23 ms·

The Steve Gibson story was really interesting. He's a really cool guy, too. My botnet adventures happened around the same time as his, and I too was DDoS'd. We

by EricR23 14y ago

The Steve Gibson story was really interesting. He's a really cool guy, too. My botnet adventures happened around the same time as his, and I too was DDoS'd. We even exchanged a few e-mails about botnets and the script kiddie culture. Those were fun times.

mahmud 14y ago
Except when he went on record opposing the addition of raw-sockets to Windows XP saying it would help hackers and spell the end of the world. I remember clutching my Redhat CD, just in case raw sockets were banned ;-) http://www.theregister.co.uk/2001/06/25/steve_gibson_really_is_off/ http://www.theregister.co.uk/2001/06/25/steve_gibson_really_...
- EricR23 14y ago
  Ah, yeah, I remember that too now :)
- koenigdavidmj 14y ago
  And then you know they banned them with a nonremovable patch, right? http://seclists.org/nmap-hackers/2005/4 http://seclists.org/nmap-hackers/2005/4
  - magamiako 14y ago
    The limitations are listed here: http://msdn.microsoft.com/en-us/library/windows/desktop/ms740548(v=vs.85).aspx http://msdn.microsoft.com/en-us/library/windows/desktop/ms74... - TCP data cannot be sent over raw sockets. - UDP datagrams with an invalid source address cannot be sent over raw sockets. The IP source address for any outgoing UDP datagram must exist on a network interface or the datagram is dropped. This change was made to limit the ability of malicious code to create distributed denial-of-service attacks and limits the ability to send spoofed packets (TCP/IP packets with a forged source IP address). - A call to the bind function with a raw socket for the IPPROTO_TCP protocol is not allowed. Note: The bind function with a raw socket is allowed for other protocols (IPPROTO_IP, IPPROTO_UDP, or IPPROTO_SCTP, for example). Also, the "half open connections" limit has been removed as of Vista.
  - mahmud 14y ago
    Who cares about XP? I was fearing legislation because his cry of wolf was heard far and wide.

by EricR23 14y ago

mahmud 14y ago

Except when he went on record opposing the addition of raw-sockets to Windows XP saying it would help hackers and spell the end of the world. I remember clutching my Redhat CD, just in case raw sockets were banned ;-) http://www.theregister.co.uk/2001/06/25/steve_gibson_really_is_off/ http://www.theregister.co.uk/2001/06/25/steve_gibson_really_...

EricR23 14y ago
Ah, yeah, I remember that too now :)
koenigdavidmj 14y ago
And then you know they banned them with a nonremovable patch, right? http://seclists.org/nmap-hackers/2005/4 http://seclists.org/nmap-hackers/2005/4
- magamiako 14y ago
  The limitations are listed here: http://msdn.microsoft.com/en-us/library/windows/desktop/ms740548(v=vs.85).aspx http://msdn.microsoft.com/en-us/library/windows/desktop/ms74... - TCP data cannot be sent over raw sockets. - UDP datagrams with an invalid source address cannot be sent over raw sockets. The IP source address for any outgoing UDP datagram must exist on a network interface or the datagram is dropped. This change was made to limit the ability of malicious code to create distributed denial-of-service attacks and limits the ability to send spoofed packets (TCP/IP packets with a forged source IP address). - A call to the bind function with a raw socket for the IPPROTO_TCP protocol is not allowed. Note: The bind function with a raw socket is allowed for other protocols (IPPROTO_IP, IPPROTO_UDP, or IPPROTO_SCTP, for example). Also, the "half open connections" limit has been removed as of Vista.
- mahmud 14y ago
  Who cares about XP? I was fearing legislation because his cry of wolf was heard far and wide.