Neowin.net - Adobe Photoshop 7

Adobe Photoshop 7

Posted by configure on 26 February 2002 - 06:08 · 19 comments & 1792 views

Thanks RmG for the heads up.

Adobe® Photoshop® 7.0 software, the professional image-editing standard, helps you work more efficiently, explore new creative options, and produce the highest quality images for print, the Web, and anywhere else. Create exceptional imagery with easier access to file data; streamlined Web design; faster, professional-quality photo retouching; and more.

View: What's new in Adobe Photoshop 7

View: Purchase Adobe Photoshop 7

Download: Complete changes list (9 Pages, PDF)

What it is
A SYN flood is a DoS attack in which server resources, not bandwidth, are stressed. It fakes the initial handshake of a TCP connection with spoofed IPs which the target machine is unable to answer, so the target machine allocates system resources in anticipation of a connection which is never completed. Re-tries and time-outs add up to perhaps three minutes per bogus SYN. A server's capacity to respond to legitimate requests can be devoured in a matter of seconds with very small packets. Only four or five compromised client machines can cripple a server; in this way it's a fiendishly economical attack.

The handshake is simple: a client initiates with a SYN (synchronize) packet; the server replies with a SYN/ACK (synchronize/acknowledge) packet; and the client finalizes with an ACK (acknowledge) packet. If these steps are followed, a TCP connection is established between the two.

GENESIS attempts to negotiate the handshake without allocating system resources until the client's IP can be verified. This is a common-sense approach, essential to SYNcookies as well. But SYNcookies were worked out over time by people who, unlike Gibson, have a solid grasp of TCP/IP and the machines it connects. Even so, it took time and collaboration, and intellectual modesty, to get all the kinks ironed out.

Unfortunately Gibson is so infatuated with the self-created myth of his own genius that he can't be bothered to consult Bernstein and Schenk, or anyone else for that matter, but goes it alone, inspired only by his overweening pride and essential incompetence. Of course his "Beautiful and Perfect" creation is going to be sadly defective. How could it be otherwise?

One Reg reader who wishes to remain anonymous believes that GENESIS is more than a mere failure, but actually worse than no SYN protection at all. It was this person who originally brought the GENESIS project to our attention, and s/he's offered some very insightful observations.

How it's done
Put simply, authenticating a TCP connection request requires the server to encrypt some aspect(s) of the client's and the server's status so as to ensure that the final ACK comes from the same source as the original SYN (pun fully intended).

Data such as the client's ISN (Initial Sequence Number), originating IP and port, MSS (Maximum Segment Size), and the server's IP and port, can be hashed to produce a server ISN which must be available for decoding in the final ACK packet. If the arithmetic fails, the ACK is rejected and no resources are devoted to the bogus connection. If it works out, a connection is made.

Old cookies absolutely need to expire so they can't be reused; and old sequence numbers need to be identifiable so that they don't get mixed up with those belonging to a newer connection. Something unique ('secret') needs to be plugged into the hash so that cookies valid for one server can't be used on another, and so that valid ISNs can't be guessed or bruteforced easily.

Broken
Anyone who reads Bernstein and Schenk's correspondence linked above will see that authenticating a SYN request is no trivial matter. There are a number of obstacles, but Gibson manages to overcome only one of them. Yes, he does manage to deal with the problem of disembodied sequence numbers, so that out-of-date numbers aren't carried over to complicate packet reconstruction on a new connection.

But Gibson is silent on the rest of the issues Bernstein and Schenk have labored to solve.

First, he offers no means to cause a cookie (or "Encrypted Token," as he prefers to call it), to expire. A valid cookie can be used to establish a connection. A lot of valid cookies can be used to establish a lot of connections. Perhaps Gibson is unfamiliar with the term 'packet sniffer.' Too bad. We'll just sit back and watch the kiddies gather up zillions of his broken SYNcookies to use against the fools who trust him.
Second He ignores MSS. It's hard to achieve decent performance without knowing it.
Third, he doesn't use a secret, which means that valid ISNs can be bruteforced and valid ACKs generated -- and abused.
Fourth, he uses RC5, which is slower than MD5 used in SYNcookies -- another performance hit (just in case his gross security sloppiness didn't already frighten you away).

Pants on fire
Gibson dares to pretend that he'd never heard of SYNcookies when he set off in quest of beauty and perfection. "Immediately after I posted the second part of this work to the Web, several participants in the news groups at grc.com reported that similar work had been done before. I was unaware of previous work in this area, and consequently developed my solution independently and without the benefit of any previous work," Steve claims. I don't believe a word of it. I think he deliberately set out to knock-off SYNcookies and simply failed because the work was too difficult. He's not an übergeek; he just plays one on his Web site.

I did a Google search and turned up more than 7,000 Web pages with the terms 'SYNcookies' or 'SYN cookies'. This guy is hacking TCP, yet he never once encountered a single mention of it?

