Flaw Leaves Internet Open To Attacks

Flaw Leaves Internet Open to Attacks

A security researcher has developed a new attack for a well-known flaw in the TCP protocol that allows an attacker to effectively shut down targeted routers and terminate existing TCP sessions at will. The scenario has many security experts worried, given the ubiquity of TCP and the fact that there's an attack tool already circulating on the Interne

The basic problem lies in the fact that existing TCP sessions can be reset by sending specially crafted RST (reset) or Syn (synchronization) packets to either of the machines involved in the session. This is in fact an intended feature of the protocol. However, the source IP addresses on these packets can be forged, which makes it possible for attackers not involved in the TCP session to terminate the connection, causing a de facto denial of service.

eWeek

Major Internet flaw fixed

Government and industry experts secretly raced in recent weeks to stave off potential worldwide computer disruptions from a serious security flaw that left core Internet technology vulnerable to hacker attacks.

Experts said the flaw, disclosed yesterday by the British government, affects the underlying technology for nearly all Internet traffic. Left unaddressed, they said, it could allow hackers to knock computers offline and broadly disrupt traffic-directing devices, called routers, that coordinate the flow of data among groups of computers.

Exploitation of this vulnerability could have affected the glue that holds the Internet together,'' said Roger Cumming, director for England's National Infrastructure Security Coordination Centre.

Waltham-based Guardent Inc. discovered it was possible to exploit the flaw three years ago, said Charles Kaplan, information security officer at the Providence office of VeriSign Inc., which bought Guardent in February.

But Milwaukee computer researcher Paul Tony Watson found a way to efficiently exploit the flaw, Kaplan said. Watson plans to describe it at a conference in Vancouver tomorrow.

Kaplan said the flaw shouldn't cause widespread disruptions of the Internet because large Internet service providers took steps last week to prevent such attacks.

By exploiting the flaw in the Internet's tranmission control protocol,' or TCP, hackers can trick computers into ending electronic conversations by sending the equivalent of goodbye messages and resetting the connections.

Chris Bailey, senior vice president at GeoTrust Inc. in Wellesley, said if the flaw was easy to exploit, hackers would already have taken advantage of it.

It would be difficult, but it's definitely doable, Bailey said. "Although it could be a problem, it hasn't been a problem as of yet.''

He said hackers will most likely target big companies with ``denial of service'' attacks.

Everything is open. :lol:

Including you! ;)