×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Microsoft Patches 1990s-Era 'Ping of Death'

Soulskill posted more than 2 years ago | from the better-late-than-never dept.

Bug 128

CWmike writes "Microsoft on Tuesday issued 13 security updates that patched 22 vulnerabilities in Internet Explorer, Windows, Office and other software, including one that harked back two decades to something dubbed 'Ping of Death.' While other patched vulnerabilities we more serious, one marked 'CVE-2011-1871' brought back memories for nCircle's Andrew Storms. 'This looks like the Ping of Death from the early-to-mid 1990s,' he said. 'Then, when a specially-crafted ping request was sent to a host, it caused the Windows PC to blue screen, and then reboot.' Two decades ago, the Ping of Death (YouTube video demonstration) was used to bring down Windows PCs remotely, often as a way to show the instability of the operating system."

cancel ×
This is a preview of your comment

No Comment Title Entered

Anonymous Coward 1 minute ago

No Comment Entered

128 comments

umm (2, Informative)

newton62 (56617) | more than 2 years ago | (#37040504)

better late then never!

Re:umm darkies (-1)

Anonymous Coward | more than 2 years ago | (#37040738)

better late then never!

better a free trip back to africa than affirmative action and welfare and crime

if my great great granddaddy knew things would turn out like this he would of picked his own cotton

Re:umm (0)

Anonymous Coward | more than 2 years ago | (#37040772)

What?

First late, then never? And that's better than what?

Re:umm (1)

Hylandr (813770) | more than 2 years ago | (#37040920)

Does anyone know if Back Oriface works on Win 7?

- Dan.

Re:umm (0)

Anonymous Coward | more than 2 years ago | (#37041066)

The backdoors in W7 are now technically harder to access but there are even more than ever - particularly if Office, Flash and .NET are installed also. Fortunately the tools are now more sophisticated too, and it's no harder to anonymously remote-admin a Windows box than it ever was.

IRC (-1)

Anonymous Coward | more than 2 years ago | (#37040510)

I remember doing this to jerks trolling on IRC back in the day.

Re:IRC (-1)

Anonymous Coward | more than 2 years ago | (#37040534)

Fuck that I did it to people who were beating me in QWCTF.

Re:IRC (2)

TWX (665546) | more than 2 years ago | (#37040580)

Fuck that I did it to people who were beating me in QWCTF.

When I used to host LAN parties after the DoS attacks became well publicized, we'd all start out playing the game nicely, be it Warcraft II or Quake or whatnot, but when someone would feel they were wronged (how one would be wronged in a game with fairly inflexible rules I still don't understand) or were doing far worse than everyone else, they'd quit and start attacking whoever they felt deserved it.

I started running Warcraft II under MS-DOS only, using DOS networking with only IPX, so that I couldn't be knocked out, but friends who chose to run it under Windows disappeared from the game frequently.

As for Quake, if I didn't set up a dedicated server on the Linux box then I'd host it, so they'd usually leave me alone. I guess my friends were altruistic enough to not try to take the whole game down, just the player they took exception to...

Re:IRC (1)

mikael_j (106439) | more than 2 years ago | (#37041142)

[...] (how one would be wronged in a game with fairly inflexible rules I still don't understand) [...]

Well, there are a lot of games out there that have various flaws that can be exploited to your advantage which is generally considered to be something you don't do outside of a strictly competitive environment. Then there are "house rules" (one I remember fondly was playing various RTS games 2v2 on maps that had one or more rivers crossing the map with a stated rule that no one was allowed to cross the river within the first n minutes of the game, really cut down on the number of games that just turned into tank/zerg rush wins in a few minutes) that aren't coded into the game but which are agreed upon by the participants (and there's always that one ass who sends half a dozen tanks and a couple of APCs loaded with engineers across the river a little early).

Re:IRC (-1, Flamebait)

mysidia (191772) | more than 2 years ago | (#37040578)

better late then never!

It must be their trump card... a feature saved for a rainy day.

Now every IRC'er in the world will need to upgrade to Windows 7, so they can be invincible to PoD.

Oops... someone should have reminded MS that the 5 IRC'ers left in the world already switched to*ix.

Re:IRC (0)

Anonymous Coward | more than 2 years ago | (#37040802)

WTF are you talking about?

The first people on IRC are the same still using it. And they've always been on *IX, not Linux, *IX.

The stupid Windows kiddies were just a fad. You must be one of them, discovering IRC when it was already declining and switching to Lignux since that's become the latest fad then.

Re:IRC (2)

devphaeton (695736) | more than 2 years ago | (#37040822)

There are actually a lot of "Windows Kiddies" on IRC. Not a majority by far, but still some. I was surprised that a libSDL channel I recently got into was almost all Windows folks.

By my estimation, in my experience (freenode and efnet), most people on IRC are running some form of older-school Linux distribution, such as Debian or Slackware. There are some Ubuntu peeps but I think a lot of them use something more 'modern', i.e. skype or pidgin. I see BSD folks in my BSD channels, but they only barely edge out the Windows guys overall.

Now that USENET has gone down the shitter, I still enjoy IRC, and will continue to do so until it goes away.

