Vendors rush to fix critical Internet protocol bug

INTERNET infrastructure vendors are rushing to develop patches for a set of Transmission Control Protocol (TCP) and Internet Protocol (IP), which is the basic communication language or protocol of the Internet, following security flaws that could help hackers knock servers offline with very little effort, reports IDG news service.

TCP/IP is the communications protocol that under-girds the Internet and communications between computers in a network.

The security community has been buzzing about the bugs since last week, when security researcher Robert Hansen discussed the problem on his blog.

Technical details on the vulnerabilities have not been released, but the security experts at Outpost24, who discovered the problem, Robert Lee and Jack Louis, have said that they could knock Windows, Linux, embedded systems and even firewalls offline with what’s known as a Denial of Service (DOS) attack.

The flaws lie in the TCP/IP software used by these systems to send data over the Internet.

According to the report, Lee and Louis first discussed the problem about a fortnight ago at a conference in Amsterdam, disclosing that many of the affected vendors were now working on patching the issue with help from the Finnish National Computer Emergency Response Team.

Lee, who spent most of Wednesday and Thursday explaining the issue also said that the vendors who are capable and responsible for creating solutions are in the loop.
The Outpost24’s chief security officer, said “The public message here is ‘Chill out, the people who need to be involved are involved,” stressing that he did not know how long it would take to fix the problem.

In a related development, Microsoft in a press statement, said it was investigating the matter and was “unaware of any attacks trying to use the claimed vulnerability or of customer impact.”

But according to Hansen, if attacks did appear, they could be bad. That’s because they could be launched with very little bandwidth and because machines targeted would often remain disabled even after the DOS attack has stopped.



ITREALMS Online ... delivering news for ICT4D