Denial of Service with Windows XP Seite 1 von 18

Why Windows XP will be the

Exploitation Tool of Choice

for Internet Hackers Everywhere
by Steve Gibson, Gibson Research Corporation

Page last modified: Jun 11, 2001 at 01:40

Another LONG page . . .

I know that this is another of my loooooong pages. I worry that it won't be
nearly as fascinating as my account of Wicked and the DDoS attacks.
However, this is a complex and important issue that can not be quickly
summarized.
If you are someone who eats dessert first, I urge you to at least read the
story of "'Junior' and his XP Gang". (click the link) then I hope you will want to
come back up here and start from the beginning.

" Steve,
I've reviewed your note with the Windows network
development architects, as well as our Corporate IT Security
and Security Response groups. Your instincts are correct --
they thoroughly understood the nature of the issue . . ."
— A Microsoft Executive

With all due respect to Microsoft, I believe that either the right
people within the organization are not yet fully aware of this issue,
or that they have not really "thoroughly understood the nature of
the issue."

Microsoft has a lot of really smart people — from Bill Gates and Steve Ballmer
right on down the line. But they are human, and they sometimes make human
mistakes. Sometimes it's worse than that, and as a company they're stubborn in
the face of some really bad decisions. Like script-enabling their eMail clients so
the virus du jour, like Melissa, can impersonate the user and happily eMail itself
across the Internet to everyone in our address books.
What a DUMB thing.

My concern today is that we have another

SERIOUSLY DUMB IDEA in the works
[Link] 11.06.2001
Denial of Service with Windows XP Seite 2 von 18

from Microsoft in Windows XP.

I regret my silence when scripting was being added to eMail. It was the dumbest
thing I had ever seen, but I didn't care since I use Eudora. So I didn't work to
make the world take notice. Now eMail viruses are born daily to travel the
Internet at light speed. And it could have — should have — been prevented.

This time, with the disaster of Windows XP support for "RAW SOCKETS" looming,
there is still time to get Microsoft to yank it out. But as the correspondence
below demonstrates, I have not yet managed to reach the right people or
convince them that they must. I need YOUR help!

What are "Sockets"?

And why are some of them "Raw"?

Circa 1981 — The Computer

Systems Research Group (CSRG),
at the University of California at
Berkeley, first mated the Unix
operating system to the Internet.
This was done by implementing
the Internet protocols and creating
a so-called "TCP/IP Stack" for
Unix. This is shown as concentric
regions in the diagram to the left.

To simplify the task of creating

Internet-communicating
applications, the CSRG designed a
simplified abstraction of the
complex underlying protocols.
They dubbed this abstraction
"Sockets" or "Berkeley Sockets".
Under this system, application
programs request easily-
programmed Internet "sockets"
and are insulated from the details
of the underlying network
protocols.

Data is exchanged across the Internet by either establishing a bi-directional "TCP

Connection" between two machines, or by sending a uni-directional "UDP
Datagram" message from one machine to another. Both of these data
transferring operations employ standard sockets.

Smooth and orderly traffic flow across the Internet requires machines to inform
each other of various non-data events such as closed ports, network congestion,
unreachable IP addresses, etc. The ICMP (Internet Control Message Protocol) was
created to fill this need.

The operating system's built-in TCP/IP stack automatically and transparently

generates and receives most of these "Internet plumbing" ICMP messages on
behalf of the machine. To facilitate the creation of Internet plumbing applications,
such as "ping" and "traceroute", which also employ ICMP messages, the Berkeley
designers allowed programmers to manually generate and receive their own

[Link] 11.06.2001
Denial of Service with Windows XP Seite 3 von 18

ICMP, and other, message traffic. As shown in the diagram above, the Berkeley
Sockets system provides this power through the use of a so-called "Raw Socket".
A Raw Socket short-circuits the TCP/IP stack to open a "backdoor" directly into
the underlying network data transport.

This provides full and direct "packet level" Internet

access to any Unix sockets programmer.

Beyond their use for supporting simple "ping" and "traceroute" commands, the
original Berkeley designers intended Raw Sockets to be used for Internet
protocol research purposes only. Because they fully appreciated the inherent
danger of abuse of Raw Sockets, they deliberately denied Raw Socket access to
any applications not running with maximum Unix "root" privileges. User-level
applications were thus prevented from accessing and potentially abusing the Raw
Sockets capability. (See asterisk '*' in diagram above.)

Full Raw Sockets were created as a potent research

tool. They were NEVER INTENDED to be shipped in a
mass-market consumer operating system.

The Traditional (safe) Microsoft Stack

Compare the schematic diagram

we've been looking at above, to
Microsoft's traditional Windows
Sockets (WinSock) implementation
to the left.

You will notice that the Windows'

Raw Socket's connection does not
"penetrate" the encompassing IP
wrapper layer.

This means that while Windows'

Raw Sockets can be readily used
for their intended and safe
purpose of generating valid ICMP
ping and traceroute packets,
application programs are
effectively cut off from direct
"lower-level" access to the
underlying physical Internet.