Re:IRC (0)

Anonymous Coward | more than 2 years ago | (#37042388)

Now that USENET has gone down the shitter, I still enjoy IRC, and will continue to do so until it goes away.

I know what you mean, but these days #!!!!!!!!!!!!!!!!!!freeporn is nothing but trolls and spammers.

Re:IRC (-1)

Anonymous Coward | more than 2 years ago | (#37040712)

Of course. When you tried to take over an IRC channel and got involved in a channel war after a net split, this is how you got rid of those your nick collisions missed.

Ahh... to be stupid again.

I remember the ping of death (0)

Osgeld (1900440) | more than 2 years ago | (#37040558)

It really didn't do much unless your bombing your buddies dialup server, and thus tying up your dialup line. I guess it could be slightly annoying if you could get a shit ton of people to do it today

Re:I remember the ping of death (-1)

Anonymous Coward | more than 2 years ago | (#37040640)

Uhhh, no. You're thinking of flood ping.

Re:I remember the ping of death (1)

0100010001010011 (652467) | more than 2 years ago | (#37040662)

If your friend was on dialup why not just do the ++ATH0 ping? Oh the fun I had with that.

Re:I remember the ping of death (1)

bipbop (1144919) | more than 2 years ago | (#37041008)

Doesn't work if it's Hayes-compliant, because of the guard timer after +++. They needed a crappy out-of-spec (usually win)modem for that, and some people had them, but just being on dialup didn't guarantee it.

Re:I remember the ping of death (1)

sjames (1099) | more than 2 years ago | (#37041350)

That was actually one of the early patent problems. Hayes wanted a significant royalty to implement the guard timer.

Re:I remember the ping of death (5, Interesting)

adolf (21054) | more than 2 years ago | (#37040746)

I remember a few variations.

One, of course, was ping -f from a sufficiently fast pipe (or just an equally-slow pipe with better buffer management). I had a custom REXX script under OS/2 which took a username as input, and would finger each of the terminal servers of a local ISP, derive the IP address of that user, then issue a ping -f for that particular dialup user.

It would cause their PPP sessions to timeout, at which point they'd disconnect. And it was fun, because I actually knew the people who I was disconnecting.

Tougher (or farther) targets at other hosts would get a ping -f from a blistering-fast (hah!) shared FreeBSD machine with a T1 connection. If -f didn't do it alone, increasing the packet size always did. Sometimes, it seemed that different packet sizes (not just larger ones) would make it happen sooner.

Around the same time, it was discovered (not by me) that sending an ICMP ping packet containing "+++ATH0" would instantly disconnect any user with a cheap modem by very neatly instructing their modem to do exactly that.

This worked because Hayes (rest their souls) had a patent on requiring a one second delay between +++ (aka "enter command mode") and any subsequent commands (ATH0 hangs up the modem). Makers of cheap modems wanted to pay as few royalties as possible, and they got their wish.

On most premium modems, or most old modems, it wasn't a problem, since it was required to have a delay between "+++" and any other command. But during the early winmodem days, it was a blast: Those cheap modems instantly dropped to command mode, and immediately executed anything after that.

You tell it to hang up, and that's just what it does.

It wasn't even really necessary to use ATH0, either: any old AT command would work, and would leave the modem in command mode instead of data mode. +++ATLM2L3, for instance, would result in a lot of noise from the modem speaker until their session timed out...

The ATH0 trick could be accomplished with IRCII using /ctcp [target] PING +++ATH0 or more generally with ping -p 2B2B2B41544829 [target IP or hostname] from a suitable *nix host.

It was fun being a kid back then, with OS-agnostic ways to be annoying. (I've grown up just slightly since then...)

Re:I remember the ping of death (1)

oztiks (921504) | more than 2 years ago | (#37040796)

My favorite of them all ... /topic #l33t Press Alt + F4 for Ops.

Re:I remember the ping of death (0)

Anonymous Coward | more than 2 years ago | (#37040928)

Social engineering at it's best.

Also, the song "The Final Countdown" is now playing in your head.

Re:I remember the ping of death (0)

Anonymous Coward | more than 2 years ago | (#37041152)

True,

But in addition, just don't think about your breathing.

Re:I remember the ping of death (0)

Anonymous Coward | more than 2 years ago | (#37041280)

Just posting to undo an accidental moderating.

Sir Greybeard, I am humbled before your greatness! (1)

rts008 (812749) | more than 2 years ago | (#37041424)

Had I only known......;-)
The pure, unadulterated anarchy, and beautiful chaos of this mentality(in regards to the AT commands) is absolutely stunning and awesome.
Really. (no sarcasm intended)

*apply sarcasm/maybe offtopic, also
Thanks to you, I now have the proper incentive to continue research and development on on my iTIME Traveler® software for your iPhone! (soon coming to an APP Store near you!)
Depending on various IP lawsuits, my be also soon ported to Android and Win 7 mobile, or none of the above, including IOSx... YMMV.

Re:I remember the ping of death (4, Informative)

Jah-Wren Ryel (80510) | more than 2 years ago | (#37040832)

It really didn't do much unless your bombing your buddies dialup server, and thus tying up your dialup line. I guess it could be slightly annoying if you could get a shit ton of people to do it today.

