BitTorrent patches flaw that could amplify distributed denial-of-service attacks

Attackers could use the vulnerability to force BitTorrent applications to send malicious traffic

BitTorrent fixed a vulnerability that would have allowed attackers to hijack BitTorrent applications -- used by hundreds of millions of users -- in order to amplify distributed denial-of-service (DDoS) attacks.

The vulnerability was located in libuTP, a reference implementation of the Micro Transport Protocol (uTP) that's used by many popular BitTorrent clients including uTorrent, Vuze, Transmission and the BitTorrent mainline client.

The flaw was disclosed earlier this month in a paper presented at the 9th USENIX Workshop on Offensive Technologies by four researchers from City University London, Mittelhessen University of Applied Sciences in Friedberg, Germany and cloud networking firm PLUMgrid.

DDoS amplification is an increasingly popular technique among attackers and can generate very large traffic volumes. It involves sending rogue requests to a large number of servers that appear to originate from the IP (Internet Protocol) address of a target chosen by attackers. This tricks those servers into sending their responses to the spoofed IP address instead of the original sender, flooding the victim with data packets.

The technique has the effect of hiding the source of the original traffic, which is known as reflection, but can also significantly amplify it if the generated responses are larger in size than the requests that triggered them.

This type of attack typically affects protocols that rely on the User Datagram Protocol (UDP) for data transmission, because UDP does not perform source address validation. In their paper, the four researchers showed that uTP is one such protocol.

They showed that an attacker could send a connection request with a spoofed address to a BitTorrent client, forcing it to send an acknowledgement (ACK) packet to the victim. The attacker could then send a second request with the same spoofed address and a random ACK number to initiate a BitTorrent handshake.

The BitTorrent client would accept this second request as well and would send a handshake response to the victim. However, since the victim would not expect the packet, it wouldn't respond back, forcing the BitTorrent client to resend the data up to four times, amplifying the traffic that the attackers can generate.

In order to fix the issue, BitTorrent, the company that maintains libuTP, modified the library so that it properly verifies the ACK number accompanying the second request. If it doesn't match the one sent to the victim in the first packet, it will drop the connection.

The change does not prevent DDoS reflection but kills the amplification effect.

It would be fairly difficult for an attacker to guess the acknowledgement number for a sufficiently large number of reflectors, a BitTorrent engineer said in a blog post Thursday that explains the fix in detail.

The latest versions of uTorrent, BitTorrent mainline and BitTorrent Sync, which are developed by the company, have included the fix since Aug. 4.

The change does not affect backwards compatibility with older versions of those applications nor with third-party BitTorrent clients that use libuTP, a BitTorrent engineer said via email. "Nonetheless, we encourage other developers to ensure their implementations properly enforce acknowledgment number sequencing."

Other protocols designed by the company that rely on libuTP, like the Message Stream Encryption (MSE), are also protected.

---

Best comptia A+ Video Training, Comptia Network+ Certification at Certkingdom.com

Microsoft tells some Insiders to stop using Windows 10 preview

Tuesday's build 10525 warns Insiders, 'You may not use this software if you have not validly acquired a license for the software from Microsoft'

With the resumption of Windows 10 builds to testers, Microsoft has told users they may not have the right to run the software and again begun marking copies with small watermarks.

Microsoft released Windows 10 build 10525 to its Insiders preview participants Tuesday, restarting the early-look program after a four-week hiatus while it pushed the production code to users.

During the pause, the watermark identifying the build as a preview was removed. The watermark has now returned for users who installed a Windows 10 preview. The watermark read, "Windows 10 Pro Insider Preview. Evaluation copy. Build 10525 [emphasis added]."

More importantly, Microsoft has warned users that they may not be legal. "You may not use this software if you have not validly acquired a license for the software from Microsoft," stated the text that appeared when users clicked on the link marked "Read the Microsoft Software License Terms" from Settings/System/About.

"If you do not have express written permission from Microsoft to access the software then you must immediately cease using the software and remove the software from your machine," the copy continued [emphasis added].

The abbreviated license's intention was similar to that of the end-user license agreement (EULA) tied to the production version. "Updating or upgrading from non-Genuine software with software from Microsoft or authorized sources does not make your original version or the updated/upgraded version Genuine, and in that situation, you do not have a license to use the software," that EULA read.

In Computerworld's case, the new watermark and license text appeared on build 10525 after Windows 10 was updated Tuesday from build 10240. That copy of Windows 10 was originally installed on a virtual machine from a disk image -- or .iso file -- downloaded from Microsoft's website. The virtual machine had been newly created, and the Insider preview had been installed from scratch: In other words, it was not backed by a valid Windows 7 or 8.1 license from which an upgrade was authorized.