As I stated in my DDoS Strange

Tale Report, and as I will
demonstrate and prove
conclusively below . . .

Windows' traditional lack of full Berkeley Unix Raw

Socket support has been a silent blessing that
has undoubtedly contributed hugely to the
stability of the global Internet of the past.

[Link] 11.06.2001
Denial of Service with Windows XP Seite 4 von 18

It is the Internet's future that concerns me greatly . . .

What IS the threat from Full Raw Sockets?

I constructed the diagrams above in the form of insulating layers surrounding the
system's network core to help demonstrate that the operating system's IP and
TCP/UDP protocol layers serve to protect the Internet from direct access by
malicious application software running inside the system.

Any system whose fundamental architecture prevents

applications from gaining "Raw" access to the
Internet will be MUCH harder to exploit.

As I will show with concrete examples below, these layers of "Internet

insulation", which were traditionally provided by Microsoft's "half-baked" Raw
Socket implementation, HAVE BEEN A VERY GOOD THING for the Internet so far.
But now Microsoft has fatally pierced this insulation by providing full Unix-style
Raw Sockets in a high-volume, impossible to secure, consumer operating system.

As proven by the success of the Windows NT server platform (lacking full Raw
Sockets support) and the successes of the Internet-connected Windows
95/98/ME platforms (also lacking full Raw Sockets), full Raw Socket support is
absolutely unnecessary for the use of ANY benign Internet applications.
Extensions to the Internet protocols, which represent a valid use for Raw
Sockets, would be performed within the operating system's network core.
"Sockets" are an application-level interface, not a system level resource, and
applications have no valid need for full Raw Sockets. None.

In other words, what Microsoft has done with Windows 2000 and Windows XP, is
to add a number of powerful and completely unnecessary networking features
because, they say, "some people complained about Windows lack of full Raw
Socket support". However, it will ONLY be Internet hostile and malicious code
that needs and uses the advanced "direct access" provided by Windows' new full
Raw Socket support.

With Microsoft's traditionally-limited Raw Sockets support, Windows applications

were UNABLE to "forge" or "spoof" the machine's actual IP address to hide the
source of any malicious traffic it might generate. This source address "spoofing"
prevents effective backtracking through the Internet. Windows applications were
also unable to generate deliberately malicious "SYN flooding" style attacks which
are essentially unfilterable and are used to effectively attack any sort of Internet
TCP-connection server.

Until the advent of Windows 2000 & XP, the familiar, complex, potent, and
untraceable Denial of Service and Distributed Denial of Service attacks have
only been generated from Unix-family operating systems. Due to the sheer
volume of Windows XP machines soon to be loose in the world, Unix systems will
quickly be supplanted as the premiere launching pad for new torrents of Denial of
Service floods. This will have an unfortunate corollary effect for XP users:

The huge number of Windows XP machines will motivate

hackers to find new ways into those machines — AND
THEY WILL. Then users of Windows XP machines will
become the most sought-after target for penetration.

[Link] 11.06.2001
Denial of Service with Windows XP Seite 5 von 18

In other words, the use of the high-power, mass-market and unsecurable

Windows XP operating system, promises to paint a big target on every user of
that system.

In the hands of a clueful hacker, fully-supported Raw Sockets is the enabling

factor for the creation of a series of "Ultimate Weapons" against which the
fundamentally trusting architecture of the global Internet currently has no
effective defense.

Windows XP is the malicious

hacker's dream come true.

My Initial Dialog with Microsoft . . .

A look at my initial attempts to prevent this . . .

Hi Greg,

It's been a while since we've talked.

I'm writing to you first for some navigational direction. Windows 2000 and the
forthcoming new MS platforms offer something never before seen in any
Microsoft platform: A complete implementation of the Windows sockets RAW
SOCKETS specification.

While, as a networking developer, I *love* the idea of having this much

power, there is a serious DARK SIDE to this which troubles me greatly: For
the first time ever, software running on Windows platforms -- including,
presumably, the Home-Targeted Windows XP -- will be able to trivially
generate IP packets carrying spoofed Source IP addresses.

Before now, the many tens of thousands of Trojans and Zombies being
installed into insecure Windows boxes across the Internet on high-bandwidth
connections have been COMPLETELY UNABLE to spoof their source IP's. This
has been a blessing, since, until now, only UNIX derived boxes have had
complete RAW_SOCK support.

But with Windows 2000, and WinXP, etc. ... Windows applications will be able
to forge their "return address" -- which spells catastrophe for the integrity of
the Internet.

I would appreciate having you forward this note to whomever should receive
it. I need to understand Microsoft's formal position on this before I go off and
make a big bunch of noise and draw the world's attention to this impending
threat to the operation and security of the global Internet.

Thanks for your time and attention to this matter.