I don't know what you are talking about, but it certainly isn't the ping of death. Maybe ping flooding? I personally wrote the patch for a now long defunct unix variant which fixed the actual "Ping of Death" vulnerability.

The way it worked was to send a ping with a 65536 byte payload - technically out of spec for the ICMP protocol by about 30 bytes in length. Since it was out of spec, most IP stacks were written with the assumption that it could never happen. But when it did happen, you got a buffer overflow that would usually panic the OS immediately. At the time, almost every OS on the net was vulnerable even the guys who didn't have BSD-derived stacks like MS Windows.

So all it took was one single oversized-sized icmp ping to crash just about any computer on the net. Imagine being able to take down all of google's internet presence with just a few thousand packets. Of course, at the time, there was no google.

Re:I remember the ping of death (2)

Sun (104778) | more than 2 years ago | (#37040892)

So all it took was one single oversized-sized icmp ping to crash just about any computer on the net. Imagine being able to take down all of google's internet presence with just a few thousand packets. Of course, at the time, there was no google.

Technically, you needn't send the whole thing. You couldn't send the whole thing, anyways, as there are limits on the size of an IP packet. You sent the packet in IP fragments. You needn't even send all of the fragments. Merely sending the last fragment, the one that overflowed the IP packet size.

Also, IIRC, it wasn't 65536. It was bigger. Maximal size was ~65506+your MTU (which was never less than 536, and was often 1500) which caused the overflow. 65536 total size is still okay (or is it 65535?)

Shachar

Re:I remember the ping of death (1)

Jah-Wren Ryel (80510) | more than 2 years ago | (#37041060)

Technically, you needn't send the whole thing. You couldn't send the whole thing, anyways, as there are limits on the size of an IP packet. You sent the packet in IP fragments. You needn't even send all of the fragments. Merely sending the last fragment, the one that overflowed the IP packet size.

Yeah, it was really just convenience to use ping since anyone could run it and most OSes would happily do the illegal fragmentation for you.

Re:I remember the ping of death (1)

c (8461) | more than 2 years ago | (#37042414)

At the time, almost every OS on the net was vulnerable even the guys who didn't have BSD-derived stacks like MS Windows.

The main difference being that when the Ping 'o Death became public knowledge, patches were available for all the free OSes... I read about it on BUGTRAQ, tested it against random Linux boxes in my office, then had every public-facing system patched and re-tested before lunch (which, those days, was about 50 minutes after I made it to the office).

The POD was one of the first incidents where the suits I worked with started looking at this open source model as maybe being a bit more than just something to "explore" to keep the geeks amused.

Re:I remember the ping of death (1)

Xest (935314) | more than 2 years ago | (#37041288)

The Ping of Death had nothing to do with bandwidth flooding, it was a packet that would instantly just crash Windows as is quite clearly mentioned in the summary. It wouldn't matter if you were on a 14.4 modem, or a 1gbps pipe. It'd still crash vulnerable versions of Windows straight away.

I remember the Blue Screen of Death (0)

Anonymous Coward | more than 2 years ago | (#37041650)

Why are they not patching that?

Why???

POD has long since been patched. (5, Informative)

atlasdropperofworlds (888683) | more than 2 years ago | (#37040562)

Just FYI, the POD doesn't affect any modern OSes. It used to bring down Windows NT (and earlier), early linux kernels, as well as Mac OS 7 back in the day.

Re:POD has long since been patched. (0, Troll)

Anonymous Coward | more than 2 years ago | (#37040590)

You're forgetting about the part where Microsoft wrote a *BRAND NEW* TCP stack for Vista+. This is why these old bugs keep popping up in the news. Yes, it was patched -- but that was when they were using the forked BSD stack. Now they get to play this game for the next 10 years until their new stack matures.

Re:POD has long since been patched. (3, Informative)

Jah-Wren Ryel (80510) | more than 2 years ago | (#37040850)

You're forgetting about the part where Microsoft wrote a *BRAND NEW* TCP stack for Vista+. This is why these old bugs keep popping up in the news. Yes, it was patched -- but that was when they were using the forked BSD stack.

You got marked troll, and it's deserved. But better that someone else explain - MS never used a BSD stack. They licensed the Spider Systems STREAMS stack which was a wholly separate implementation (for one, it was STREAMS which BSD, AFAIK has never implemented).

However, my understanding is that MS did eventually roll their own stack, iirc it was for XP.

Re:POD has long since been patched. (2, Informative)

93 Escort Wagon (326346) | more than 2 years ago | (#37041050)

You got marked troll, and it's deserved. But better that someone else explain - MS never used a BSD stack. They licensed the Spider Systems STREAMS stack which was a wholly separate implementation (for one, it was STREAMS which BSD, AFAIK has never implemented).

Those of us who are old enough remember the "portions copyright the regents of the University of California Berkeley" (or words to that effect) that used to be part of the Windows legal declarations from 95 onward. It has been considered common knowledge that their pre-Vista TCP/IP stack was taken from BSD [wikipedia.org], as was their FTP executable [terminally...herent.com]. If you're going to claim otherwise, you should offer some citations please.

However, my understanding is that MS did eventually roll their own stack, iirc it was for XP.

