Re: IPv4 fragmentation --> The Rose Attack

[Darren Reed]

In some mail from Ventsislav Genchev, sie said:
>
> I've tested the attack on 4 machines..
> The first two were running windows 98 SE with all patches and service
> packs... the CPU stuck the 100% as soon as the attack started..
>
> The last two machines were running Fedora Core 1 Linux and RedHat Linux
> 9... no success here... the attack seems not to bother the normal work
> of the PCs... The RedHat Linux uses kernel-2.4.20-30.9...

Is there any real point in testing Windows 9*, still ?
Does anyone care, including Microsoft, enough to want it fixed rather
than get people to upgrade to something that is better when it comes
to security, overall ?

This is approaching 6 years plus in age and has surely got to be in
the "so what" category by now. Similarly, IE4 has dropped off the
things to check and you didn't test with Linux 2.2 or 2.0 or whatever
else is of similar same vintage (not that I would expect any difference in
terms of results).

Greetings and Salutations:

On 4/8/04 1:26 PM, "Darren Reed" <avalon@caligula.anu.edu.au> wrote:
> In some mail from Ventsislav Genchev, sie said:
>>
>> I've tested the attack on 4 machines..
>> The first two were running windows 98 SE with all patches and service
>> packs... the CPU stuck the 100% as soon as the attack started..
>>
> Is there any real point in testing Windows 9*, still ?
> Does anyone care, including Microsoft, enough to want it fixed rather
> than get people to upgrade to something that is better when it comes
> to security, overall ?

From my experience in the real world, specifically with Windows 98 (and I
suspect ME) I would say that yes we should care. You would probably be
frightened at the number of people still running Windows 9* and ME.

With a OS like Linux most people are *PROBABLY* on a newest version, but I
bet you have companies who had a consultant parachute in, set up the Linux
box and then leave. Nobody touches the box because they are afraid to.

Also:
Snort (IDS) does not detect this as an attack. Please note that any Snort
rule should allow for two "small" fragments making a "large" buffer. The
attack I published can easily be modified with different size packets and
the end fragment put in different areas of the fragment (at the end, near
the end, etc.).

If anybody is able to "attack" any other machines please tell me the
results, I am curious. I have come up with the following:
MoDem speeds:
1) Microsoft 2000 - 200 packets in less than 2 minutes completely shuts off
legitimate fragmented packets
2) PIX - 200 packets in less than 5 to 20 seconds completely shuts off
fragmentation

LAN speeds:
1) LINUX running on a 450 MHz (I know, very slow but it is all I had) high
CPU utilization, some missed packets at ?400 Kbits / sec? (I have to run
this test again)
2) Macintosh G4 dual proc - some missed pings starting at about 110 Kbits /
sec (no / very little CPU utilization increase)

Mike from the FreeBSD mailing list has told me that there may or may not be
very much code sharing between the Mac OSX and FreeBSD, so the above tests
may not apply to FreeBSD.

3) Cisco 2621XM router - 20% to 30% utilization at 600KBits / second

There is an article discussing the fragment attack from IDefense that claims
that a Cisco 675 router had to be rebooted !?!??? The article:
http://www.eweek.com/print_article/0...=123491,00.asp

Ken

---------------------------------------------------------------
Do not meddle in the affairs of wizards for they are subtle and
quick to anger.
Ken Hollis - Gandalf The White - gandalf@digital.net - O- TINLC
WWW Page - http://digital.net/~gandalf/
Trace E-Mail forgery - http://digital.net/~gandalf/spamfaq.html
Trolls crossposts - http://digital.net/~gandalf/trollfaq.html

[Darren Reed]

In some mail from gandalf@digital.net, sie said:
>
> Greetings and Salutations:
>
> On 4/8/04 1:26 PM, "Darren Reed" <avalon@caligula.anu.edu.au> wrote:
> > In some mail from Ventsislav Genchev, sie said:
> >>
> >> I've tested the attack on 4 machines..
> >> The first two were running windows 98 SE with all patches and service
> >> packs... the CPU stuck the 100% as soon as the attack started..
> >>
> > Is there any real point in testing Windows 9*, still ?
> > Does anyone care, including Microsoft, enough to want it fixed rather
> > than get people to upgrade to something that is better when it comes
> > to security, overall ?
>
> From my experience in the real world, specifically with Windows 98 (and I
> suspect ME) I would say that yes we should care. You would probably be
> frightened at the number of people still running Windows 9* and ME.