Oh! ... and while I've been intending to mention this danger for some time, I
stumbled upon a chunk of hacker source code a few days ago that frightened
me a lot:

(Taken directly from hacker source code)

[Link] 11.06.2001
Denial of Service with Windows XP Seite 6 von 18

>-------------------------------------------------------------
>
> 6. Some words about DDoS from Windows OS.
> The new feature IP_HDRINCL that comes with win2k can make
> windows to a powerful DDoS server because it enables IP-
> spoofing!
>
> THE IP_HDRINCL
> setsockopt(ssock, IPPROTO_IP, IP_HDRINCL, (char *)&bOpt,
> sizeof(bOpt));
>
> That means win2k-servers can become a base for DDoS that
> is equal to Unix servers.
>
>------------------------------------------------------------

I sincerely hope that you and Microsoft will sufficiently appreciate the
significance of this problem, and the danger it represents.

Please keep me in the cc-chain and let me know what, if anything, transpires.

All the best!

____________________________________________________________
Steve.

Greg was terrific about following up. I received a few progress reports as my note
went through "channels". Then a couple of days later I received the following
complete reply:

Steve,

I've reviewed your note with the Windows network development architects, as
well as our Corporate IT Security and Security Response groups. Your
instincts are correct -- they thoroughly understood the nature of the issue ... I
guess the response is sort of "good news, bad news" story, depending on your
point-of-view. In a nutshell, it will be very much harder to get hostile code
running on a Windows XP system than on a Windows 9x, or even a Windows
2000 system ... but a determined hacker still can ... If you'd like to speak to
someone about the issue in more detail, I'd be happy to arrange.

Here's the summary:

Your concern is the ease of spoofing the IP address under which a Windows
2000 or Windows XP system operates on the Internet. You believe that our
providing a raw sockets option will make it much easier for malicious parties
to develop zombie code that is capable of operating with a spoofed source
address.

You're particularly concerned with Windows XP which, as a consumer

system, will be very widely represented on the Internet and operated by naive
home users who won't have the time or expertise to take active steps to
configure their systems securely.

Windows 9x and NT systems have for some time offered the capability to
send raw packets from the NDIS layer. This capability is just as exploitable for

[Link] 11.06.2001
Denial of Service with Windows XP Seite 7 von 18

IP spoofing as the IP_HDRINCL API is.

The real issue here is more the ability to get control of the zombie system
than the ease of writing the zombie code that exploits it. If I can get code
running on a system, it's pretty much guaranteed that I can write code to
exploit it. The issue is only one of how much code I have to load onto the
zombie and how hard it is to get it right (neither a trivial issue, but neither a
showstopper for the hacker).

It is much harder to get hostile code running on a properly configured

Windows 2000 system than on an Windows 9x system. While proper security
configuration takes some work and expertise, we do provide tools and
guidelines to help with this task. Because Windows 2000 primarily appeals to
technical home users, we believe this is a reasonable balance.

It will be very much harder to get hostile code running on a Windows XP

system than on a Windows 9x, or even a Windows 2000 system. The
integrated Internet Connection Firewall will be enabled by default for users
who go through the wizard that connects an XP system to the Internet. A
number of system default settings have been tightened to make it harder to
get code that makes it through the firewall to run (for example, Outlook XP,
Outlook 2000 SR2, and Outlook Express V6 all process HTML e-mail messages
in the IE Restricted Sites zone).

In summary, our security folks believe that it will be significantly harder to get
an army of zombies running on XP systems than has been the case today with
Windows 9x. Unfortunately, even if we prohibited sock_raw, determined
hackers can go around that restriction ...

Finally, as to the actual "why are providing a raw sockets option" ? , I'm told
it's less about "need", and more a response to customer demand for Winsock
standard compliance.

As I said, please let me know if you'd like to speak with someone about this.
And if you think we are absolutely nuts, then I really would like to know about
that, too. I can only assume that you will expose your point of view to your
readership on your web site, and if you think we are being insanely
irresponsible, then I'd rather hear it from you first, than read it on your site...

Thanks, and have a great weekend!

Greg

I will respond, in detail, to these points Microsoft has raised. But first I would like to
raise and respond to some of the other questions raised early in this controversy . . .

A Standard by any other Name

Windows 2000 (NT5) was the first Microsoft Windows platform to bring the full
"Berkeley Sockets" specification — including Raw Sockets — to WinSock. Until this
time, there had been essentially NO APPARENT CHANGE in Microsoft's TCP/IP stack.

In fact, while discussing the OS Fingerprinting capabilities of his well-known "nmap"

Internet scanner, nmap's author Fyodor, has this to say about nmap's detection of
Windows versions:

[Link] 11.06.2001
Denial of Service with Windows XP Seite 8 von 18

[...] Even with all the tests above, nmap is unable to distinguish between
the TCP stacks of Win95, WinNT, or Win98. This is rather surprising,
especially since Win98 came out about 4 years after Win95. You would
think they would have bothered to improve the stack in some way (like
supporting more TCP options) and so we would be able to detect the
change and distinguish the operating systems. Unfortunately, this is not
the case. The NT stack is apparently the same crappy stack they put into
'95. And they didn't bother to upgrade it for '98.
But do not give up hope, for there is a solution. You can simply start with
early Windows DOS attacks (Ping of Death, Winnuke, etc) and move up a
little further to attacks such as Teardrop and Land. After each attack, ping
them to see whether they have crashed. When you finally crash them, you
will likely have narrowed what they are running down to one service pack
or hotfix.
I have not added this functionality to nmap, although I must admit it is
very tempting :).