Nope, the "from the ground up" rewrite was for Vista [slashdot.org], although they had previously partially rewritten the stack for Win 2K and for XP I believe. And there were definitely a number of bugs in that new Vista stack - here's one example [technet.com]. But if you were paying attention back during the interminable Vista beta process, you would've remembered the noise about those old TCP/IP vulnerabilities, solved long ago, that Microsoft re-introduced with their new stack.

Re:POD has long since been patched. (1)

Jah-Wren Ryel (80510) | more than 2 years ago | (#37041102)

It has been considered common knowledge that their pre-Vista TCP/IP stack was taken from BSD, as was their FTP executable. If you're going to claim otherwise, you should offer some citations please.

Like lots of common knowledge, it was https://www.kuro5hin.org/?op=displaystory;sid=2001/6/19/05641/7357 [slashdot.org]">wrong and you'll see that the wikipedia page you linked to does not cite its sources for those claims. While it may be true that Vista has a complete network stack rewrite, that does not mean there wasn't an earlier rewrite when Spider was dumped.

Re:POD has long since been patched. (1)

93 Escort Wagon (326346) | more than 2 years ago | (#37041378)

Did you notice this line in the (corrected) article you linked to?

"Now, some of Spider's code (possibly all of it) was based on the TCP/IP stack in the BSD flavors of Unix."

Re:POD has long since been patched. (3, Interesting)

Jah-Wren Ryel (80510) | more than 2 years ago | (#37041506)

I am (or was, its been 15 years) actually pretty familiar with Spider's code and it wasn't even close to to the BSD stack.

They probably lifted constants and structures inherent to TCP/IP and might have cut-n-pasted a few code snippets like checksum calculations, maybe even some higher-level stuff to emulate sockets on top of the STREAMS Transport Layer Interface. But the heart and soul of the BSD stack is the mbuf structure and that didn't exist at all anywhere in the Spider code. Not just a simple search-and-replace with a different data structure, it was an entirely different data flow because STREAMS had requirements that couldn't just be "bolted on" to the BSD stack.

Totally sucked for me because everything I knew about BSD network internals was useless there - and everything I learned about Spider's code while on that job became practically useless the second I moved on as Sun's own STREAMS implementation in Solaris, which was basically the only mainstream use of STREAMS, had nothing to do with Spider.

Re:POD has long since been patched. (3, Interesting)

benjymouse (756774) | more than 2 years ago | (#37041454)

Those of us who are old enough remember the "portions copyright the regents of the University of California Berkeley" (or words to that effect) that used to be part of the Windows legal declarations from 95 onward. It has been considered common knowledge that their pre-Vista TCP/IP stack was taken from BSD [wikipedia.org], as was their FTP executable [terminally...herent.com]

The "common knowledge" here is an euphemism for myth. Back in Windows NT 3.1 (!) MS licensed a TCP/IP stack from Spider. That *may* have been based partially or entirely on the BSD stack of the time. However, as of Windows NT 3.5 and Windows 95 that stack had been replaced by Microsofts own stack. Some of the utilities (ftp client, ping?) were still the original BSD utilities, or based on them. The network stack has not been BSD since Windows NT 3.1.

If you're going to claim otherwise, you should offer some citations please.

here you go: https://www.kuro5hin.org/?op=displaystory;sid=2001/6/19/05641/7357 [kuro5hin.org]

Nope, the "from the ground up" rewrite was for Vista [slashdot.org], although they had previously partially rewritten the stack for Win 2K and for XP I believe.

Incorrect, it had been previously rewritten for Windows NT 3.5. See above.

But if you were paying attention back during the interminable Vista beta process, you would've remembered the noise about those old TCP/IP vulnerabilities, solved long ago, that Microsoft re-introduced with their new stack.

Citation? or should I write

If you're going to claim otherwise, you should offer some citations please"

Re:POD has long since been patched. (1)

drinkypoo (153816) | more than 2 years ago | (#37042534)

Nope, the "from the ground up" rewrite was for Vista, although they had previously partially rewritten the stack for Win 2K and for XP I believe. And there were definitely a number of bugs in that new Vista stack - here's one example.

In fact, during the Vista betas, it was revealed that the "new" stack was indeed vulnerable to a whole laundry list of vulns fixed in the XP stack... Not only P-o-D, but also land.c and other antique exploits would work without modification when executed against Vista. This proved beyond the shadow of a doubt that Microsoft was not doing any bounds checking in the TCP stack. IOW, they were making the same amateur-hour mistakes they made the FIRST time around all over again for their new version of Windows.

On the plus side, I hear IPv6 actually works properly with the new stack, and it's quite a bit faster at the top end, but seriously, Microsoft is incompetent on their best day.

Re:POD has long since been patched. (1)

Ironhandx (1762146) | more than 2 years ago | (#37041094)

You don't recall correctly. You were right about the first bit, he was right about the second.

MS did not use the BSD stack, however their new TCP stack was invented for Vista.

Its got a long ass way to go to mature. Its sad that they didn't revert that one change for Windows 7.

From what I understand its supposed to allow more functionality eventually. I can't really see what sort of functionality you need out of a tcp stack that wasn't already there. Anything else can be bolted on top.