Let me put this in a different light...

Anyone or any corporation that cares about security, reliability of
their sytems, etc, is not going to be using Windows ME/9*, today.

In this particular case, whether someone is running Windows ME/9* is
irrelevant to me - it's a local attack against them that isn't likely
to affect me.

Further, most likely all the people who are still using Windows9*/ME
are not reading this, are not likely to ever hear about whether their
PC is vulnerable or understand it if they read about it in the paper.
Hence automatic updates in 2k/XP/...

> With a OS like Linux most people are *PROBABLY* on a newest version, but I
> bet you have companies who had a consultant parachute in, set up the Linux
> box and then leave. Nobody touches the box because they are afraid to.

This is different to PC installations how ?

Anyone who assumes that people who use/run Linux automatically run the
latest version of anything has their head in the sand. It just doesn't
happen like that for any number of reasons. Just because you or anyone
else in the "open source community" can take the time and make the
effort to keep your software "current" does not necessarily mean that
even a majority do. People have better things to do than reinstall
their desktops, loose all their settings each time, etc, every month
or 6 or 12 months.

Also, there's the problem of Linux in _devices_ where it may not be
possible to upgrade and quite possibly there, invisibly, to the owners
of the hardware. The same is true for examining the BSDs.

> MoDem speeds:
> 1) Microsoft 2000 - 200 packets in less than 2 minutes completely shuts off
> legitimate fragmented packets
> 2) PIX - 200 packets in less than 5 to 20 seconds completely shuts off
> fragmentation

Recovery time or isn't there one ?

There is probably a similar "denial" attack against all firewalls
that keep track, in some manner, of fragments, where this is done
without requiring any active session. Using "scrub" in pf comes
to mind as a "recent" innovation that is likely to be vulnerable
in a similar way to the aforementioned systems because "scrub"
rules that track fragments or do the defragmenting are independant
of the policy rule base (or at least that's how I remember it working.)
To extend it one step further to impact firewalls that require an
existing relationship before doing anything special for fragments,
a good suspect for an attack vehicle might be ICMP echo request
packets.

Unless it crashes the whole system, I don't think it's particularly
interesting as most people try and avoid dealing with frgaments,
these days, using PMTU discovery.

In contrast to other algorithms that try and prevent synflooding
(jamming the listen queue with SYN packets), there's no easy way
out here because the target of the attack is not expected to send
any packets back at the "source". All you can seemingly do is play
around with limits and timeouts and things like that to at best
focus the problem.

Darren

[Darren Reed]

In some mail from gandalf@digital.net, sie said:
>
> On 4/9/04 12:56 PM, "Darren Reed" <avalon@caligula.anu.edu.au> wrote:
>
> > In some mail from gandalf@digital.net, sie said:
> >> From my experience in the real world, specifically with Windows 98 (and I
> >> suspect ME) I would say that yes we should care. You would probably be
> >> frightened at the number of people still running Windows 9* and ME.
> >
> > In this particular case, whether someone is running Windows ME/9* is
> > irrelevant to me - it's a local attack against them that isn't likely
> > to affect me.
>
> I work at many other places than on my own personal computers. I would like
> to know if attacks might affect any number of computers. I am a computer
> professional.

And if so, surely any place where you see "Windows 9*/ME" should bring a
"you need to start planning on upgrading/replacing these with 2K/XP, if
you haven't already." styled response.

> Or program with queues that drop packets in a FIFO fashion that have enough
> memory that an attack will still allow fragmented packets to be serviced.
> You can (at least) make it harder to DoS a machine.

If the time an entry stays in the queue is less than the time required
for reassembly to occur then even a FIFO will not suffice as an adequate
algorithmic countermeasure. There are solutions to this too, but this
is just to say that it's more complex than "throw this data structure
in to fix."

Darren

Greetings and Salutations:

On 4/9/04 12:56 PM, "Darren Reed" <avalon@caligula.anu.edu.au> wrote:

> In some mail from gandalf@digital.net, sie said:
>> From my experience in the real world, specifically with Windows 98 (and I
>> suspect ME) I would say that yes we should care. You would probably be
>> frightened at the number of people still running Windows 9* and ME.
>
> In this particular case, whether someone is running Windows ME/9* is
> irrelevant to me - it's a local attack against them that isn't likely
> to affect me.

I work at many other places than on my own personal computers. I would like
to know if attacks might affect any number of computers. I am a computer
professional.

