UPDATE: Netgear routers attack university - News - Communications

To print: Select File and then Print from your browser's menu

--------------------------------------------------------------
This story was printed from ZDNet Australia.
--------------------------------------------------------------

UPDATE: Netgear routers attack university

By Patrick Gray, 0
August 25, 2003
URL: http://www.zdnet.com.au/news/communications/soa/UPDATE-Netgear-routers-attack-university/0,130061791,120277694,00.htm

A design flaw in a router product has seen the University of Wisconsin's network bombarded with network time protocol synchronisation requests, in an accidental denial of service (DoS) attack.

The university's administrators noticed a dramatic increase in in-bound traffic to its time server, and eventually traced the cause to a Netgear router product. A full analysis was posted on the university's Web site.

The router was hard-coded to synchronise its clock to the university's time server, meaning that every unit sold and deployed began bombarding the machine with requests as often as once a second.

"I have counted more than 500,000 unique Netgear sources that queried our time server in one day. This measurement likely underestimates the actual count," the analysis read. "As of June 30, 2003, Netgear reported a total of 707,147 affected products manufactured."

A similar problem forced the CSIRO to take down its public time server in April this year after a US manufacturer, SMC, hard-coded its network time server into its code. The flood of requests from 85,000 of the devices proved too difficult to service.

Dave Plonka, who wrote the analysis, is planning on educating vendors on the down-side of hard-coding IP specific servers into their products.

"I am in the process of preparing an Internet Draft, currently titled 'Embedding Globally Routable Internet Addresses Considered Harmful', which denounces the practice of embedding unique, globally routable IP addresses in Internet hosts, describes some of the resulting problems, and considers selected alternatives."

In a joint statement, the university's chief information officer, Annie Stunden, said Netgear had worked closely with the university to "understand the issue and minimise any impact".

Netgear has released a firmware upgrade for the products causing the problem.