Nuke

The Story

Microsoft's operating systems contain a nasty little bug which allows other people to crash your computer. To do this, they send an invalid packet to your TCP/IP connection which causes the crash. The OOB (Out of Band) Bug will crash Windows 3.11, Windows 95, Windows NT 3.51, & Windows NT4.0. Both Microsoft and 3rd party programers have since released patches.


How they do It ?

The attack is done by sending Out of Band (OOB) data to an established connection. NetBIOS, which listens on port 139 among others, seems to be the most affected - but the attack may work against MS-DNS running on port 53, causing massive Event Log entries related to "select() errors", as reported by David LeBlanc. Apparently the OS doesn't know how to handle OOB data properly, so it may panic, causing strange things to happen. NT displays the Blue Screen of Death (BSOD) indicating TCPIP.SYS as the cuplrit, and definately requires a reboot after being attacked. Windows 95 may or may not crash completely, but always presents a blue exception screen, indicating MSTCP and NDIS as the culprits. Win95 always stops talking on the network after the attack.

What's nuking...?

There are nuke programs, which take advantage of some fault within windows. The Nuker uses a program, that sends Information to the "being nuked person's" computer and due to the errors in windows the computer will crash or do other strange things... (note: you can be nuked if you are connected to the internet, you don't even have to be on irc...)

  • Nuke Attack 1

Nuke 1: also known as "Bluescreen nuke" or "Winnuke" or "OOB-nuke" or "Port 139 attack/nuke".
The program called winnuke will send a special kind of package to port139 (or another vulnerable port) of the being nuked person. Only people with Microsoft Windows can be nuked with this nuke.
You know when you are nuked by nuke 1 if you get (in 70% of all cases) a blue screen in windows, with a windows fault... your internet connection has been destroyed,.. most likely you will have to reboot your computer...

 

Example program for nuke attack1 :

 

 

  • Nuke Attack 2

    Nuke 2: Also known as "ICMP-nuke".
    This nuke will terminate a connection between 2 parties (on IRC: you (=party 1) and the IRC-server (=party 2)). By nuking both the ports with which they are connected to eachother, the connection between those 2 parties is cut off immediately... This nuke can nuke every user on the internet

    You know when you are nuked by nuke 2 if your suddenly disconnected from the server on which you were, and you didn't disconnect yourself, your quit-msg said nothing... you will have to reconnect to the server...

    There isn't a patch against this kind of nuking. However there is a way to protect you. So with this nuke you can nuke 2 parties so both parties have to be protected. Ever heard of a firewall? A firewall means that some people aren't allowed to connect to you. And if you know that a certain person is attacking you, shield yourself by using a firewall. You can download a windows firewall here: http://www.signal9.com

 Example program for nuke attack2 :