> Further, most likely all the people who are still using Windows9*/ME
> are not reading this, are not likely to ever hear about whether their
> PC is vulnerable or understand it if they read about it in the paper.
> Hence automatic updates in 2k/XP/...

See above. I am betting that there are many computer professionals who
would like to know what they are up against when they visit a customers site
and see computers "acting funny".

> Anyone who assumes that people who use/run Linux automatically run the
> latest version of anything has their head in the sand. It just doesn't

True. I agree wholeheartedly.

>> MoDem speeds:
>> 1) Microsoft 2000 - 200 packets in less than 2 minutes completely shuts off
>> legitimate fragmented packets
>> 2) PIX - 200 packets in less than 5 to 20 seconds completely shuts off
>> fragmentation
>
> Recovery time or isn't there one ?

Oops. I missed on this one, good question.

All of the numbers I worked with were packets in the amount of time
specified. So in windows if you keep a up a continuous stream of 200
packets (2 fragments) in 2 minutes then no legitimate fragmented packets can
get through. When you stop the attack the Windows 2000 machine recovers and
works normally.

If you keep up 200 fragments (not packets as I said) per 5 to 20 seconds
against a PIX firewall the same happens. When you stop the device recovers
and works normally.

Same with the other machines I tested against (obviously not a large sample
of machines). Stop sending fragmented packets and they return to normal.

> Unless it crashes the whole system, I don't think it's particularly
> interesting as most people try and avoid dealing with frgaments,
> these days, using PMTU discovery.

Again, see my original post. Between cell phones, satellite and other
devices fragmentation is needed on the Internet.

> In contrast to other algorithms that try and prevent synflooding
> (jamming the listen queue with SYN packets), there's no easy way
> out here because the target of the attack is not expected to send
> any packets back at the "source". All you can seemingly do is play
> around with limits and timeouts and things like that to at best
> focus the problem.
> Darren

Or program with queues that drop packets in a FIFO fashion that have enough
memory that an attack will still allow fragmented packets to be serviced.
You can (at least) make it harder to DoS a machine.

Ken

---------------------------------------------------------------
Do not meddle in the affairs of wizards for they are subtle and
quick to anger.
Ken Hollis - Gandalf The White - gandalf@digital.net - O- TINLC
WWW Page - http://digital.net/~gandalf/
Trace E-Mail forgery - http://digital.net/~gandalf/spamfaq.html
Trolls crossposts - http://digital.net/~gandalf/trollfaq.html

Greetings and Salutations:

On 4/10/04 8:23 AM, "Darren Reed" <avalon@caligula.anu.edu.au> wrote:
> In some mail from gandalf@digital.net, sie said:
>> I work at many other places than on my own personal computers. I would like
>> to know if attacks might affect any number of computers. I am a computer
>> professional.
>
> And if so, surely any place where you see "Windows 9*/ME" should bring a
> "you need to start planning on upgrading/replacing these with 2K/XP, if
> you haven't already." styled response.

Yup. Been there, did that. Small businesses have a hard enough time
justifying doing maintenance much less buying new equipment.

>> Or program with queues that drop packets in a FIFO fashion that have enough
>> memory that an attack will still allow fragmented packets to be serviced.
>> You can (at least) make it harder to DoS a machine.
>
> If the time an entry stays in the queue is less than the time required
> for reassembly to occur then even a FIFO will not suffice as an adequate
> algorithmic countermeasure. There are solutions to this too, but this
> is just to say that it's more complex than "throw this data structure
> in to fix."
> Darren

Agree 100% that a simple data structure will not fix this problem. But it
is a start. I would also say that in this case a "standard" (I.e. RFC) for
fragmentation reassembly should be written to take all of the diverse ways
that fragments are handled and standardize them. Again I am amazed that
every machine I hit with fragments seems to have a different effect on the
machine than the last machine I tested against.

Ken

---------------------------------------------------------------
Do not meddle in the affairs of wizards for they are subtle and
quick to anger.
Ken Hollis - Gandalf The White - gandalf@digital.net - O- TINLC
WWW Page - http://digital.net/~gandalf/
Trace E-Mail forgery - http://digital.net/~gandalf/spamfaq.html
Trolls crossposts - http://digital.net/~gandalf/trollfaq.html

[Taylan Develioglu]

Has anyone tried setting /proc/sys/net/ipv4/ipfrag_low_thresh on linux ?

This should minimize memory usage for packet reassembly, and may be an easy
workaround.

Taylan