Impossible. No human being could have his head that far up his own ass -- not even Steve Gibson

Hide additional information

About the Author
Full name: Unknown
Forum name: vet

configure
Contact: via forum PM
Submissions: Normal · Headline

Total votes: 0

Bookmark on del.icio.us

Advertisement

#1 Posted by drewster2100 on 26 Feb 2002 - 06:13: sweet, cant wait to check it out

Last edited by 2488 on 26 Feb 2002 - 06:13

#2 Posted by Hawkeye on 26 Feb 2002 - 06:21: This was more or less announced right on the main page just one day ago. It's right here: [url=http://www.neowin.net/comments.php?id=3187&category=main]Main page article[/url] Sure it announces it for Mac from the headline, but the article itself mentions Photoshop 7 for Mac and Windows.

Last edited by 5076 on 26 Feb 2002 - 06:22

#3 Posted by deron dantzler on 26 Feb 2002 - 06:23: hopefully it incorporates some of the tools from photoshop elements because i've been using elements since ever since it came out...it was way better than photoshop 6...(recipes, easier to use filters, etc)

#4 Posted by ih8fake on 26 Feb 2002 - 08:32: Well...Photoshop Elements is not for power users and it was made for those who don't know much about "how-to-do" stuff. And...it was not made for print! That's why Photoshop is a program for pros and heavy to learn all the details on how-to-do-stuff...but when you do learn......it's like don't-want-another program ;-)))

#5 Posted by wtmcgee on 26 Feb 2002 - 15:27: finally native support of os x! whipee!

#6 Posted by Neobond on 26 Feb 2002 - 16:51: [quote]for those who don't know much about "how-to-do" stuff[/quote]I know how-to-do it really I do

Last edited by 2 on 26 Feb 2002 - 16:54

#7 Posted by Mr magoo on 26 Feb 2002 - 17:21: of course!!!

#8 Posted by RmG on 26 Feb 2002 - 17:37: Thanks Configure for posting my submitted article

#9 Posted by YahoKa on 26 Feb 2002 - 18:52: What and i JUST got photoshop 6 !?!?!? #%@!%

#10 Posted by noll3095 on 26 Feb 2002 - 19:25: Any word on a release date? I only see to be notified when you can pre-order which it says will be in mid-March.

#11 Posted by Xenomorph on 26 Feb 2002 - 19:41: #9, surprised 7.0 just came out? 6.0 came out several years ago. its like saying you JUST got Win98SE when WinXP came out.

#12 Posted by timdorr on 26 Feb 2002 - 20:08: Pfft. Photoshop is overrated crap. I can do EVERYTHING it does in PSP and I can actually, *gasp*, draw in PSP. It's like Photoshop and Illustrator in one. Seriously, the only reason this product is on top is becuase it is viewed as a "must-have" product with no one look at how truely inadequate it is. Man, I think I just might start a thread on this...

#13 Posted by frod on 26 Feb 2002 - 20:32: overrated to you maybe. there is a big difference between what you can do with a program and what the program can actually do (i'm assuming your statement that PSP can do EVERYTHING photoshop can and MORE, is based on what you know how to do in photoshop and not what photoshop actually has the potential to do). anyways, whatever program you're more familar with is most likely the program you will like more. in my personal opinion, when i used PSP it was extremely inferior to photoshop just due to the fact i didn't know how to do things in PSP that i could do in photoshop. i don't think photoshop is overrated but i do think it is overpriced .

#14 Posted by fizik2 on 26 Feb 2002 - 21:38: blah... psp blows, photoshop for life... besides it costs 500-600 dollars more, now why would they make it that much more expensive for nothing? hmm, answer that, slappy! i like photoshop, and have been using it for about 3-4 years. ive used psp before and well i completely dislike it.

#15 Posted by Ice Blue on 26 Feb 2002 - 22:13: #11. 6 hasn't been out "several" years. Several usually means 3 or more. I think it came out less than 2 years ago.

#16 Posted by Xcalibur on 27 Feb 2002 - 01:41: release date is in about 2 months i think.

#17 Posted by iconman on 27 Feb 2002 - 02:42: it's going to released in June/July... That's what I heard

#18 Posted by iconman on 02 Mar 2002 - 05:59: I cant wait for it!

#19 Posted by Robert_Hague on 03 Mar 2002 - 17:19: [quote]Pfft. Photoshop is overrated crap. I can do EVERYTHING it does in PSP and I can actually, *gasp*, draw in PSP. It's like Photoshop and Illustrator in one. Seriously, the only reason this product is on top is becuase it is viewed as a "must-have" product with no one look at how truely inadequate it is. [/quote] You cant be serious?? PSP is for children.

[1]

Commenting has either been disabled on this article or you are not logged in. Click here to login or register, its free!

Note: Anonymous commenting is disabled in order to keep the quality of responses to a high standard.