Re:POD has long since been patched. (1)

ozmanjusri (601766) | more than 2 years ago | (#37041170)

I can't really see what sort of functionality you need out of a tcp stack that wasn't already there.

Deep packet inspection and silent (hidden) report-to-base capabilities.

Re:POD has long since been patched. (1)

jamesh (87723) | more than 2 years ago | (#37041336)

From what I understand its supposed to allow more functionality eventually. I can't really see what sort of functionality you need out of a tcp stack that wasn't already there. Anything else can be bolted on top.

Have you ever used the IPv6 "bolted on top" of the XP/2003 TCP/IP stack? The Vista implementation is much better. Guess why.

Re:POD has long since been patched. (1)

benjymouse (756774) | more than 2 years ago | (#37041488)

I can't really see what sort of functionality you need out of a tcp stack that wasn't already there. Anything else can be bolted on top.

From Windows Internals, Fifth Edition (Mark E. Russinovich; David A. Solomon; Alex Ionescu):

The Next Generation TCP/IP Stack offers several advanced features to improve network performance, some of which are outlined in the following list:

  • Receive Window Auto Tuning. The TCP protocol defines a receive window size, which determines how much data a receiver can accept before the server requests an acknowledgment. A higher size favors low-latency networks with high throughput, while lower values work better on networks such as Wi-Fi. The Windows TCP/IP stack is capable of analyzing the conditions of a network and choosing the optimal receive window size, adjusting it as needed if the network conditions change.
  • Compound TCP (CTCP). While automatically changing the receive window size allows more data to be received, CTCP aggressively increases the amount of data that can be sent by a machine, while monitoring bandwidth, latency, and packet loss. Using CTCP on a high-bandwidth, low-latency network can significantly improve transfer speeds. CTCP is disabled by default.
  • Explicit Congestion Notification (ECN). Whenever a TCP packet is lost, the TCP protocol assumes that the data was dropped because of router congestion and enforces congestion control, dramatically lowering the sender's transmission rate. ECN allows routers to explicitly mark packets as being forwarded during congestion, which is read by the Windows TCP/IP stack as a sign that transmission rates should be lowered. Lowering rates in this manner results in better performance than relying on congestion control. ECN is disabled by default.
  • High-loss throughput improvements, including the NewReno Fast Recovery Algorithm, Enhanced Selective Acknowledgment (SACK), Forward RTO-Recovery (F-RTO), and Limited Transit. These algorithms reduce the overall retransmission of acknowledgments or TCP segments during high-loss scenarios while still maintaining the integrity of the TCP stream. This allows for greater bandwidth in these environments and preserves TCP's reliable transport semantics

Re:POD has long since been patched. (2)

Jah-Wren Ryel (80510) | more than 2 years ago | (#37041544)

FWIW all of those things are part of a good modern stack and technically not more functionality. I too struggled to figure out what might qualify as "more functionality," the only things I could think of would be support for new protocols or "replacement" implementations - like an app could pass a function pointer to the stack and say "for my connections, use this code to do the tcp processing instead of what came with the kernel" or possibly define an entirely new protocol that could be application defined but still run in the kernel context for efficiency.

Of course the alternative is that "more functionality" isn't the right words to describe MS's intent and what they really said or meant was closer to "easier for MS's engineers to modify in the future."

Re:POD has long since been patched. (0)

Anonymous Coward | more than 2 years ago | (#37041710)

http://technet.microsoft.com/en-us/network/bb545475

This explains the new features. You will either instantly know that this requires a complete rewrite, or you do not really understand how a protocol stack is implemented.

Re:POD has long since been patched. (-1)

Anonymous Coward | more than 2 years ago | (#37040668)

I remember when a friend downed his ISP with the PoD, and they were running Linux. He told them that they had a problem, but they told him it was fixed. He tried it on a Friday, and the ISP wasn't back online until Monday....

Patch = turn off ping support? (0)

Karljohan (807381) | more than 2 years ago | (#37040722)

Why, then, are Windows machines never responding to ping calls? This has been the case at least on all networks I've been on. Did the patch of Windows simply turn off the ping server service?

Re:Patch = turn off ping support? (3, Informative)

eht (8912) | more than 2 years ago | (#37040858)

Since Windows XP SP2 I think it was the firewall is turned on by default(or at least really really encourages you to do so) and blocks ping responses and was released August 25, 2004.

EnableICMPRedirect in TCP Parameters (0)

Anonymous Coward | more than 2 years ago | (#37042448)

HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters

EnableICMPRedirect = 1

* This stops PING responses IF set to = 1 (0 of course, re-enables it)... I've been using this as a defense vs. ICMP "Ping-Of-Death" attacks since, oh, around 1996-1997, or thereabouts, iirc...

APK

P.S.=> Take a read here for more detailed information, "straight-from-the-horses'-mouth" @ Microsoft:

http://technet.microsoft.com/en-us/library/cc739622(WS.10).aspx [microsoft.com]

and, of course, a verification for you that PING does indeed rely on ICMP, here:

http://en.wikipedia.org/wiki/Ping [wikipedia.org]

... apk

Re:POD has long since been patched. (1)

Anonymous Coward | more than 2 years ago | (#37042562)

When I was in college I once witnessed it put to good use. I was over in a friend's dorm room. It was 2 am and the asshole above him was playing Quake with the volume at 11. It was a well known secret at the time that the network admins kept a "hidden", but world-readable list on the unix server of every IP address in the school, including who it belonged to, what room, and what wall port. So my friend grepped the list for the room number above him, guessed which wall port, and then POD nuked the IP address associated with it. The sound instantly stopped.

