Suhas Bagul

Dan Goodin, The Register 2010-01-08

Juniper Networks is warning customers of a critical flaw in its gateway routers that allows attackers to crash the devices by sending them small amounts of easily-spoofed traffic.

In an advisory sent Wednesday afternoon, the networking company said a variety of devices could be forced to reboot by sending them internet packets with maliciously formed TCP options. The flaw affects versions 3 through 10 of Junos, the operating system that powers devices at ISPs, backbones, and other large networks. Software releases built on or after January 28, 2009 have already fixed the issue.

"The Junos kernel will crash (i.e. core) when a specifically crafted TCP option is received on a listening TCP port," the bulletin, which was issued by Juniper's technical assistance center, stated. "The packet cannot be filtered with Junos's firewall filter. A router receiving this specific TCP packet will crash and reboot."

There are "no totally effective workarounds," the bulletin added.

It's unclear how many Juniper systems remain vulnerable or exactly when customers began installing patches. But the wording of the bulletin was enough to make some security watchers pay close heed, particularly since the Junos ACL, or access control list, was powerless to prevent the attacks.

"Anything that can crash the internet is a big deal," said Daniel Kennedy, a researcher with Praetorian Security Group. "Essentially, you can send a packet to a router and the ACL in that router can't stop this, so you can basically start bouncing routers just by sending it a crafted options field in a TCP request."

A Juniper spokeswoman said the bulletin was one of seven security advisories the company issued under a policy designed to prevent members of the public at large from getting details of the vulnerabilities.

"Because of Juniper's 'Entitled Disclosure Policy,' only our customers and partners are allowed access to the details of the Security Advisory," the spokeswoman wrote.

While the only effective solution is to patch, the bulletin said the risk could be minimized but limiting TCP packets destined for Junos devices. Specifically, customers should employ anti-spoofing" techniques described here. If those techniques aren't feasible for all traffic "focus on anti-spoofing for the IP addresses used for the control plane, management plane, and link addresses," the advisory stated.

More from the Praetorian Prefect blog is here.

This story was updated to include comment from Juniper.

Published: 2010-01-05

Build-your-own-botnet kits based on a family of malicious software known as Zeus account for about one out of every ten botnets, according to data collected by security firm Damballa.

The kits, which sell for $400 to $700, allow a would-be criminal with rudimentary technical skills to bake their own custom bot software and have become so popular that a large community of developers have created plugins to further customize the software, said Gunter Ollmann, vice president of research for the Atlanta-based firm. The firm tracks a few thousand botnets, more than 200 of which are based on the Zeus code, Ollman said.

"Zeus has picked up a lot of momentum," he said. "If you are a beginner, then you might have heard about Zeus from the press. And, if you are someone looking for specific features, the plugins allow you to do that."

Zeus, also referred to as Prg and Zbot, has become a popular amongst cybercriminals as a way to steal victims' financial information. Last month, a Zeus-based command-and-control server was found on a server instance hosted by Amazon cloud computing service, EC2. The discovery came a few days after one security firm warned Internet user that spammers where attempting to infect recipients with the Zeus bot.

Zeus is not the most sophisticated program out there, but it is widespread and affordable. Those considerations and the availability of a wide variety of plugins has made the software popular, said Ollmann.

"Zeus is coming to dominate the very low end of the market," he said. "The newbies that are getting into the market want to create their botnets from scratch. There are better kits available, but they cost more money."