Researcher's Death Casts Pall Over TCP Fix

Outpost24's Jack Louis died before patches for the flaws he found could be released

By Robert McMillan

April 08, 2009 — IDG News Service —

The security researcher who discovered a major networking flaw that could be used to take down Internet servers has died, leaving others to carry on the work of fixing the flaw without him.

Jack Louis died in the early morning of March 15 of smoke inhalation during a fire in his home in Karlskrona, Sweden. He was 32. Prior to his death, he had discovered a half-dozen vulnerabilities that could be used to attack computers via the Internet, using what's known as a Sockstress attack.

The attack could allow a low-bandwidth computer to knock very large servers off of the Internet by attacking the TCP (Transmission Control Protocol) software used by systems on the Internet. Although technical details of the attack have not been disclosed, it could be targeted at routers, servers, and even firewalls.

"These vulnerabilities have been around for a long time, and to the best of our knowledge they have not been used in the wild," said Robert E. Lee, the Outpost24 researcher who worked with Louis on the issue, and who had frequently presented with Louis at security conferences and training sessions.

Lee has had to step up to fill in his colleague's shoes following the death. "It's been rough," he said. "Jack's been a very close friend and business partner for the past six years. We did everything together."

The Finnish national Computer Emergency Response Team, (CERT-FI) which has been coordinating work with the many vendors who must patch the issue, says it expects to see patches by year's end.

The situation is unprecedented, said Jussi Eronen, an information security adviser with CERT-FI.

"Jack's death didn't make our work any easier," Eronen said. However, he added, "he documented his work very well and we have received the necessary materials to report issues to vendors."

Lee expects to see patches in early June, although that date could be pushed back. "The problem is, we can't have one vendor release [a patch] without all the other vendors releasing it at the same time." Otherwise, malicious hackers could reverse-engineer the fix in order to attack an unpatched system.

Louis didn't have the chance to hand over all of his vulnerability research before his death, Lee said. "There were a number of additional [vulnerabilities] where Jack didn't have enough information to give the vendors," he said.

To keep his work alive, however, Louis' friend Rick Jones is setting up a foundation that will continue his work.