The guy tried launching it a couple more times, gave up after being "denied".

Re:POD has long since been patched. (0)

Anonymous Coward | more than 2 years ago | (#37043266)

Not just Linux. HPUX, AIX, NeXT, and Solaris were all vulnerable in my lab when this first surfaced in ~1995. Linux was patched in days. The others took quite a bit longer.

Didnt bluescreen (1)

antifoidulus (807088) | more than 2 years ago | (#37040566)

The ping of death didnt cause your computer to blue screen, it caused it to become a picture frame. Everything, including the mouse pointer, would just stop.

Re:Didnt bluescreen (1)

sg_oneill (159032) | more than 2 years ago | (#37040650)

Depends which windows. At least one of the NTs definately would bluescreen.

I actually had this on a function key on my mIRC client, so that if someone was trolling the IRC channel, I'd highlight their name, hit F10 (or something) and it'd kick them, ban them, then win-nuke them. More malicious types would just drop a bot into a channel and nuke everyone in there. God damn the dial-up days where wild sometimes.

Re:Didnt bluescreen (1)

antifoidulus (807088) | more than 2 years ago | (#37040656)

Ah, by the time I started using NT the ping had already been fixed, Windows 95(98?) would picture frame though.

Re:Didnt bluescreen (3, Interesting)

devphaeton (695736) | more than 2 years ago | (#37040882)

God damn the dial-up days where wild sometimes.

Fugganaye right. I shouldn't admit any of this, but I was into scrolling chat rooms* back in the mid-late 90s and it was the fucking Wild West. Winnukes and Portfloods for days and days. Javascript exploits and whatnot. People getting pWn3d for no good reason. You had to be patched and armed just to stay in the joint.

There was a guy that flexed his hax0r muscle at everyone, but especially gave me shit. Seriously unprovoked bullshit, following me from room to room, then later site to site. I could write a book on this, but basically through some elaborate social engineering of several people (including his school) I was able to determine his home address. I bribed a high school friend of mine who was going to a school in the next city over to go take a picture "of the white house at this address" and send it to me. Some low-tech scanning practices and some floppy disk work at a local Staples ensued.

The next time he fucked with me I posted the pic of his house in the chat room. I wish I had logged his responses, and the crying he did to my alt (the social engineering 'chick') over the next few days. He never messed with me or anyone else in the place again. It was a pretty good hack, and I dreamed guys like Kevin Poulsen would approve. But I actually felt pretty dirty afterwards.

*hotelchat ftw!

Re:Didnt bluescreen (3, Interesting)

Isaac-1 (233099) | more than 2 years ago | (#37041192)

Yeah, the wild west days, I remember hanging around on IRC on #userfriendly where much of the crowd were of the IT types working in the .com boom which was very wild west itself. One night one of the regulars posted a message that she was on dial up and was being ping flooded by some guy with a cable modem, and asked someone ping flood the guy off the net so she could upload an important file before it was due in a few minutes. Well the moments afterward were one of those things where you look back and think, hey maybe too many people decided to unleash too much fire power at once. Sure there were those that were sitting on T1, T3, etc. lines at the time that reacted to the call within seconds, but there were also a few BIG GUNS aimed at this lowly cable modem user's IP within seconds. Think core routers from big name national ISP's, and .COM giants. When the smoke cleared a minute or two later everyone realized not only was the cable modem user in question off the net, but so was his cable provider.

Holy Nuke It From Orbit, Batman! (1)

rts008 (812749) | more than 2 years ago | (#37041528)

Wow!
What a revelation for me.
I say this as a former n00b-troll.

I will say that this 'lesson gave to me' in my ms- spent[sic] [1]youth had a profound positive influence on my internet behavior, except when i 'drink while posting' here on /., sad to say.
Again, wow.
Thanks very much, BTW, really.

[1] Some habits are hard to break. ;-)
As my wife has said about me many times, "At least he's house-broke, but he's not domesticated. But, I've never shopped at 'Normal-Boys-R-Us'. Ever!"

Re:Didnt bluescreen (1)

Shinobi (19308) | more than 2 years ago | (#37041856)

I was there for that, "borrowing" my school's connection.

And yes, I used this nick in the channel.

Re:Didnt bluescreen (1)

Anonymous Coward | more than 2 years ago | (#37042820)

Not only can you not ignore the collateral damage, people should also have asked themselves if the alleged flooder had actually done anything at all. People regularly ask for help with retaliating when they're actually just looking for someone else to carry out their (first-strike) attack for them. Attacks under the guise of "active defense" are a very old tactic - Poland certainly won't forget.

Re:Didnt bluescreen (1)

Shinobi (19308) | more than 2 years ago | (#37041880)

The thing is, most of those knew NOTHING about TCP/IP, so my standard reply when people asked for my IP addy was to reply with 127.0.0.1 (and yes, that worked for PoD vs Windows...)

