SYN floods (was: does history repeat itself?)

Mon Sep 9 18:38:59 UTC 1996

At 09:13 AM 9/9/96 -0700, you wrote:

>A friend of mine gave me a photocopy of a page in the latest 2600
>magazine.  It was the source code for a SYN flooder on Linux, with a
>description of what it does and a notice on how it can really cause
>denial-of-service attacks.
>

Hello Craig [Flashman],

The SYN Flooding is not only the problem on IRC, but the TCP sequencing as
well. Using a TCP sequencer, one of these 13 year olds who has no idea how
or what they are doing, can SYN flood a host without knowing it at all. This
involves hosing a host with SYN floods to keep it from sending out the
correct ACKs so that you can sequence them on your side and "spoof" them. 

Well, sadly to say, all these kids want to do is be "eleet" and hide thier
real host names so they can trade pirated software etc. 

However, this leads to a bigger problem seeing as how this same code can be
used to do blind rcommands using the same sequencing technique. Fortunately,
the person who wrote the orginal TCP sequencer had only IRC in mind, and
mainly the people that have used it were IRC kiddies, and even they had a
hard time using it because it needs a modification to raw.c in order to
patch the kernel to do the correct raw socket operations under the mask of a
faked packet.

  struct tcphdr * fake_tcp;
       fake_tcp = ( struct tcphdr *)( packet + offsetTCP );
       fake_tcp->th_dport = htons(fromport);
       fake_tcp->th_sport = htons(toport);
       fake_tcp->th_seq     = htonl(sequence);
       fake_tcp->th_ack     = htonl(acknum);
       fake_tcp->th_off     = (sizeof(struct tcphdr))/4;
       fake_tcp->th_win  = 2;

I think you get the point. 

I'm not sure what a real feasable solution would be, except to do a tcpdump
or start a sniffer during an attack and try and trace it from there.
However, if the packets are carrying fake headers, there's not much you can do.

P.S. Lets try not to get mad at Emmanuel Goldstein (Editor 2600 Magazine)
for what he puts in his magazine. True, the code can and will be used for
malicious purposes, but if it weren't published, only a select few people
would have the code and very few people would be hearing about SYN floods,
instead, simply being attacked without the slightest clue what was happening.

Ben Tersian
-LebaNet Inc. C.S.O.