Re: IPv4 fragmentation --> The Rose Attack

[Darren Reed <avalon@xxxxxxxxxxxxxxxxxxx>]

In some mail from gandalf@xxxxxxxxxxx, sie said:
> 
> On 4/9/04 12:56 PM, "Darren Reed" <avalon@xxxxxxxxxxxxxxxxxxx> wrote:
> 
> > In some mail from gandalf@xxxxxxxxxxx, sie said:
> >> From my experience in the real world, specifically with Windows 98 (and I
> >> suspect ME) I would say that yes we should care.  You would probably be
> >> frightened at the number of people still running Windows 9* and ME.
> > 
> > In this particular case, whether someone is running Windows ME/9* is
> > irrelevant to me - it's a local attack against them that isn't likely
> > to affect me.
> 
> I work at many other places than on my own personal computers.  I would like
> to know if attacks might affect any number of computers.  I am a computer
> professional.

And if so, surely any place where you see "Windows 9*/ME" should bring a
"you need to start planning on upgrading/replacing these with 2K/XP, if
 you haven't already." styled response.

> Or program with queues that drop packets in a FIFO fashion that have enough
> memory that an attack will still allow fragmented packets to be serviced.
> You can (at least) make it harder to DoS a machine.

If the time an entry stays in the queue is less than the time required
for reassembly to occur then even a FIFO will not suffice as an adequate
algorithmic countermeasure.  There are solutions to this too, but this
is just to say that it's more complex than "throw this data structure
in to fix."

Darren