In school, we used it to knock the Quake players offline, so people could do their homework etc on the school computers.

Re:Didnt bluescreen (1)

MobileTatsu-NJG (946591) | more than 2 years ago | (#37040902)

It took me an entire week of being 'nuked' several times a day to figure out Win95 was being less stable than usual.

Re:Didnt bluescreen (0)

Anonymous Coward | more than 2 years ago | (#37043200)

hah i remember back in 98 or so irc.scifi.com we would manually ping flood operators out of a channel... fortunately didn't have reconnect scripts and the servers didn't have much in the way of services... we would wait til there were just 3 or 4 of them... manually flood each of them off the server using like 5 or 6 people doing it, until they were all out of the channel, then all but one would /part the other would bounce back in real quick to take over the channel... fun times.

Re:Didnt bluescreen (0)

Anonymous Coward | more than 2 years ago | (#37043230)

It was the wild wild west then! amen to that! One of the reasons why the net has become so boring for me now :(. It was fun to code and to follow security mailing list then!

+selven

Re:Didnt bluescreen (1)

dzfoo (772245) | more than 2 years ago | (#37042366)

I had Win95 at the time, and it did bluescreen.

Ah, the memories. I remember being naive, and searching frantically around the intertubes looking for a "how to" document explaining how to employ the "Ping Of Death" that I just recently read about.

My search took me to IRC, where--true to n00b form--I proceeded to ask a very dumb question:


DZ> Can someone show me how to do the ping of death?
Someone> Like this...

[blue screen]

My girlfriend was right next to me and thought it was the funniest thing. I did so too. Eventually I played the same trick on other unsuspecting kiddies.

Funny.

          -dZ.

Ping of Win (1)

timberwolf753 (1064802) | more than 2 years ago | (#37040586)

I remember doing that to my father because he would not let me play Doom. So i went to the other room and Pinged him till the computer would reboot and he would call me to fix it. After what he was done with on the computer he would let me play doom. "Step 4. Profit" was achieved in those early days of computing.

Re:Ping of Win (-1)

Anonymous Coward | more than 2 years ago | (#37040630)

I remember when people wrote coherent messages and September ended.

More Information Please (0)

Anonymous Coward | more than 2 years ago | (#37040744)

I thought the POD worked because once the packets were reassembled they ended up larger than the buffer that was created to hold them.

This needs much more information than subby turning a 3 page article into one paragraph with errors.

Misleading title (1)

FrootLoops (1817694) | more than 2 years ago | (#37040758)

To be clear, this bug hasn't been in Windows since the 1990's (which is how I read the title). From TFA:

The bug exists in Windows Vista, Server 2008, Windows 7 and Server 2008 R2, Microsoft said, but not in Windows XP or Server 2003.

Re:Misleading title (3, Insightful)

Psychotria (953670) | more than 2 years ago | (#37040938)

It would make more sense if you provided context for your quote

Storms said it appeared that today's "Ping of Death" bug was a different vulnerability than Microsoft patched in its now-ancient OSes of the 1990s.

The bug exists in Windows Vista, Server 2008, Windows 7 and Server 2008 R2, Microsoft said, but not in Windows XP or Server 2003.

Re:Misleading title (1)

FrootLoops (1817694) | more than 2 years ago | (#37041858)

I don't know what "different vulnerability" means, so I'm not sure what that extra sentence adds. I have two interpretations: (1) a bug was introduced, patched, and all relevant code was rewritten in Vista, introducing the original error again; (2) two rather similar but somehow fundamentally different bugs were introduced, one in the 90's and one in the Vista rewrite. That's guesswork, though, and as far as I recall not backed up by the article.

Re:Misleading title (0)

Anonymous Coward | more than 2 years ago | (#37042630)

Complete Crap.
The mentioned CVE is not listed in Mitre's database as a vulnerability yet and it is not mentioned in the linked security bulletin. Furthermore, the security bulletin updates Internet Explorer and is not a core flaw in the OS networking stack like ping of death.

Re:Misleading title (1)

AmberBlackCat (829689) | more than 2 years ago | (#37041168)

I think Microsoft would do the United States a big service to remove ping from consumer versions of Windows altogether. People may want to ping another server to test their connection speed but no home user needs their own computer to respond to a ping.

Re:Misleading title (4, Insightful)

guruevi (827432) | more than 2 years ago | (#37041204)

That is stupid. Any IP host should respond to a ping. It's one way of testing if everything is working. Disabling ping just because your IP stack is buggy is security through obscurity. ICMP has to be implemented according to standard.

Re:Misleading title (1)

Anonymous Coward | more than 2 years ago | (#37041920)

You have obviously never worked with technical support for an ISP. Oh how I hate that almost no Windows-machines respond to ping, because all firewalls, including the one built into Windows disables ICMP by default. I love Mac:s and (the occasional) Linux machine you run into, because they do respond, making troubleshooting a whole lot easier.

I think that every machine should respond to ping, it's just silly not to.

