21–30 of 126 posts
Great work! This is my favourite type of vulnerability, simple, effective and brutal. Reminds me of a time two decades ago when with a friend from uni we theorised about a perfect server vulnerability where you’d exploit a machine by pinging it. And of course, two years ago it was in fact discovered as CVE-2022-23093.
Ping of death was already a thing two decades ago. https://web.archive.org/web/19981206105844/http://www.sophis...
Earlier quoted context omitted.
Back in the dial-up days you could disconnect someone by adding ATH commands to a ping payload field.
Only if their modem didn’t implement the Hayes command set properly or you could otherwise control the per-character timing of the OS sending. It required a pause (1sec by default), “+++” with no pauses, another pause, _then_ the ATH command
Earlier quoted context omitted.
Ping of death was already a thing two decades ago. https://web.archive.org/web/19981206105844/http://www.sophis...
This link doesn’t show me anything useful.
Great work! This is my favourite type of vulnerability, simple, effective and brutal. Reminds me of a time two decades ago when with a friend from uni we theorised about a perfect server vulnerability where you’d exploit a machine by pinging it. And of course, two years ago it was in fact discovered as CVE-2022-23093.
Back in the dial-up days you could disconnect someone by adding ATH commands to a ping payload field.
Earlier quoted context omitted.
Only if their modem didn’t implement the Hayes command set properly or you could otherwise control the per-character timing of the OS sending. It required a pause (1sec by default), “+++” with no pauses, another pause, _then_ the ATH command
Which was fairly common, as Hayes had a patent on those pauses.
https://en.wikipedia.org/wiki/Time_Independent_Escape_Sequen...
Earlier quoted context omitted.
Back in the dial-up days you could disconnect someone by adding ATH commands to a ping payload field.
Only if their modem didn’t implement the Hayes command set properly or you could otherwise control the per-character timing of the OS sending. It required a pause (1sec by default), “+++” with no pauses, another pause, _then_ the ATH command
Great work! This is my favourite type of vulnerability, simple, effective and brutal. Reminds me of a time two decades ago when with a friend from uni we theorised about a perfect server vulnerability where you’d exploit a machine by pinging it. And of course, two years ago it was in fact discovered as CVE-2022-23093.
Back in the dial-up days you could disconnect someone by adding ATH commands to a ping payload field.
Anyone know how long ago that system would have been introduced? It seems like such an obvious security concern. Maybe it was pre-AppStore? And more assumed trust in other apps?
The notification API is quite old (iOS 3). It's explicitly an untrusted API that you shouldn't use for something like showing the restore in progress UI, so I suspect that was something written quite a bit later. Widget extensions are iOS 14. There's older ways to run background tasks, but none of them would give the soft brick. Background fetch, for example, originally didn't run until after you launched an app for…
Earlier quoted context omitted.
Back in the dial-up days you could disconnect someone by adding ATH commands to a ping payload field.
Only if their modem didn’t implement the Hayes command set properly or you could otherwise control the per-character timing of the OS sending. It required a pause (1sec by default), “+++” with no pauses, another pause, _then_ the ATH command
Earlier quoted context omitted.
Back in the dial-up days you could disconnect someone by adding ATH commands to a ping payload field.
I’m too lazy to look it up but there was some string you could send over IRC that would make some routers drop the connection immediately - if you pasted that string in a big channel you would see dozens of people immediately disconnect.
DCC SEND whatever 0 0 0
This caused the DCC ALG helper in ancient Linux kernels to close the connection, as they failed to parse 0 as a valid IP address. Users connecting to IRC servers over TLS were immune, as the ALG helper in the router could not observe the traffic.
This is what breaks DCC in general -- to use DCC on IRC while connecting to the server over TLS and behind a NAT, you must instruct your client to use a specific range of ports for DCC and preforward those ports to your machine in your router, as the ALG helper cannot mark the incoming connection as RELATED (and forward it through to you) as it cannot see the outgoing command that caused the incoming connection to occur. You must also instruct your client to determine the correct external IP address to advertise, as the ALG helper will be unable to rewrite it when the router does masquerading.