If you read though Fyodor's fingerprinting description, you will see that nmap is a
superlatively sensitive detection tool that can generally sense even the tiniest changes
in the implementation of a system's TCP/IP stack. Yet Microsoft's stack apparently
never changed . . . until it suddenly changed significantly.

An intriguing rumor is that Microsoft lifted the source code for their now advanced
TCP/IP stack directly from version 4 of the FreeBSD operating system project.
Although I've heard this from several different sources, I have not confirmed it one
way or the other. But if true, it might be germane within the context of this
controversy: Perhaps Microsoft just doesn't know how to turn off the full Raw Sockets
support, even if they wanted to.

In any event, several people have been quoted in the press defending Microsoft's
stance by simply stating that "following standards is a good thing".

I agree that following good and safe standards can be a good thing. But it seems to
me that blindly following a standard for its own sake, just because someone said it
was "standard", and lacking an understanding and independent evaluation of that
standard's merit in the intended application, is tantamount to replacing your own
judgement with someone else's. I would disagree that, for a well-informed person,
doing that is always a good thing.

It must also be that these people have never actually programmed the Windows
Sockets system (as I have extensively). Because there is very little about Microsoft's
Sockets — with their wild extensions (which I love by the way) — that in any way
follows any "standard". So the truth is, that either with or without full Raw Socket
support, Windows Sockets never has been, and never can be, "standard" in any way,
shape, or form.

Windows 2000 -vs- Windows XP

Other people have noted that Windows 2000 is already out in the world with full Raw
Socket support. They seem to believe that my lobbying so firmly against the
subsequent release of WinXP — with its similar Raw Sockets — is the equivalent of
closing the barn doors after all of the horses have escaped.

These people miss the essential aspect of "scale". If Microsoft were going to sell only a
few thousand copies of Windows XP, I would not be wasting either your time or mine

[Link] 11.06.2001
Denial of Service with Windows XP Seite 9 von 18

with this entire issue. But whereas Windows 98 and Windows ME have been largely
uninteresting upgrades, Microsoft has loaded so many new goodies into WinXP that it
will make for a compelling Christmas season.

Microsoft has executed this perfectly: In the near

future, Windows XP is going to become THE generic
consumer personal computer operating system.

Therefore, my concern is with the DEFAULT feature-set of the system and with the
probable size of that feature-set's installed base. Sure, I wish that Windows 2000 were
also "Raw Sockets Neutered" so that malicious hackers could not assume that all
Windows 2000 machines were exploitable. I have no problem with the idea of an after-
market add-on download pack from Microsoft, or of making the "deluxe stack"
available in a Windows XP resource kit or MSDN subscription.

It is the idea that EVERY CONSUMER MACHINE will have such

dangerous capabilities that are NOT NEEDED AT ALL for Internet
connectivity, that strikes me as being SO unnecessarily
dangerous and . . . ultimately . . . dumb dumb dumb!

Microsoft Reacts
After the May 31st release of my widely read DDoS attack report, in which I was
strongly critical of Microsoft's publicly stated and confirmed intentions to equip the
consumer-targeted Windows XP with full Raw Sockets capabilities, Microsoft produced
and publicized a formal response on their TechNet web site. You should take a look at
that so that you have an updated sense for Microsoft's position:

[Link]

I will summarize what I read as Microsoft's stated position, point-by-point, and reply
to each in turn:

Microsoft's Position:

This is not really anything new, since previous versions of

Windows had support for Raw Sockets.

HUH?!!
This is a very disappointing position for Microsoft to be taking. Within the present
context, they MUST KNOW that this is simply not the truth. The entire debate centers
upon the distinction between partial and full Raw Socket support. So I can only
presume that Microsoft is hoping to achieve some quick public relations damage-
control, even at the ultimately extreme cost of sacrificing the truth.

On Friday, June 8th, the TechNet page referenced above states:

" . . . as raw sockets implementations are already present in Linux,
VMS, Unix, Mac OS X, and even in previous versions of Windows."
And in their first reply to me, shown above:
"Windows 9x and NT systems have for some time offered the
capability to send raw packets from the NDIS layer. This capability
is just as exploitable for IP spoofing as the IP_HDRINCL API is.

