Microsoft pptp vpn vulnerabilities Exploits in Action

Signature of the attack:
Very sudden blue screen with message: “IRQL_NOT_LESS_OR_EQUAL”
within five seconds of receiving malformed packets using the GRE protocol (47).
0

---

© SANS Institute 2000 - 200
                                                5
, Author retains full rights.
 
 
 
 
 
 
 
 
 
 
 
 
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 
 
© SANS Institute 2000 - 200
5                                                                                                                 
Author retains full rights.
30
No useful information in the Event Logs.
Typical traffic you would see during such an attempted attack (in this case 
against an up to date NT 4.0 SP6a system that is no longer vulnerable) is: