A "breakthrough" in hacking Windows

Date: March 10, 2005
Source: Computer Crime Research Center
By: CCRC staff

Dejan Levaja, certain security expert, in his posting to BugTraq archive at Security Focus, noted that Windows Server 2003 and XP SP2 (with Windows Firewall turned off) are vulnerable to "LAND attack". This attack is
sending TCP packet with SYN flag set, source and destination IP address and source and destination port as of destination machine, results in 15-30 seconds DoS condition.

This attack can be launched using the following tools: IP Sorcery for creating malicious packet, Ethereal for sniffing it and tcpreplay for replaying.

Sending single LAND packet to file server causes Windows explorer freezing on all workstations currently connected to the server. CPU on server goes 100%. Network monitor on the victim server sometimes can not even sniff malicious packet. Using tcpreplay to script this attack results in total collapse of the network.

Vulnerable operating systems are Windows 2003, Windows XP SP2, other OS were not tested by the researcher.

Microsoft downplayed the impact of the vulnerability's exploitation, saying such an effort would only slow a Windows computer, not force it to crash. The company said the attacks can be largely avoided by merely employing the firewall tools it includes with its Windows operating system.

---

Add comment  Email to a Friend

Discussion is closed - view comments archieve

2005-03-10 13:22:32 - gUD Sachin

Total 1 comments