Hello
I am not sure if I already sent this last week ... Had Server problem.
Peace
.---------------.
/ NtWaK0 Advisory \
+-----------------------------------------------------------------------.
:
Affected : BlackIce 2.9 car Latest with patch :
Type : DOS attacks with URG Flag Set ARE NOT LOGGED :
Date : 14-02-2002 :
Author : NtWaK0 @ www.SafeHack.com :
+-----------------------------------------------------------------------.
+----------------.
Remote/Local DOS \
+------------------`----------------------------------------------------.
:
+-----------. :
Disclaimer \ :
+-------------`---------------------------------------------------------.
The information in this advisory is believed to be true based on :
experiments though it may be false. The opinions expressed in this :
advisory and program are my own and NOT of any company. :
In Fact I do not work for no one at the present time. :
:
This material is presented for informational and entertainment purposes :
only, and to satisfy the curious. Any activities described in this file :
which involve vandalism, theft, or any other illegal activities are :
recounted from third-party conversations. I do not condone or encourage :
vandalism or theft. I do not accept any liability for anything anyone :
does with this information. So, don't shoot the messenger. :
Remember: Use a computer in ways that ensure respect for your fellows. :
:
+-------. :
T.O.C. \ :
+---------`-------------------------------------------------------------.
:
:
[ Brief History . . . . . . . . . . . . . . . . . . . . . .line 40 ]:
:
[ The Problem . . . . . . . . . . . . . . . . . . . . . . .line 60 ]:
:
[ The Solution . . . . . . . . . . . . . . . . . . . . . .line 156 ]:
:
+-------------. :
Brief History \ :
+---------------`-------------------------------------------------------.
Blackice personal firewall do not log a DOS attack if sent with URG Flag:
Set. :
To learn more about Blackice please visit: :
http://www.networkice.com/ or http://www.iss.net/ :
:
:
+---------------------------+ :
>>> Test OS Applications <<< :
+---------------------------+ :
Tested on Windows 2K with SP2 :
Blackice Server 2.9 car :
Test was done on 4 boxes :
+-----------. :
The Problem \ :
+-------------`---------------------------------------------------------.
I never played with Blackice before even I use often. I decide to play :
with it a bit last night and here is what I found. :
:
If you send a DOS (Denial Of Service) attack to an Blackice Server :
protected box NON of your attack will be LOGGED in blackice. :
:
PLEASE DO NOT MIX this is not an attack on blackice. But if you are :
using blackice as your ONLY IDS then you are affected. :
This mean you cannot trust Blackice Logs if you was attacked with the :
same type of attacks, because your blackice wont LOG these packets. :
(Packets sent with URG flag SET). :
:
:
:
A packet crafted with URG FLAG SET to 1 and all others FLAG set to 0 :
will pass undetected by Blackice Server version. :
:
Other type of packets will be detected but the detection results is not :
that CORRECT. In the example below I sent a 5 packets with PUSH FLAG set:
to 1 and all others to 0 this was detected by BLackice as QUESO Scan. :
That is one example for many... Just play with it and you see your self.:
:
Now the bad issue is I was able to flood my local LAN with over 10000000:
packets (URG FLAG SET) and non of these packets was captured by BICE. :
:
NOTE: During the attack BlackICE LIGHT WAS GOING NUTS... BUT ZERO attack:
in the log or in the GUI. :
:
>>> PACKET DETECTED AS QUESO SCAN BUT AT LEAST WAS LOGGED <<< :
>>> Sniff Cpature <<< :
IP Header
Length and version: 0x45
Type of service: 0x00
Total length: 78
Identifier: 11783
Flags: 0x0000
TTL: 64
Protocol: 17 (UDP)
Checksum: 0xc87b
Source IP: 192.168.1.103
Dest IP: 192.168.1.101
UDP Header
Source port: 1031
Dest port: 137
Length: 58
Checksum: 0xb7e3
Raw Data
80 b0 00 00 00 01 00 00 00 00 00 00 20 43 4b 41 ( CKA)
41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 (AAAAAAAAAAAAAAAA)
41 41 41 41 41 41 41 41 41 41 41 41 41 00 00 21 (AAAAAAAAAAAAA !)