Georgia and the United States six flags park (-1)

Anonymous Coward | more than 2 years ago | (#37040826)

Georgia and the United States six flags park
For north face sale [onsalethenorthface.org] example, professional stores, the customer driven or frequent long distance only once in a while might benefit from the text information, they remind happened to be in the neighborhood.What is like a roller coaster of pleasure and visit the theme park attractions and the voice.Georgia and the United States six flags park
For north face sale [onsalethenorthface.org] example, professional stores, the customer driven or frequent long distance only once in a while might benefit from the text information, they remind happened to be in the neighborhood.What is like a roller coaster of pleasure and visit the theme park attractions and the voice.Georgia and the United States six flags park
For north face sale [onsalethenorthface.org] example, professional stores, the customer driven or frequent long distance only once in a while might benefit from the text information, they remind happened to be in the neighborhood.What is like a roller coaster of pleasure and visit the theme park attractions and the voice.Georgia and the United States six flags park
For north face sale [onsalethenorthface.org] example, professional stores, the customer driven or frequent long distance only once in a while might benefit from the text information, they remind happened to be in the neighborhood.What is like a roller coaster of pleasure and visit the theme park attractions and the voice.

Too bad... (0, Flamebait)

Anonymous Coward | more than 2 years ago | (#37040846)

those of us stuck with Windows XP Pro SP1 (due to software/hardware issues) can't run this patch. Well, is there a workaround? To force it to patch without getting SP3 as it says it requires?

Seriously. I've tried upgrading to SP2 twice and it created nothing but problems. Very slow and some software broke. Plus on my other machines I found out SP2 changes IE6.

Re:Too bad... (0)

Anonymous Coward | more than 2 years ago | (#37041018)

Hmm, maybe you should join the 21st century and upgrade to Fedora 15...

None of these script kiddies are going o get my IP (2)

Velox_SwiftFox (57902) | more than 2 years ago | (#37041048)

at 127.0.0.1 they'll find out it's armored beyond anything they can come up with

Re:None of these script kiddies are going o get my (0)

Anonymous Coward | more than 2 years ago | (#37041134)

He's pulling your leg, script kiddies. You're not going to let him get away with it, are you? His real IP address is 127.37.164.116. Now, go get him.

Re:None of these script kiddies are going o get my (0)

Anonymous Coward | more than 2 years ago | (#37041356)

at 127.0.0.1 they'll find out it's armored beyond anything they can come up with

Dude I got in easily and you have so much warez and porn on your computer, some pretty sick stuff too

Re:None of these script kiddies are going o get my (1)

laejoh (648921) | more than 2 years ago | (#37041382)

It works even better if you provide 127.1.37.8 as your ip address! Some people start to recognize 127.0.0.1 :)

Re:None of these script kiddies are going o get my (0)

Anonymous Coward | more than 2 years ago | (#37042218)

What a coincidence. That's the same combination as my VPN.

No matter you are in this situation (-1)

Anonymous Coward | more than 2 years ago | (#37041104)

No matter you are in this situation
This north face sale [onsalethenorthface.org] is any family difficulties and embarrassing time. The important thing is to find the real estate agent, can help guide you to complete this process, to help protect your interests. No matter you are in this situation, the seller or the buyer, the sun island experts can help you enjoy in these difficult trading smooth transition. There is no doubt that foreclosure and short without any ideal.
No matter you are in this situation
This north face sale [onsalethenorthface.org] is any family difficulties and embarrassing time. The important thing is to find the real estate agent, can help guide you to complete this process, to help protect your interests. No matter you are in this situation, the seller or the buyer, the sun island experts can help you enjoy in these difficult trading smooth transition. There is no doubt that foreclosure and short without any ideal.
No matter you are in this situation
This north face sale [onsalethenorthface.org] is any family difficulties and embarrassing time. The important thing is to find the real estate agent, can help guide you to complete this process, to help protect your interests. No matter you are in this situation, the seller or the buyer, the sun island experts can help you enjoy in these difficult trading smooth transition. There is no doubt that foreclosure and short without any ideal.
No matter you are in this situation
This north face sale [onsalethenorthface.org] is any family difficulties and embarrassing time. The important thing is to find the real estate agent, can help guide you to complete this process, to help protect your interests. No matter you are in this situation, the seller or the buyer, the sun island experts can help you enjoy in these difficult trading smooth transition. There is no doubt that foreclosure and short without any ideal.

Ping of Death == WinNuke? (1)

tekrat (242117) | more than 2 years ago | (#37043114)

There used to be a Macintosh Application called WIN-NUKE, and we'd use it to crash NT-based web-servers. I think this was during the days of NT3.5, and Macs were still running System 7.1 or something like that.

Anyhow, we were a Mac/Linux shop at the time, and during the dot-com boom, there was this dopey company called "muffinhead", we thought that was a dumb name, so we'd win-nuke them constantly.

We'd ping them from the linux box, see a continuous stream of replies, run win-nuke, and then... the pings would stop, and we'd know they were down.

Back in the early days of the web, you could easily take down half your competition in New York if you were interested enough in doing that. Generally though, my company had enough work that we weren't all that interested - that is, until the boom went bust, and then we were hunting for scraps of work like everyone else.

Load More Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Sign up for Slashdot Newsletters
Create a Slashdot Account

Loading...