Others have done the same.
In fact, the practice had been the focus of considerable interest in June, when Microsoft took several tries to explain who of those on the preview program could continue to run Windows 10 after its July 29 launch.

The final word? "Let me start by restating very clearly that Windows 10, whether you get it on 7/29 or whether you got it in a preview form through the Windows Insider Program, is intended to be installed on [a] Genuine Windows device," said Gabriel Aul, engineering general manager for Microsoft's operating system, in a June 22 blog.

"Genuine" is Microsoft-speak for a legitimate, activated copy of its software.
"This is not a path to attain a license for Windows XP or Windows Vista systems. If your system upgraded from a Genuine Windows 7 or Windows 8.1 license, it will remain activated, but if not, you will be required to roll back to your previous OS version or acquire a new Windows 10 license. If you do not roll back or acquire a new license the build will eventually expire," Aul added.

In comments on Twitter around the same time, Aul spelled out what appeared to be a loophole, tweeting assurances that as long as testers continued to run a pre-release build linked to their Microsoft Account -- no matter how it was installed -- Windows 10 would remain activated. "This is pre-release software and is activated with a pre-release key," Aul said of the Insider previews. "Each individual build will expire after a time, but you'll continue to receive new builds, so by the time an older pre-release build expires you'll have received a new one."

Computerworld's copy of build 10525 remained activated, presumably by the kind of pre-release product activation key code Aul referenced.

However, activation does not legality dispense, even if there may not be a way for Microsoft to easily stop users from running an Insiders preview sans an underlying valid license. Nor may it want to: Insiders is an important part of both Microsoft's feedback loop and its external testing regimen.

Once Microsoft completes an update internally, it will be seeded to Insiders, and Insiders only, who will run it for at least a month. At the end of that month, Microsoft will decide if the update is suitably stable -- and that bugs uncovered by participants have been patched -- for the much larger number of consumers tapped into the "Current Branch" distribution track.

---

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

FIVE things you need to know about Google and Alphabet

A look at what’s changing, what's not and what it all means for Google and its research

With Google restructuring its business and moving under the umbrella of new parent company Alphabet, executives may be trying to get back some of their old start-up swagger.

The restructuring will bring a lot of changes to what is easily one of the world's most well-known companies. But company officials haven't offered any information about the move since co-founder Larry Page offered up a blog post Monday.

So what does all of this mean for users and for the industry?
Jeff Kagan, an independent industry analyst, said Google's move is akin to a "middle-aged facelift." What's unclear is just what that will entail.

With that in mind, here are the five things you should know about Google's restructuring:
Don't worry

Like Google search, Maps or your Android phone? That's great. No need to worry about them for now.

"I don't think there will be changes to product," said Brad Shimmin, an analyst with Current Analysis. "All the road maps they have in place will continue. At least for the foreseeable future, which is about 18 months in this industry, all the plans Google has had in play will remain."

It's simple: Things like search and Android have been the money makers for Google. The company has no reason to shake them up.

"Companies periodically have to go through restructuring to position themselves for the future," said Scott Strawn, an analyst with IDC. "This isn't about product. This is just the way the business world works.... I don't see any real product changes right now."

Let Google be Google
Now that Google has been trimmed of research projects like autonomous cars, Google Glass, drones and smart contact lenses, the company will be far more focused on core Internet-related businesses.

Google executives will no longer be splitting their attention between search and high-altitude balloons, or between Android and funding startups. Instead, they can focus on the products and services that make money for the company -- and that should mean more advances in those areas and more agility against competitors.

"It allows Google, the Internet property, to be more fiscally responsible and focused on what that company does," said Shimmin. "Because they were pulled in so many different directions, [co-founders] Sergey [Brin] and Larry [Page] had a lot to contend with, in terms of prioritization and coordination. Leaving Google on its own should make the company more successful because executives won't have to worry about so much else. They won't have to worry about the success of Google Glass and how they might affect the whole business."

The restructuring also means that Google's research projects will get their own executives and their own singular attention.

Relieved of the hefty administrative chores related to managing the Google colossus, the company's research arm can give more attention to things like Internet connectivity balloons, Google Fi and wearables.

"This new structure could help focus the founders' attention, and resources, on all of the much smaller companies and technologies that Google has either purchased or developed over the past several years," said Dan Olds, an analyst with The Gabriel Consulting Group. "We could also see these ancillary businesses receive more authority to make decisions on their own, which could drive quicker innovation and greater consumer impact."

Shimmin agreed, adding that Alphabet companies like Google X, which has been behind projects like Glass and driverless cars, will have more freedom under the new business structure.

"They won't have to worry about pulling resources away from their responsible revenue-making entities," he said. "Research will have its own set of finances. This lets the big multinational company sit separately, while the small, start-up-like entrepreneurial parts are set free. If they're going to have the focus to do more research, we'll see some innovations that have greater vision to them."