00 01 ( )
>>> PACKET DETECTED AS QUESO SCAN BUT AT LEAST WAS LOGGED <<< :
IP Header
Length and version: 0x45
Type of service: 0x00
Total length: 78
Identifier: 11784
Flags: 0x0000
TTL: 64
Protocol: 17 (UDP)
Checksum: 0xc87a
Source IP: 192.168.1.103
Dest IP: 192.168.1.101
UDP Header
Source port: 1031
Dest port: 137
Length: 58
Checksum: 0xb7e3
Raw Data
80 b0 00 00 00 01 00 00 00 00 00 00 20 43 4b 41 ( CKA)
41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 (AAAAAAAAAAAAAAAA)
41 41 41 41 41 41 41 41 41 41 41 41 41 00 00 21 (AAAAAAAAAAAAA !)
00 01 ( )
:
:
>>> PACKET NOT DETECTED AT ALL BY BLACKICE <<< :
============================================== :
IP Header
Length and version: 0x45
Type of service: 0x00
Total length: 72
Identifier: 18539
Flags: 0x0000
TTL: 128
Protocol: 6 (TCP)
Checksum: 0x6e28
Source IP: 192.168.1.101
Dest IP: 192.168.1.103
TCP Header
Source port: 1
Dest port: 1
Sequence: 3158779
ack: 0
Header length: 0x50
Flags: 0x20 (URG )
Window Size: 512
Checksum: 0x27cb
Urgent Pointer: 0
Raw Data
78 39 30 78 65 62 78 30 33 78 35 64 78 65 62 78 (x90xebx03x5dxebx)
30 35 78 65 38 78 66 38 78 66 66 78 66 66 78 00 (05xe8xf8xffxffx )
:
>>> PACKET NOT DETECTED AT ALL BY BLACKICE <<< :
:
IP Header
Length and version: 0x45
Type of service: 0x00
Total length: 40
Identifier: 11785
Flags: 0x0000
TTL: 64
Protocol: 6 (TCP)
Checksum: 0xc8aa
Source IP: 192.168.1.103
Dest IP: 192.168.1.101
TCP Header
Source port: 1
Dest port: 1
Sequence: 0
ack: 3158811
Header length: 0x50
Flags: 0x14 (ACK RST )
Window Size: 0
Checksum: 0xf866
Urgent Pointer: 0
Raw Data
()
:
:
>>> BLACKICE LOG <<< :
:
:
13:00:50 27 BlackICE detection stopped 0.0.0.0 0.0.0 :
13:01:56 26 BlackICE detection started 0.0.0.0 0.0.0 :
13:05:07 2000321 Queso Scan 192.168.1.101 192.168.1.103 :
13:10:07 2000321 Queso Scan 192.168.1.101 192.168.1.103 :
:
>>> NOT DETECTED ATTACK WITH URG SET IS SUPPOSED TO BE HERE <<< :
>>> NOT DETECTED ATTACK WITH URG SET IS SUPPOSED TO BE HERE <<< :
:
:
>>> TCP Settings that may help you understanding what I sent <<<
:
[TCP]
fURG=1
fACK=0
fPUSH=0
fRESET=0
fSYN=0
fFIN=0
Acknowledge=0
Sequence=0
Window=0
Offset=0
Urgent=0
Checksum=0
SpecifyTCPChecksum=0
Data=x90xebx03x5dxebx05xe8xf8xffxffx
:
[UDP]
Checksum=0
SpecifyUDPChecksum=0
Data=
:
[ICMP]
Type=0
Code=0
Checksum=0
SpecifyICMPChecksum=0
Data=
Identifier=0
Sequence=0
Message=0
:
[IP]
SourceAddress=
SourcePort=1
DestinationAddress=
DestinationPort=1
HeaderSize=20
SpecifyHeaderSize=0
Identification=0
SpecifyIdentification=0
Checksum=0
SpecifyChecksum=0
TypeService=0
FragmentationType=2
DataSize=0
Offset=0
TTL=1
:
+------------. :
The Solution \ :
+--------------`---------------------------------------------------------.
No idea. Vendor should be informed... Blackice now I guess is owned by :
ISS.Net. :
+------------------------------------------------------------------------.
This archive was generated by hypermail 2b30 : Mon Feb 18 2002 - 19:59:19 PST