's nothing wrong with making jokes, especially since a lot of us had no idea who he was.
200 posts of "my condolonces" doesn't make for interesting reading.
Re: (Score:3, Insightful)
Re: (Score:2)
What's sad is the fact that +1 funny has no effect on karma at all.
Re: (Score:2)
Shit, that came out wrong. I meant to say that it's sad that people whore for karma that they won't even get, and do so regarding something so serious. I agree with the (now) GP, really a shame.
Re: (Score:3, Funny)
What, like RST in peace?
Re: (Score:2)
Technically, you can't call it whoring. Sleeping around, maybe.
Because getting Moderated Funny doesn't increase your Karma.
From the FAQ [slashdot.org]
Note that being moderated Funny doesn't help your karma. You have to be smart, not just a smart-ass
Re: (Score:2)
Did yelling at other people make you feel like a better person?
Could you help me out (Score:1)
Re: (Score:2)
There is over a million people, cowards and bots here, do you really believe that they are a community?
Re:What the fuck (Score:5, Funny)
But it worked for Jesus!
Actually, Jesus came back from the dead for the sole purpose of taking his revenge out on all those lamoids who kept shouting out "Hey Jesus, how's it hangin'?" while he was up there on the cross. He spent most of his time between the resurrection and his final ascension into Heaven giving out wedgies and telling people to "stop hitting themselves".
Of course, much of that has been lost in the various translations of the Gospels.
Here's the guy... (Score:5, Informative)
Well, everyone's having a good laugh at the expense of the death of this guy. May as well laugh at a picture of him. [unicornscan.org]
Re: (Score:2)
Is that him on the right or the left?
Re: (Score:1)
Naptha all over again (Score:4, Informative)
This problem was demonstrated in 2000, with the NAPTHA software and its demonstration that the problem is not academic. Yes, before NAPTHA, there was some software that could demonstrate the issue but this software had issues itself (written in perl, kept state) which limited its effectiveness. SockStress is just NAPTHA revisited.
I have a fix for this problem, but there's not enough room in the margin to describe it.
Re: (Score:2)
Can you guarantee that the fix will be rolled out to everyone at the same time?
Because this just seems like it's going to cause chaos once it is reverse engineered.
See: Conficker [wikipedia.org] which is attacking the estimated 30% of unpatched Windows PCs
At some point, something epic is going to happen and we'll end up with:
A. OSes take away your control over updates, or
B. ISPs take away your access unless you are updated
Then again, there's also the remote possibility that windows/linux will become resistant to remote and
Re: (Score:3, Informative)
Can you guarantee that the fix will be rolled out to everyone at the same time?
The fix has already been rolled out long ago.
Do you know what the fix is? Source address level filtering [www.cert.fi]. It's that simple.
This attack is less of a threat than SYN flooding attacks, because the attacker's address can't be spoofed. More information from Fyodor [insecure.org].
Re: (Score:3, Insightful)
Source address level filtering does provide some level of protection against a SYN flood. The problem is, it is not universally implemented. Another problem is someone who doesn't care to hide their address. If you are doing more than a SYN flood, but more advanced TCP hijinx, you need to use your read IP address anyhow. So, it's not much of a fix. Neither is the recommendations which came out back in 2000, which was to increase the resource limits that the operating system imposed upon the IP stack. I coul
Re: (Score:3, Interesting)
Source address level filtering does provide some level of protection against a SYN flood.
My point was that this attack has to use a valid IP, because it needs to create a connection. It is therefore easier to block than a SYN flood, which could spoof any address or groups of addresses.
The problem is, it is not universally implemented.
That's news to me. Which commercial firewall hardware does not have this ability?
Another problem is someone who doesn't care to hide their address. If you are doing more than a SYN flood, but more advanced TCP hijinx, you need to use your read IP address anyhow. So, it's not much of a fix.
