The Ethical Hacker Network - Fyodor Explains TCP DOS attack

Latest Additions

Who's Online

EH-Net > Ethical Hacking Discussions and Related Certifications > Malware (Moderator: don) > Fyodor Explains TCP DOS attack

Pages: [1] Go Down

« previous next »

	Author	Topic: Fyodor Explains TCP DOS attack (Read 5604 times)
0 Members and 1 Guest are viewing this topic.

apollo

Full Member

Offline

Posts: 146

Fyodor Explains TCP DOS attack

« on: October 06, 2008, 07:20:08 PM »

I thought that this was a great explanation. We don't know for sure what what Robert E Lee is going to say about the vulnerability, but this is good reading none the less.

http://insecure.org/stf/tcp-dos-attack-explained.html


	Logged

CISSP, CSSLP, MCSE+Security, MCTS, CCSP, GPEN, GWAPT, GCWN, NOP, OSCP, Security+

geekyone

Full Member

Offline

Posts: 180

Re: Fyodor Explains TCP DOS attack

« Reply #1 on: October 06, 2008, 10:22:19 PM »

I agree it is good reading. If you go down to the FAQ's under Fyodor's explanation there is a link to Robert Lee's response.

http://blog.robertlee.name/2008/10/conjecture-speculation.html


	Logged

CISSP, CEH, GPEN, GCIH, GCFA

Andrew Waite

Hero Member

Offline

Posts: 928

Re: Fyodor Explains TCP DOS attack

« Reply #2 on: October 07, 2008, 04:00:43 AM »

Agreed this is a good article that goes beyond the media circus of 'Oh noes, the sky is falling'. I'm just waiting to see if there is any real impact from the findings once they release full details.

Think BillV beat you to the punch though....


	Logged

-- http://www.infosanity.co.uk
-- http://blog.infosanity.co.uk

Ketchup

Hero Member

Offline

Posts: 1021

Re: Fyodor Explains TCP DOS attack

« Reply #3 on: October 07, 2008, 04:07:54 PM »

Definitely a good article. I am not sure that I understand why this is so huge though. It seems like the same DOS attacks that have been around for a while. Isn't it still a battle of who has more resources and bandwidth?

I would imagine you can easily use a firewall rule or an IDS rule to limit the number of connections coming from a particular IP address, right? Even in a DDOS scenario, you would still have an unusually high number of connections from each IP address involved, right?