Is Linux TCP security in grave danger or not?

Talk about internet security, computer security, personal security, your social security number...
Post Reply
barbaz
Senior Member
Posts: 10847
Joined: Sat Aug 03, 2013 5:45 pm

Is Linux TCP security in grave danger or not?

Post by barbaz »

http://phys.org/news/2016-08-highlights ... users.html

Is it just me or is that link really ridiculously vague?
I understand the need to leave some things unsaid so as not to inform the script kiddies, but that seems so devoid of detail that I'm not sure whether to believe it or just dismiss it as FUD.

What are they even talking about anyway? I don't know TCP to that level, can someone please elucidate the TCP concepts they refer to?
*Always* check the changelogs BEFORE updating that important software!
-
User avatar
Thrawn
Master Bug Buster
Posts: 3106
Joined: Mon Jan 16, 2012 3:46 am
Location: Australia
Contact:

Re: Is Linux TCP security in grave danger or not?

Post by Thrawn »

Sounds like they found a way to tamper with the routing of TCP by forging packet identifiers. It doesn't break TLS, but it would make it easier for a MITM to mess around with your traffic.

I'm no TCP expert either, though.
======
Thrawn
------------
Religion is not the opium of the masses. Daily life is the opium of the masses.

True religion, which dares to acknowledge death and challenge the way we live, is an attempt to wake up.
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
barbaz
Senior Member
Posts: 10847
Joined: Sat Aug 03, 2013 5:45 pm

Re: Is Linux TCP security in grave danger or not?

Post by barbaz »

Thanks for the clarification. Using that information, I found a better description of the attack: https://nakedsecurity.sophos.com/2016/0 ... oping-bug/

Read elsewhere that the upstream kernel will be patched in version 4.7. Don't know if Ubuntu 14.04.1 kernel (3.13.*) is patched against this, but it sounds unlikely to be my problem given how I have set myself up, so, meh.
*Always* check the changelogs BEFORE updating that important software!
-
Post Reply