[Link] 11.06.2001
Denial of Service with Windows XP Seite 10 von 18

Here are three pieces of concrete evidence demonstrating that Microsoft is apparently
losing its grip on reality in their desperate need to discredit my position in this matter:

Proof #1:
My original note to Microsoft quoted from the "readme" file of a Windows DDoS
attack tool named Skydance v3.03:
"The new feature IP_HDRINCL that comes with win2k can make windows into a
powerful DDoS server because it enables IP-spoofing!" ...and...
"That means win2k-servers can become a base for DDoS that is equal to Unix
servers."
Also appearing on that readme page under the section "Client Usage", is the
following:
"The Client will try to use a spoofed source address. You should test your
spoofing-ability first to ensure that you can not be revealed. The test will fail on
WinNT and Win9x/Me systems. It should not fail under Win2000."

How much more plain can that be? Windows 9x/ME and WinNT DO NOT HAVE
the Raw Socket capability to spoof the machine's actual IP address. This was
only added into Windows 2000 and is now being carried down into the consumer
market by Windows XP.

Here, located on the "megasecurity" hacker site (provided with their knowledge
and permission), is the entire "readme" page for this typical Windows DDoS
attack tool. Note that it is not currently useable on any consumer-grade Windows
systems . . . but Microsoft's XP will soon be changing that, to the delight of
malicious hackers everywhere:

[Link]

I got a personal chuckle out of the last paragraph on that page. It talks about
the trouble with the new personal firewalls and suggests that by renaming the
DDoS Trojan to the name of a common Internet application (like "[Link]")
— which presumably has firewall permissions — you may be able to get past
outbound blocking firewalls by "impersonating" a permitted application.
Those of you who have been following my work at [Link] will note that this
was exactly the personal security problem I anticipated when I created and
promoted my free LeakTest utility. Its goal was to bring market pressures to
bear, thereby inducing firewall vendors to prevent this trivial exploit. At the
time of LeakTest's release, all but one firewall was vulnerable to this. But
today, every reputable firewall has been updated as a direct consequence of
LeakTest's influence.
As you might imagine, the personal firewall vendors were as furious with me
then, as Microsoft appears to be now. But those vendors are happy today,
and their users are much safer.
(So as not to confuse people, I should mention that BlackICE defender still
fails the LeakTest, and would therefore presumably allow this Trojan to
operate. However, Network ICE has stated that, despite the declarations on
their web site, BlackICE is not a firewall. So it is exempt from the class of
products I refer to as "reputable firewalls".)

While you're at the megasecurity site, take just a moment to browse through
their catalog of the Trojans which will soon be competing for space on Windows
XP hard drives:

[Link]

[Link] 11.06.2001
Denial of Service with Windows XP Seite 11 von 18

Under the "Requirements" section, the author explains:

"Currently working only under w2k."

Right.

This author is describing a classic SYN flooding attack using a spoofed Source IP.
NO PRIOR VERSION OF WINDOWS allows its applications to arbitrarily generate
Internet packets. As this example demonstrates, deliberately invalid — and
malicious — SYN packets can NOT be generated unless the application is running
on Windows 2000 . . . or, soon, Windows XP.

This sample highlights another interesting aspect of Microsoft's poor judgement

in this matter:

The threat of attacks is NOT ONLY from surreptitiously

installed remote-control Zombie/Bot Trojans, but from PC
hobbyists who will soon be able to gleefully launch
untraceable spoofed IP SYN-flooding attacks from the
comfort of their own bedrooms. Presumably after finishing
their homework.

The typical teenage hacker has not had access to Windows 2000. He or she has
been limited to playing video games on Windows 95/98/ME. But this Christmas
will change all that: When "Junior" asks Mom and Dad if he can get an upgrade
to the new really cool Microsoft Windows XP for Christmas, Mom and Dad will
smile and nod. "What a GREAT idea!" they think to themselves.

Yeah. Great.

Proof #3:
One of the most well known and sophisticated remote control attack Zombies is
named: Trinoo. This remote control Bot was originally written to run on
compromised Unix- and Linux-style platforms which, as we all know by now,
have traditionally been unique in having the ability to generate spoofed source IP
flooding attacks.

Trinoo was such a successful attack tool over on the *NIX platforms, that it was
"ported" to the Windows environment under the name: WinTrinoo.

But, of course, WinTrinoo's malicious capabilities are somewhat limited under

Windows. Unlike its Unix cousin, WinTrinoo can neither spoof source IPs,
nor generate SYN flooding attacks. You KNOW that WinTrinoo's authors know
how to spoof source IPs and generate SYN floods. They did it for Trinoo. So why
doesn't WinTrinoo have the same power under Windows? You know why:
Because Windows has traditionally lacked support for the full Raw Sockets
specification.

Next year, after "The XP Christmas of Death" has passed, tens of millions of
home PC's will be happily running Windows XP. How many minutes do you think
it will take for "WinTrinoo2" to arrive on the scene and for it to take full
advantage of XP's Unix-style full Raw Socket support?

A note to the Internet's Hackers: It would be TERRIFIC if you were to

name your second-generation WinTrinoo version: WinTrinoo-XP !!

