Torbenth <torbenth@it.dk> wrote:
> Nappet fra WOL generel snak om firewalls.
> Kig på
http://grc.com/dos/grcdos.htm , den er lang men næsten i bunden
> kommer godt nyt for os der bruger Zonealarm 2.6
Steve fatter taet paa ingenting og utroligt mange mennesker kalder ham en
guru -- selv SANS. Han skriver:
"It is impossible for an application running under any version of Windows
3.x/95/98/ME or NT to "spoof" its source IP or generate malicious TCP
packets such as SYN or ACK floods."
Som atstake.com korrekt skrev for nyligt:
===
Raw Sockets are not a Security Risk
contributed by Chris Wysopal (Jun 5, 2001 4:43 pm EST)
The New York Times has an article about Steve Gibson's unfounded and hyped
concern about Windows XP containing raw socket functionality.
The "powerfull Internet-connection capabilities" which is hyped in this
article is merely the ability to write raw IP packets. This is where an
application program controls every field in the IP packet. This
functionality is required if you were writing your own network bridge
program for Windows or other low level network applications. An IDS for
NT that resets connections would need this functionality. AntiSniff,
which detects sniffers on a network, requires this functionality.
This capability, which this article states is so dangerous to the internet,
is already available practically everywhere. It is available in every
commercial and open source unix distribution and is already available for
all Windows platforms (not just Windows XP) through the use of free add on
libraries such as winpcap and libnetNT.
The hype and hyperbole is astounding. From reading this article you'd think
a deluge of DDoS attacks was building up just waiting to be released once
Microsoft releases the all powerful new API. Nothing could be further from
the truth. When XP arrives it will receive a collective yawn from DDoS
attackers who would much rather have their win32 DDoS clients run on
every version of windows using the already available add on libraries.
Once an attacker has administrative control of a machine they can run any
code they want, whether it is native or in an uploaded executable. There is
absolutely nothing stopping an attacker from spoofing IP addresses from a
Windows machine today or tommorrow.
===
--
I prefer the dark of the night, after midnight and before four-thirty,
when it's more bare, more hollow.
http://a.area51.dk/