That's exactly what this attack entails. The attacker has to use their real address with this, so it's easier to block them at the firewall. You might have a problem with your bandwidth, but you'd have that same exact problem rega
Re:Naptha all over again (Score:4, Interesting)
My fix is on the server side. It does not require changes in the stack code of clients who would connect to it. Reverse-engineering it would gain the attackers nothing. An all-or-nothing fix would not be much of a fix. Neither would one which was successful based upon its obscurity.
I am not telling you what it is because I am hoping that Microsoft will pay me some money to give them access to it. Apple as well (and Sun if they're still around). Once these are secured, I will open the invention to the FOSOSs. (Free Open Source Operating Systems). Call me greedy if you want, but I am tired of researching security and not getting paid for my hard work. That's why you haven't seen me by this handle or my real name posting security advisories for some time.
Died in a fire (Score:3, Funny)
You would think someone like that would have a firewall.
Re: (Score:2)
You assume he was on the other side of the firewall....
Re: (Score:2)
Firewalls won't protect against internal breach. The killer must be someone in the inner circle and familiar with his work (and vulnerabilities).
Re: (Score:2)
It's a shame. (Score:2)
Re: (Score:3, Insightful)
I would imagine any death where you're aware that you're dying (i.e. not dying in your sleep or getting shot in the back of the head) is horrible.
Honestly, what would you prefer? Being eaten alive? Drowning? Cancer? Airplane crash? Being hit by a car? Being stabbed? etc.
Death sucks regardless of the circumstance, imho.
Re: (Score:2)
Re: (Score:2)
but if, and only if, he was wearing clean underwear.
Re: (Score:2)
The article says that he died of smoke inhalation. I'm sure that isn't fun, but it is not nearly as painful as burning to death. Fortunately, many fire victims actually die of smoke inhalation/lack of oxygen rather than from burns.
Re: (Score:1)
there's going to be such a delay in fixing the TCP/IP issue
Yeah, the real nasty part is it isn't a TCP issue really.
Forcing anomalies in session behavior causes the receiving system to dedicate resources to recovery tracking, and in host systems built by the insufficiently professional those resources are limited, provisioned to handle ~plausible~ loads.
These guys say they got Windows to bork itself so hard a reboot wouldn't fix it. Different OS's are apparently vulnerable to different attacks — Windows, Linux and OS X all have different vulnerability sets
Or since you have IPTables... (Score:1)
Quote of the moment (Score:1)
If all else fails, immortality can always be assured by spectacular error. -- John Kenneth Galbraith
Aren't there any solid details yet? (Score:2)
Why is it that every description of this problem that I've read so far does not present a problem.
The sockstresss.com itself provides a horrible description of it in the front page. All it appears to do is open up multiple tcp sockets.
Apparently the source IPs are not spoofed, thus the syn cookies are not at play, so how can it not hit a max connections per source IP? Any tcp service worth didley must use that in some form or the other.
If someone has some (f)actual information about this, please, provide a
Re:Come on... (Score:4, Insightful)
Screw off you insensitive clod.
Re: (Score:1)
The Ides of March
Colleague "Robert E Lee"
Low bandwidth attack that can take down large servers?
I suppose we should all beware the Ides of March. Et tu, Bruce Schneier, et tu?
Re: (Score:2)
The attack is very real.
Re: (Score:2)
Meh. According to the link, Sockstress is simply making lots of completed TCP connections to the target. The "sneaky trick" is apparently just doing it raw, so the client OS doesn't waste memory tracking them.
Re: (Score:2)
I don't think this is about how simple it is, but how hard it is to fix it, because that is the real problem. If people only need a simple DSL to DOS a server, this is bad news. Obviously, you can limit per IP, but DDOS also becomes much easier this way.
So that's why I think it's very real, more real than say the whole BGP-security stuff. Yes it does happen and the impact might be big, but there are some fixes. But this might be a lot harder to fix.
Re: (Score:1)
Still condolences to his family.
Re: (Score:3, Funny)
Idiot. The correct grammar is:
He should have beworn the Ides of March.
Re: (Score:2)
More likely it was Shermen
Re: (Score:2)
TCP isn't a specification either. Has there ever been a clean-room implementation of Internet Protocols? I doubt a working implementation could be created based solely on RFC's.