Archived copy of
http://www.chatnet.org:80/nethelp.html as of
1998-02-12 · original content, not edited ·
ChatNet Old StuffAnswers Solutions to
Nuking and Icmp Attacks
Nuking and Icmp across the internet
are used to Crash systems
and disconnect people from the internet.
This page was made help people understand
and protect and detect yourself from such attacks.
[Winuke Info and Protection]
[Icmp/SSping Info and Protection]
[Emailing The Provider]
[Detection Programs and Methods]
|
WinNuke
AKA "Blue Screen of Death"
On a computer running Microsoft Windows
95 (all releases) using the Microsoft TCP/IP
protocol, the following error message may occur when certain data is received
over
the network with a blue screen:
Fatal exception 0E at 0028:<address> in VxD MSTCP(01) + 000041AE.
This was called from 0028:<address> in VxD NDIS(01) + 00000D7C.
After this error message occurs, the computer may not receive further network
data
until Windows is restarted.
|
Update to Windows
95 TCP/IP to Address Out-of-Band Issue
http://www.microsoft.com/kb/articles/q168/7/47.htm
Solution
To install these updated files, follow these
steps:
1.Download the Vtcpupd.exe file to an empty folder.
2.In My Computer or Windows Explorer, double-click the Vtcpupd.exe file
you
downloaded in step 1.
3.Follow the instructions on the screen.
The following file(s) are available for download from the Microsoft Software
Library:
Vtcpupd.exe (size: 253144 bytes)
http://www.microsoft.com/kb/softlib/mslfiles/Vtcpupd.exe
Test Your Patch see if it "Works"
Go to this site:
http://206.148.240.160/~dirk/winnuke.html
ICMB/SSPING
aka "Jolt"
Computers running Windows
NT or Windows 95 may stop responding (hang) when they
receive corrupt Internet Control Message Protocol (ICMP) datagram fragments
from a
client. also modem lights on my win95 modem icon when the incoming light
is
pegged on and stays that way due to the rapid incoming Data.
SSPING/Jolt is a program which
effectively will freeze of almost any
Windows95 or Windows NT connection. It's based on old code which
freezes old SysV and Posix implementations. It works basically by sending
a series of spoofed & fragmented ICMP packets to the target, which
build
up to be a 64k ping, and Windows95/NT
then ceases to function altogether.
|
Solution
Windows 95
This issue is resolved
by the following updated file for Windows 95 and OSR2:
Vip.386 version 4.0.956 (dated 6/30/97) or later
This file is included in the self-extracting Vipupd.exe file.
To install this update, follow these steps:
1.Download the Vipupd.exe file from the online service listed below to
an empty folder.
2.In My Computer or Windows Explorer, double-click the Vipupd.exe file
you
downloaded in step 1.
3.Follow the instructions on the screen.
The following file are available for download from the Microsoft Software
Library:
~ VIPUPD.EXE (size: 171672 bytes)
http://www.microsoft.com/kb/softlib/mslfiles/VIPUPD.EXE
Windows NT 3.51
NOTE: Service Pack 5 must be applied to Windows
NT 3.51 prior to applying this fix.
This hotfix has been posted to the following Internet location:
ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT351/hotfixes-postSP5/icmp-fix
Windows NT 4.0
NOTE: Service Pack 3 must be applied to Windows
NT 4.0 prior to applying this fix.
This hotfix has been posted to the following Internet location:
ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP3/icmp-fix
|
Emailing
the Provider:
Email your proof of nuke
or icmp to the Provider, by sending the email
to the perpetrator's domain (host.domain) to both abuse@domain and
root@domain.
example: if the nuker is canton15.imperium.net, you would send
email to abuse@imperium.net and cc to root@imperium.net
You need to include all of the following information:
a) log file of the nuke or icmp attack
b) IP of the attacker
c) any relevant IRC logs, preferably timestamped
d) time of day
e) your time zone, preferably in relation to GMT
f) /whois information on the attacker, if s/he is on IRC at the time of
the attack
Politely explain what occured, the proof you have, and the frequency of
attack, if a chronic problem, and request that the provider take action
against the perpetrator.
|
Detection
Programs and Methods
Skream's port listen
http://skream.simplenet.com/plisten/
Port
Listen Intructions txt
Nuke Nabber*
http://www.dynamsol/puppet/files/nn21.exe
Nuke Detecter
ftp://ftp.devware.com/nukedet/
Arp Scanner
Icmp
Dos Arp Scanner for Win95