[Link] 11.06.2001
Denial of Service with Windows XP Seite 12 von 18

Proof #3:
One of the most well known and sophisticated remote control attack Zombies is
named: Trinoo. This remote control Bot was originally written to run on
compromised Unix- and Linux-style platforms which, as we all know by now,
have traditionally been unique in having the ability to generate spoofed source IP
flooding attacks.

Trinoo was such a successful attack tool over on the *NIX platforms, that it was
"ported" to the Windows environment under the name: WinTrinoo.

But, of course, WinTrinoo's malicious capabilities are somewhat limited under

Windows. Unlike its Unix cousin, WinTrinoo can neither spoof source IPs,
nor generate SYN flooding attacks. You KNOW that WinTrinoo's authors know
how to spoof source IPs and generate SYN floods. They did it for Trinoo. So why
doesn't WinTrinoo have the same power under Windows? You know why:
Because Windows has traditionally lacked support for the full Raw Sockets
specification.

Next year, after "The XP Christmas of Death" has passed, tens of millions of
home PC's will be happily running Windows XP. How many minutes do you think
it will take for "WinTrinoo2" to arrive on the scene and for it to take full
advantage of XP's Unix-style full Raw Socket support?

A note to the Internet's Hackers: It would be TERRIFIC if you were to

name your second-generation WinTrinoo version: WinTrinoo-XP !!

So now, in light of what you've just seen, reconsider the intent behind Microsoft's
summarized position, as documented above:

"This is not really anything new, since previous

versions of Windows had support for Raw Sockets."

What are they thinking up there in Redmond?

I hope it is clear to you, in light of this little bit of evidence (there's an endless amount
more), that the release of Windows XP, as currently planned, into the mass consumer
market, represents a crucial mistake. And given that Microsoft is fully aware of this, a
shocking example of corporate hubris.

NEXT

This quote is taken directly from Microsoft's TechNet page referenced above:

From the TechNet Page:

"The presence of operating system-level functions to

manipulate data packets is not a critical factor in the
number of DDOS attacks. If it were, the explosion in DDOS
attacks should have already occurred, as raw sockets
implementations are already present in Linux, VMS, Unix,
Mac OS X, and even in previous versions of Windows."

We have just examined the obfuscation that was apparently intended at the end

[Link] 11.06.2001
Denial of Service with Windows XP Seite 13 von 18

of that quote. (Regarding the applicability of full Raw Sockets to previous

versions of Windows.) I hope you're no longer fooled by that. Let's look at the
rest of it.

"If it were, the explosion of DDOS attacks should have already

occurred..."

Perhaps Microsoft hasn't been reading about the rapid rise (explosion) in the
number of DDoS attacks which is already occurring. One must wonder how they
could be unaware of this since they have, themselves, been frequent targets of
those attacks. Furthermore, they must know, as I demonstrated above, that the
widespread availability of Linux and Unix, with their "system-level functions to
manipulate data packets" are clearly responsible and are a "critical factor" in
the number of DDoS attacks.

It is precisely because of the rapid growth in the number

of hobbyist-owned Unix and Linux boxes — inevitably
compromised with Trojans — that we are now seeing
a rapid growth in the number of DDoS attacks.

Microsoft is about to massively escalate this problem!

Although it is not completely clear what message Microsoft intended to convey

with that quote, what they APPEAR to be saying here is something along the lines
of:

"Everyone else has full Raw

Sockets, so why can't we?"

Assuming that this is what that quote was trying to say, it raises a good question
which is worth exploration:

As we have seen, it is indeed unfortunate that "everyone else" has full Raw
Socket support. The Internet has already been suffering the consequences. That
problem is certainly going to grow with time and needs to be dealt with as well.

The fact that Microsoft was not the first to make this crucial mistake on the
Internet in no way reduces their now-fully-informed responsibility to prevent
their deliberate compounding of the problem.

The installed-base of consumer Windows operating systems dwarfs that of all

other platforms combined. In shipping their Windows XP system, squarely
targeted at the home and small office user, tens of millions of existing Windows
platforms which have never had full Raw Socket support, will be upgraded
overnight into powerful Internet attack platforms. And all new computers sold
after Windows XP's release will have that built-in.

If you think the Internet is in trouble now, just wait!

NEXT

From the TechNet Page:

"Nor is the absence of such functions a significant

[Link] 11.06.2001
Denial of Service with Windows XP Seite 14 von 18

impediment to such attacks. Most modern operating

systems allow new functions — including networking
functions — to be added via installable drivers. An
attacker who had the ability to install zombie software on
another user's machine could just as easily install a
network driver to provide any functions it needed,
including functions to disguise the source address of the
attack."

That is absolutely true . . . and absolutely irrelevant.

Remember those three concrete examples we looked at first? Every one of

them demonstrated that — in actuality — the lack of the DEFAULT AVAILABILITY
of full Raw Socket support in traditional versions of Windows, completely
prevented that malicious tool from gaining access to IP spoofing and TCP
flooding capability. We KNOW that they all wanted it. Trinoo has it under Unix
and Linux, but WinTrinoo doesn't under Windows. The other program examples
apologized that they were only useable under Windows 2000 because of W2K's
support for full Raw Sockets.

