Basic Security Flaw in the Fabric of the Net

TCP protocol at risk, could knock vast chunks of net offline.

[grelmar]

Security expert Paul Watson found the flaw around a year ago. The AP article is very vague, but very ominous at the same time.

Watson plans to disclose details of the flaw at a conference. He also states that anyone attending the conference should understand how to exploit the flaw within about 5 minutes of leaving the conference, no matter how vague it is.

How big is the flaw? The British and US governments have been working on it for the past year, since it was first discovered. Aparently, it should be possible to shut down most of the key routers on the internet within minutes, bringing the net to a screeching halt.

[globetechnology.com...]

[bill]

[webmasterworld.com...]

[grelmar]

I woulda never found it in there... thanks.

[grandpa]

I swear I'm in the wrong business, I should give a try to fortune telling and general telephone shamanism. Just last week I was wondering how long it would be before someone brought the entire web to its knees. I really didn't anticipate such a quick response.

[Robert Charlton]

While this sounds very serious, local San Francisco Bay Area newscasts (admittedly of dubious authority) interviewing local high level internet security experts (of which there are many) are suggesting that work on the fix has been going on for some time and that it's only a few days away.

He also states that anyone attending the conference should understand how to exploit the flaw within about 5 minutes of leaving the conference, no matter how vague it is.

Let's hope that the conference has been carefully timed, and/or that the guest list has been very carefully screened.

[grelmar]

Update:

Yah, there are a lot of high level experts out there, and they've been working on it for the past year. Another BBS I frequent is run by one such person (its not a security BBS, just a culture BBS he runs as a hobby).

Anyhoo, he responded to the effect that its a well known flaw that the administrators of the major backbone servers have been given plenty of warning about, and that there are patches already in place across the major routers.

They also "implied" that this Watson fellow didn't discover anything, and that he's using a known vulnerability and some good timing to generate some publicity for himself.

Y2K anyone?

[trillianjedi]

LOL, what a great way of getting bums on seats for a conference!

TJ

[grelmar]

Also a good way to turn yourself into a pariah 9in the highly clicky world of computer security.

[Nova Reticulis]

There's been a lot of discussion on this matter and the overall conclusion is that it's all crap and doesn't really threaten anything but big ass backbone routers which are being patched everywhere as we speak.