A happier Wall Street?
Wall Street's big investors are hopeful that the restructuring means they'll get a clearer look at how the company spends its money and where these different research projects are heading.

For some time, Wall Street has been pushing Google to be more transparent financially. How much is it spending on high-altitude balloons and drones? What is the expected revenue for Google Glass?

The company, despite Wall Street's insistence, has been mum on the subject. Now, though, that could change.

All of the businesses underneath the Alphabet umbrella should provide more financial information. Alphabet is expected to segment out its financials by its fourth-quarter earnings report, which should make Wall Street happy and could boost Alphabet's stock.

"This is Google becoming more transparent," said Kagan. "They were never really transparent and that has been causing them to stumble.... Google is a Silicon Valley creation. Everyone in Silicon Valley loves the young. Google has been growing and getting older, less youthful. This will hopefully help Google look more youthful to investors, workers, users and partners."

Google's new chief
As part of the restructuring, Sundar Pichai, who had been a vice president at Google overseeing Android, Chrome and Google apps, has been named CEO of the new trimmer Google.

"This is the man," said Shimmin. "This is the guy who brought us Android and the guy who has already basically been running their biggest cash cow. He's very charismatic and he's definitely [at the] CEO level of competence and swagger that you would expect to see from a company like Google. I think he's the perfect choice."

For a man who already has had so much success at Google, Pichai now can run Google's core businesses without having to figure out how other projects fit in and how to relate them to the board of directors and stock holders.

"With Pichai at the helm, I am hoping to see a Google more focused on all things Google as we've known it," said Patrick Moorhead, an analyst with Moor Insights & Strategy. "Pichai will need to make yet another run at being successful in social media, which has eluded Google so far."

---

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

Don't bother with Microsoft Windows 10 until you read this

This OS release might fix many problems and resolve some usability problems, but make sure you look before you leap

Wait, doesn’t it always make sense to download something for free? Microsoft released its brand-new operating system this week, and you can grab it at no cost, but make sure you know exactly what you are getting into before you upgrade.

Let me be your guinea pig on this one. I’ve been testing the beta for several weeks. HP just sent me an Elite X2 laptop with Windows 10 preloaded. And, I’ve been testing and using Windows since the 2.0 release back when people used to question a “windowing” interface. I’ve been testing Windows laptops for a decade or more.

The first thing you should do before making the upgrade is to look closely at the gear you have attached to your computer. I mean closely. You might already know that Microsoft has put great effort into making sure just about every printer and scanner in the known universe will work with the new OS, but what if you own one from an unknown universe? More to the point, if you have really odd peripherals — say, a 3D printer or maybe a drone that needs constant driver updates — think twice about jumping on the download so quickly. Check with the peripheral maker first.

Second, ask yourself some tough questions about why you are updating. Are you an early adopter? It’s definitely less risky than being one of the first people to drive an autonomous car or use a new VR headset when there are so few VR apps. You can expect Chrome to run smoothly (I’m using Google Docs on Chrome running on Windows 10 right now). But any new OS will have some issues. Maybe they are security-related. Maybe your accounting app will crash. Be ready to spend time tinkering and have a good backup plan (and a good backup). At least do the upgrade during a time when you don't have a ton of projects due.

I do most of my work in the cloud these days, and I always have a few computers floating around. It’s an incredibly low-risk upgrade for me. If one of them crashed, I'd grab another, I tend to live on the edge (and the Edge) when it comes to computing, but then again, I don’t have to do the payroll for hundreds of employees or develop a marketing brochure using Photoshop by 5 o'clock tonight.

If you get past those hurdles, it’s time to think about why the upgrade makes sense. It’s a smarter interface. The Start menu is now located back where it belongs, on the left-corner of the screen instead of taking over your entire screen with tile apps. That means it is easier to use. Before, you had to know where to find simple features like how to turn the computer off. Microsoft has mostly addressed the usability problems in Windows 8 with this release. It's getting great reviews.

It’s faster, easier and smarter. It’s also not going to change your world in a million ways. Windows 10 has not made much of a difference in how I work, the apps I use, or the fact that I tend to do most of my work in a browser these days. I don't mean that as a diss, I'm just not that OS-centric these days, There’s still some question about whether it will run reliably, and there’s no way to know unless you try it with your apps on your computer for a few days or weeks. It’s pretty tough to go back to a previous OS. Anything new in technology should be evaluated for the value it provides to you, not just because it is new, available, free or good.

I’m not saying to skip this release at all. After complaining about Windows 8 over and over again, I will say that Windows 10 is a big step forward in making the OS more user-friendly. I’m happy with the update so far and haven’t have any problems. Your mileage (and patience level) will vary. As with any new OS, just be careful before you jump into the fray.

---

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com