A hacking group says it has discovered a security vulnerability affecting Windows 95, 98 and 2000, as well as the SunOS and Solaris operating systems, allowing unauthorized users to intercept outgoing information.
The problem is related to the Internet Control Message Protocol Router Discovery Protocol (IRDF) that determines the way computers connect to the Internet. The glitch lets an attacker spoof a route, according to an advisory issued Wednesday by hacker-security specialists L0pht Heavy Industries. As a result, attackers can reroute outbound traffic on vulnerable systems; modify traffic; act as "man in the middle"; or launch denial-of-service attacks, L0pht says. All of the attacks, excluding denial of service, require the unauthorized user to be on the same network as the victim, the specialists says.
Man-in-the-middle attacks occur when an attacker acts as "a proxy between the victim and end host," L0pht says. The victims think they are directly connected to the end host, but are actually connected to the attacker, who is connected to the end host feeding information through. For example, an attacker acting as man in the middle may access all banking information online without the victim knowing, L0pht says.
A denial-of-service attack is when routers, T-1 and T-3 lines are jammed with data that prevent users from accessing a site.
According to L0pht's Weld Pond, Microsoft turned IRDF on by default for Windows 95 and 98, and it stays enabled even when a user has configured a system to turn it off.
"This means that many people out there are running this vulnerable protocol and they don't know it," Weld says.
However, Microsoft says IRDF is enabled by default in Windows 95 and 98 "because the industry standard requires it." The company says IRDF attacks are due to "weaknesses in the protocol itself and not due to any security vulnerabilities in Microsoft products." Microsoft also says these attacks could happen with other vendors that implemented IRDF.
According to Microsoft, IRDF "assumes a benign environment" and cannot check if any participants are deliberately providing false information. Agreeing with L0pht that an authenticated protocol would be more secure, Microsoft says it hopes L0pht plans "to design a more secure version of the protocol" and bring it to the Internet Engineering Task Force.
RELATED LINKS
Find out the latest holes in programs from Network World.
Feedback
Tell us your thoughts on this article or the issues it raises.
