5 ms·
Great work! This is my favourite type of vulnerability, simple, effective and brutal. Reminds me of a time two decades ago when with a friend from uni we theori
by _rrnv 1y ago
Great work! This is my favourite type of vulnerability, simple, effective and brutal. Reminds me of a time two decades ago when with a friend from uni we theorised about a perfect server vulnerability where you’d exploit a machine by pinging it. And of course, two years ago it was in fact discovered as CVE-2022-23093.
- Rygian 1y agoPing of death was already a thing two decades ago. https://web.archive.org/web/19981206105844/http://www.sophist.demon.co.uk/ping/ https://web.archive.org/web/19981206105844/http://www.sophis...
- dgfitz 1y agoThis link doesn’t show me anything useful.
- giantrobot 1y agoTry scrolling down. On mobile (maybe because of ad blockers) Wayback pages have a full screen of white space above the page contents anymore for me. This happens on pretty much every Wayback page I've tried. It's also relatively recent and I'm not sure the exact cause.
- jasongill 1y agoTry https://insecure.org/sploits/ping-o-death.html https://insecure.org/sploits/ping-o-death.html
- jasongill 1y agoIt was actually almost 3 decades ago, making me feel extremely old - the period right at the end of '96 and into mid '97 when this was a popular way to cause mischief via IRC was truly a magical time
- anyfoo 1y agoHard to believe that during those times in IRC, you were used to automatically (and proudly) advertising your IP address, your exact client version, and the means for a direct connection to your client without any server in between (CTCP, literally “client-to-client protocol”). And all of that most often with no packet filter whatsoever, not even NAT, in between. Everything was plaintext, including “authentication”, which was (at best) just asking the “ident server” on the same machine as your client who you claimed to be, which was considered sufficient because, after all, to run identd on its “privileged” low port meant you were an “administrator” (i.e. root of a unix machine).
- sneak 1y agoCTCP messages still go through the server. DCC (direct client connection) are the p2p connections you are thinking of, but they of course don’t work behind nat. I was behind NAT when I first got on IRC in ‘98. I set it up with ipfwadm.
- anyfoo 1y agoAh you are right, I mixed CTCP and DCC up. The former was also used to set up the latter I think? (Among other things.) I joined IRC in the early 90s, there was no NAT then, packet filtering was uncommon, and practically nothing on the Internet was encrypted. It was a very different time.
- chasd00 1y agoDeath on flaxxen wings
- driverdan 1y agoWhen I was in college circa 2001 we used to prank each other with the ping of death and other crash exploits. Also random IPs on the college network when we were bored. It was crazy how long it was around for and how easy it was to exploit.
- _rrnv 1y agoDOS yes, but that freebsd cve I referenced is a theoretical RCE.
- NitpickLawyer 1y agoBack in the dial-up days you could disconnect someone by adding ATH commands to a ping payload field.
- brontitall 1y agoOnly if their modem didn’t implement the Hayes command set properly or you could otherwise control the per-character timing of the OS sending. It required a pause (1sec by default), “+++” with no pauses, another pause, _then_ the ATH command
- wat10000 1y agoWhich was fairly common, as Hayes had a patent on those pauses.
- brontitall 1y agoHuh, TIL. I guess they might have used TIES https://en.wikipedia.org/wiki/Time_Independent_Escape_Sequence https://en.wikipedia.org/wiki/Time_Independent_Escape_Sequen...
- NitpickLawyer 1y agoI had an external USRobotics 56k modem, I was immune. But the many many "bulk" no-name modems were vulnerable. You could ping entire ranges of dial-up IPs and watch the results on big IRC channels. Uhmmm, allegedly :)
- mycall 1y agoCommas provided 2 second pauses
- brontitall 1y agoOnly in the dial string to ATD, surely?
- cryptoegorophy 1y ago