There is a huge PRACTICAL gulf between what

COULD be accomplished in theory, and what
IS ACTUALLY ACCOMPLISHED in practice.

Adding full Raw Socket support to the DEFAULT Windows XP consumer product
ABSOLUTELY GUARANTEES that, IN PRACTICE, the next-generation tools of mass
malicious exploitation will be far more powerful than any previously or currently
designed for the traditional Windows of today.

It's just that plain and simple. How could Microsoft NOT see that?

NEXT

From the TechNet Page:

"The real issue is whether the attacker could run hostile

code on another user's computer. Like viruses, Trojan
horses and other hostile code, a zombie program can only
run if an attacker can install it and run it."

Wrong again, Microsoft.

Remember "Junior" whom we met awhile back when he asked his parents for a
Windows XP upgrade for Christmas? Let's take a look at what "Junior" is up to
after he returns to school from Christmas vacation . . .

The Story of "Junior" and his XP Gang

[Link] 11.06.2001
Denial of Service with Windows XP Seite 15 von 18

"Junior" is basically a good student and a good kid who likes

computers and trades mp3 music files and Windows programs with
his friends at school.
But not long after Christmas, one of his friends finds a cool new
program written for Windows XP. If you try to run this program
(which is called "[Link]") on the old versions of Windows,
which they all had before Christmas, it just says: "You need WinXP
to use this safely." and it won't do anything else.
This little Windows program allows anyone to launch a completely
untraceable "personal" Denial of Service attack. It launches a
protracted SYN flood with spoofed source IPs against any web site
the user wishes. When you run it under Windows XP, a window pops
up asking its user to enter the URL of the website to be driven from
the Net.
A couple of the school's more knowledgeable young computer geeks
explain that Windows XP is really cool because, unlike the earlier
versions of Windows, XP lets you "Spoof" your computer's IP
address to make you completely anonymous and invisible when
attacking others on the Internet. The geeks caution that the
program should only be run from a diskette, never stored on the
hard drive, so that no evidence of its use is ever left behind. Since
Windows XP has all the fancy full Raw Socket support built right in,
the "[Link]" program, which was written in Visual Basic,
fits easily on any spare diskette.
Of course, this program didn't exist and wasn't written before XP,
because it wasn't possible under any traditional versions of
Windows. But now many such programs are popping up all over the
Internet. All it took was the new release of Windows.
Now, after school every day, "Junior" and his close friends — all
with fresh Windows XP Christmas upgrades and cable modems —
meet behind the Gym to decide whom they want to punish with
their own little neighborhood-wide Distributed Denial of Service
attack.
Feeling a bit like super-cool spies, glancing around stealthfully, they
synchronize their watches and each head to their respective homes,
ready to click the "Launch Attack" button at the appointed time.

If you imagine that this little story about "Junior" and his XP Gang is pure
Science-Fiction, you don't know teenagers. This is what Windows XP will be
making all too easily possible.

It is worth noting that since TCP "SYN" packets are extremely small (60 bytes)
compared with data-carrying packets (1500 bytes), many more SYN packets can
be sent per second than data packets. This gives a SYN flooding machine more
"packet potency" than one which is attempting to transfer valid data. The
consequence of this, is that a single SYN-flooding machine can completely
knock out any other machine connected at the same or lesser speed. Coupled
with Windows XP, and a breed of cyber-war toys like the still-hypothetical
"[Link]" described above, we can expect "one-on-one" cyber-battles
between individuals. If someone doesn't like what you've said or done, you're
easily blown off the Internet.

Let me say it again: This is all COMPLETELY UNNECESSARY since no Windows

[Link] 11.06.2001
Denial of Service with Windows XP Seite 16 von 18

applications have ANY need for full Raw Socket support. No VALID use exists
outside of an Internet research setting. Raw Sockets were only included by the
original Berkeley designers for Internet protocol research. In a consumer
computer system, they will only be exploited for malicious purposes.

So, as we see, the "real issue" (to quote Microsoft) is NOT whether the attacker
can run hostile code on another user's computer. I submit that the "real issue" is
whether a personal computer can be much too easily programmed to generate
untraceable and maliciously damaging Internet traffic. Until now, for Windows,
that answer was no, and as a direct consequence it was never done.

Windows XP flaunts its ability to trivially generate

malicious traffic. You already know what will happen.

"Microsoft Security"
It takes every last bit of strength I have, not to label those two words "The
Oxymoron that Keeps on Giving". I have tried on this page, often without
success, to keep to the facts, since my feelings are already well known. You don't
need to read them over and over again.

So here is a simple fact:

It is absolutely impossible to create a

secure, consumer, personal computer.
Security is black and white. Either you are secure and protected, or you're not.

