10 Aug
2016
10 Aug
'16
10:02 p.m.
Greets!
what must we who are using trinity do to avoid the tcp exploit?
I found the following instructions from L. Weinstein's privacy mail
list but they don't corrrespond to anything in my sysctl.conf.
Felmon
----- quote -----
Workaround for serious TCP exploit previously discussed
https://plus.google.com/+LaurenWeinstein/posts/gWSj2sYExoB
Here is the recommended workaround for Linux/Android clients/servers
for the serious TCP exploit discussed in:
https://threatpost.com/serious-tcp-bug-in-linux-systems-allows-traffic-hija…
This one will work for Ubuntu as is, and for various other Linux
distributions with suitable modifications. The point is to bump the
ACK limit way up. Note that some of the pages announcing this exploit
appear to be contaminated with browser hijack "fake technical support"
warning sites. Beware. Close your browser immediately if you hit one
if you can, otherwise reboot and don't restore crashed pages.
The workaround for the TCP exploit:
Open /etc/sysctl.conf, append a command:
/net.ipv4/tcp_challenge_ack_limit = 999999999
Use "sysctl -p" to update the configuration.
_______________________________________________
privacy mailing list
https://lists.vortex.com/mailman/listinfo/privacy
10 Aug
10 Aug
10:06 p.m.
New subject: Workaround for serious TCP exploit [correction]
I see I misread the instructions - the 'challenge_ack' line should be
ADDED to sysctl.conf.
f.
On Wed, 10 Aug 2016, Felmon Davis wrote:
Greets!
what must we who are using trinity do to avoid the tcp exploit?
I found the following instructions from L. Weinstein's privacy mail list but
they don't corrrespond to anything in my sysctl.conf.
Felmon
----- quote -----
Workaround for serious TCP exploit previously discussed
https://plus.google.com/+LaurenWeinstein/posts/gWSj2sYExoB
Here is the recommended workaround for Linux/Android clients/servers
for the serious TCP exploit discussed in:
https://threatpost.com/serious-tcp-bug-in-linux-systems-allows-traffic-hija…
This one will work for Ubuntu as is, and for various other Linux
distributions with suitable modifications. The point is to bump the
ACK limit way up. Note that some of the pages announcing this exploit
appear to be contaminated with browser hijack "fake technical support"
warning sites. Beware. Close your browser immediately if you hit one
if you can, otherwise reboot and don't restore crashed pages.
The workaround for the TCP exploit:
Open /etc/sysctl.conf, append a command:
/net.ipv4/tcp_challenge_ack_limit = 999999999
Use "sysctl -p" to update the configuration.
_______________________________________________
privacy mailing list
https://lists.vortex.com/mailman/listinfo/privacy
--
Felmon Davis
Health nuts are going to feel stupid someday, lying in hospitals dying
of nothing.
-- Redd Foxx
10:16 p.m.
New subject: Workaround for serious TCP exploit [correction]
sorry for the mess-up's but there was a syntax error; this is the line
that should be added:
net.ipv4.tcp_challenge_ack_limit = 99999999
followed by executing
sysctl -p
not sure of the rationale and the effect.
f.
--
Felmon Davis
It's not the fall that kills you, it's the landing.
10:17 p.m.
New subject: [trinity-users] Workaround for serious TCP exploit
On Wednesday 10 August 2016 18:02:20 Felmon Davis wrote:
sysctl -p
sysctl: cannot stat
/proc/sys//net.ipv4/tcp_challenge_ack_limit: No such
file or directory
Do we need to restart something? Wheezy, trinity r14.04.
Ah, I see it s/b net/ipv4/tcp yadda. That works.
Cheers, Gene Heskett
--
"There are four boxes to be used in defense of liberty:
soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
Genes Web page <http://geneslinuxbox.net:6309/gene>
10:59 p.m.
New subject: [trinity-users] Workaround for serious TCP exploit
On Wed, 10 Aug 2016 18:02:20 -0400 (EDT)
Felmon Davis <davisf(a)union.edu> wrote:
what must we who are using trinity do to avoid the tcp
exploit?
That exploit is kernel-level (nothing to do with Trinity, can be found even
on headless servers). It's been corrected in kernel version 4.7, so build a
new kernel if you're really worried, or follow your distro's instructions on
what to do if they have any.
Personally, I'm not going to lose any sleep over it.
E. Liddell
2817
days inactive
2817
days old
4 comments
3 participants
participants (3)
-
E. Liddell -
Felmon Davis -
Gene Heskett