<<< Date Index >>>     <<< Thread Index >>>

Re: Skype Network Remote DoS Exploit



Skype made a funny "explanation" of the problem...

Lets say, people download updates on Tuesday in the US, on Wednesday in Europe and just happen to reboot their computers simultaneously on Thursday? :)

As I remember, there were two primary theories of the problem source:

 1.. Microsoft's updates
 2.. DoS attack
It seems Skype has decided to make their own theory based on these two: so it was a DoS, but not an attack, and it was updates fault, but not Microsoft's.



I do believe that the DoS Exploit, published at www.securitylab.ru, might have such an impact, but it's impossible to prove anything and it's not necessary. I just would like to say, that Skype could came up with more realistic story, for example: someone made a mistake in the code, or they were trying to implement new feature and everyone would believe, even me :)



Best regards,

Valery Marchuk

www.SecurityLab.ru



----- Original Message ----- From: "Steven M. Christey" <coley@xxxxxxxxx>
To: <tecklord@xxxxxxxxxxxxx>; <bugtraq@xxxxxxxxxxxxxxxxx>
Sent: Monday, August 20, 2007 8:39 PM
Subject: Re: Skype Network Remote DoS Exploit



The outage being experienced by Skype was apparently due to massive
simultaneous reboots and reconnects after systems installed their
Windows patches.

from http://heartbeat.skype.com/2007/08/what_happened_on_august_16.html:

  The disruption was triggered by a massive restart of our users'
  computers across the globe within a very short timeframe as they
  re-booted after receiving a routine set of patches through Windows
  Update.

  The high number of restarts affected Skype's network resources.
  This caused a flood of log-in requests, which, combined with the
  lack of peer-to-peer network resources, prompted a chain reaction
  that had a critical impact.

I wonder how many other services are impacted by simultaneous Windows
scheduled updates.

Anyway... given that this was going on at the time the SecurityLab.ru
exploit was released, and the exploit only claims a DoS (and only
seems to make a series of requests to long URIs), was the exploit
actually effective, or was the "DoS" just part of the larger outage?

- Steve