NEWS The UK's web security watchdog has issued a warning on a critical web vulnerability just as a US researcher is poised to tell how to hack into it.
US researcher Paul Watson, who discovered the flaw in TCP (transmission control protocol) late last year, is to reveal all tomorrow (Thursday) to an internet security conference in Vancouver.
The technique will allow hackers to knock unprotected computers offline and to broadly disrupt routers and net traffic. The UK National Infrastructure Security Coordination Centre (niscc) issued an advisory on the vulnerability on Tuesday.
It said: "The impact of this vulnerability could allow an attacker to create a Denial of Service condition against existing TCP connections." It added: "The impact of this vulnerability varies by vendor and application, but in some deployment scenarios it is rated critical."
Watson discovered a technique to reliably shut routers down by resetting them remotely. The odds against being able to crack the inter-router codes, basically cracking a rotating number from four billion combinations, were previously estimated as being very high – and would take between four and 142 years to execute.
Watson's technique takes four tries and a couple of seconds. He will reveal this tomorrow in a presentation entitled 'Slipping in the Window: TCP Reset Attacks' at the cansecwest conference which starts today in Vancouver.
The UK warning says that the BGP (boarder gateway protocol) is potentially the most seriously affected by this style of attack and that there is a potential impact on the DNS (domain name system) and SSL (secure socket layer).
Niscc advises users to consult their vendors for patches and solutions to the threat. It has a list of vendors and solutions on its website under advisory 236929.
Comments
There are 7 comments. Join the discussion
1. Adrian Jones
Releasing the way to perform this hack is totally irresponsible. Does he not know the damage that can be done when this info is out in the open world.
2. Craig
People need to know how it's done so they can protect against it. We can't bury our heads in the sand and hope no body else will figure it out.
3. Simon West
A few links to other articles about this, lists of affected products, and some infpo on what we can DO to eliminate this vulnerability in our own systems would be nice... or is it tha case that we don't have fixes for the vulnerability about to be publicised?
4. Karen Challinor
Good job it's the weekend soon, with the web paralysed by all the hackers trying this out we won't have much to do anyway.
5. Mark Leman
I totally agree,
completely stupid.
6. Rob.
Releasing info seems to be the only way to get action.
The vulnerability has been known of since late last year - we can only hope a full fix has been implemented.
If not - then releasing the info will prompt action (a cure).
There are countless examples of security flaws that have been highlighted to vendors - but no fix was attempted (until it became a well known flaw).
Then news of such attacks will prompt people to deploy the fixes - they may not have actively deployed the fix as it was previously unknown to them.
Stop deriding people and look at the bigger picture.
7. royston
informe the public why dont you! its bad enough for high brow people to informe everyone they found a problem but then to show everyone a demonstration, thats downright irresponsible. and then to publish they are actualy going to do it and when. on top of all this the news channels then spread it even further!! nice going everybody. very wrong for all concerned.keep it in house will you and secure the sodding vulnerability..then tell em all what a narrow escape we all had for gods sake.