Ask any real security expert, like Bruce Schneier of Counterpane Internet
Security. They will tell you flat out that it's an impossible task to secure a
personal, consumer, computer. Why does Microsoft continually insist otherwise?
Because it is what people desperately want to hear, and desperately want to
believe. Well, it's not possible.

Microsoft's OWN software has NEVER been secure, and NEVER will be. Why?
Because with each generation of featurerama upgrade, it becomes more and
more complex, and less and less understandable. There can not possibly be
anyone left at Microsoft whose mind encompasses the entire system. They gave
that up with MS-DOS. Microsoft single-handedly created the eMail virus. Their
consumer operating systems — and the high-end server platforms — are a
security joke.

So Microsoft's defense for adding incredibly exploitable and utterly unnecessary

Internet technology into their base consumer-level system is: "Don't worry, THIS
one will REALLY be secure." Does ANYONE believe that?

You MUST KNOW that not long after its release the world will begin finding huge
security holes in Windows XP. Oh sure, Microsoft will issue patches. Then the
users will be blamed for not installing them in a timely fashion. What's WRONG
with those damn users anyway?

And even if, against all logic and our wealth of experience, you're on the fence
with this question . . . WHAT IF they are wrong? There is just too much riding on
the issue of the security of this completely unproven new system.

What if they are wrong?

[Link] 11.06.2001
Denial of Service with Windows XP Seite 17 von 18

The Third-Party Joke

And EVEN IF Windows XP shocked the world by turning out to be secure, that will
last ONLY until the myriad of Windows applications start loading themselves into
the system.

How many people complain that the annoying "Comet Cursor" keeps getting
installed into their computer whenever they visit certain web sites? Guess what
folks, that's Comet Cursor's CODE being downloaded and run without your
knowledge or permission. What happens when a Windows XP user innocently
surfs to a site that was set up to take over those machines?

When I reverse-engineered the Aureate/Radiate advertising Spyware, to create

the OptOut spyware detector and removal tool, I mentioned that it would be
trivial for any malicious hacker to commandeer the Aureate Trojan and cause it
to do their bidding. One line added to an innocuous and unprotected file, will
cause any of the more than 30 million Aureate Trojans to "phone home" to a
different server. From there it's trivial to have the Trojan accept a file to
download and then run it. Oh, and did I mention that the Aureate Trojan
undetectably runs within the Internet Explorer browser process? This lets it slip
past the system's firewall by trading on the browser's Internet access
permissions. So much for Windows XP security.

As any of you who run a personal firewall with "noisy logging" know, routine
scans for the PC Anywhere remote control utility are STILL occurring on the
Internet. Why? Because people installed PC Anywhere in their machines to give
them remote access across the Internet. The only problem was, a great many of
these people never bothered with a password. Thus, anyone could scan the
Internet to find a machine running the "PC Anywhere" Trojan and "own it". So
much for the "security" of that machine.

As you can see from these examples, the goal of an "absolutely" secure personal
computer for the masses is impossible to achieve. It's true that exercising
extreme care and caution can result in "a more secure PC". But that can only be
achieved in degree, never absolutely. For example, even Windows 95 could be
quite secure if the user were careful about its configuration and diligent about its
use. But the average consumer can not be expected to appreciate the subtle and
complex nuances of Internet security — especially when being stalked, tricked,
and seduced by malicious hackers. Typical consumer computer users will tend to
do insecure things. There's no practical means to prevent that, since that's what
they want to do.

Windows NT and 2000 are supposedly "secure" operating systems, yet malicious
Russian hackers have been breaking into those machines left and right, then
stealing consumer credit card data. Has anyone ever supported the contention
that WinNT and Win2000 are immune to viral infection? Has anyone ever
contended that? I've never heard any such thing because we all know it's
ridiculous.

We all know that no Windows system is inherently safe or secure. The truth is,
that can NEVER change due to the customer-base these systems have been built
to satisfy.

The Final Straw

It is apparent that, for unfathomable reasons of their own, Microsoft is

[Link] 11.06.2001
Denial of Service with Windows XP Seite 18 von 18

DETERMINED to ship a consumer-targeted operating system containing the

openly accessible Internet research interfaces known as Full Raw Sockets.

Come on folks, we can't let Microsoft

do this. It would REALLY be a joke.

The bad news is, the joke would be on us.

While Microsoft "spins" the reality of what happened with Windows XP — just as
they spun my initial concerns in their bogus response — they would find
somewhere else to place the blame. Let's NOT let it be our fault too.

Purchasing Info GRC Mail System To GRC's Home Tech Support Discussions

The contents of this page are Copyright (c) 2001 by Gibson Research Corporation.
SpinRite, ChromaZone, ShieldsUP, NanoProbe, the character 'Moe' (shown above),
and the slogan "It's MY Computer" are registered trademarks of Gibson Research
Corporation (GRC), Laguna Hills, CA, USA. GRC's web and customer privacy policy.
~~~

[Link] 11.06.2001