# Netflix found vulnerabilities in FreeBSD



## sidetone (Jun 18, 2019)

Multiple Linux and FreeBSD DoS Vulnerabilities Found by Netflix
					

A denial of service flaw found in the way recent Linux and FreeBSD kernels handle TCP networking can be exploited by remote attackers to trigger a kernel panic in vulnerable systems.




					www.bleepingcomputer.com


----------



## aht0 (Jun 18, 2019)

Netflix's provided patch https://github.com/Netflix/security...sories/third-party/2019-001/split_limit.patch


----------



## forquare (Jun 19, 2019)

Perhaps good to pull this out:


> Luckily, as explained by FreeBSDHelp, FreeBSD 12 does not have RACK enabled by default and requires a custom kernel to be toggled on.


----------



## phoenix (Jun 26, 2019)

A more appropriate headline would be "Netflix finds vulnerabilities in custom TCP/IP stack written by Netflix, included in FreeBSD, but not enabled by default".  

The RACK stack was originally written by Netflix, for use by Netflix, and upstreamed into FreeBSD (as Netflix uses FreeBSD for their OpenConnect CDN).  The RACK stack included in FreeBSD 12.0 is disabled by default and requires a bit of hoop-jumping to enable (meaning it's not just a simple entry in rc.conf).  So, the number of people affected by this issue is pretty much Netflix.  

As shown above, there are patches available already for those who want to use RACK in FreeBSD 12.


----------



## Deleted member 9563 (Jun 26, 2019)

phoenix said:


> A more appropriate headline would be "Netflix finds vulnerabilities in custom TCP/IP stack written by Netflix, included in FreeBSD, but not enabled by default".


That's so old fashioned.  In a world where clicks are worth more than facts, we'd get more return from "Netflix Guilty of Poisoning Freebsd!"


----------



## ralphbsz (Jun 27, 2019)

In the department of "wrong party being blamed", did you all hear about the fracas with the new Neil Gaiman / Terry Pratchett movie "Good Omens"? It's about an angel (from heaven) and a daemon (from hell), both who are stationed on earth, becoming sort of double agents, and trying to prevent armageddon, and save humanity. The humorous depiction of religion has ultra-conservative christians upset, and they demanded that Netflix stop the series. Only problem is: it isn't Netflix, it's Amazon. Oops.


----------



## Crivens (Jun 27, 2019)

ralphbsz Great book. I read it some years ago and I am still laughing over it.

OJ You dropped the ball there a bit short. Why didn't you include women and children in that headline? Bonus points for "... eats endangered pets of suppressed minority"


----------



## ralphbsz (Jun 27, 2019)

Crivens said:


> ralphbsz Great book. I read it some years ago and I am still laughing over it.


The movie (or more accurately series) is very good too. I loved the book when it came out, and read it often enough that I can quote lines from it. Usually, knowing a book well makes one less inclined to like the movie, but I enjoyed that a lot.


> "... eats endangered pets of suppressed minority"


Time for funny anecdote. We live in relatively remote mountains, near Silicon Valley. There is a deep valley near our house, which is difficult to inhabit (no electricity, nasty terrain, water sources are small springs and seasonal creeks, no paved road, some areas only accessible via seasonal temporary bridges), and the folks who live there are refugees from society: outcasts, drug addicts, psychological problems, released criminals. One family there are ultra-conservative christians, who want to live far away from the sins of modern society (20 minutes from Silicon Valley!), and raise their children in near perfect isolation. To do that, they have chickens and a large vegetable garden. Another person there is a vietnam veteran and multiple-times convicted criminal (drugs, guns), who keeps a few small pigs as pets: they are his best friends, and after a while he eats them. Well, one day one of his pigs got away, and ran to the christian's vegetable garden. He ran after it to catch it, and while trying to catch and recover it, he said some words they didn't like, like f*** and s***. They didn't like those words so badly that they beat him up. So badly that he called the sheriff, and they were arrested. It leads to a court case, where they defend themselves by saying: their kids having to hear these 4-letter words is so offensive, it gives them the right to stop those words from being said. Well, the judge didn't agree, and restraining orders were issued by the judge. Which didn't make things better, it just transferred the vendetta to different victims: the chickens died. Then one of the pigs died of a gun shot wound, and we can safely assume that it was not self-inflicted (pigs don't have trigger fingers). Unfortunately, the area doesn't have electricity (no refrigerated storage), so a small part of the pig had to be prepared and roasted right away, and the rest was wasted.

This was several years ago; the parties involved still live there (well, except for the chickens and pigs which remain dead), and I have no heard of further murder and mayhem from them. Now, imagine being a regular police officer (we call them sheriff's deputies here), and being called to deal with 4-letter words, beatings, and dead pets. That's why being a cop is such a hard job.


----------



## drhowarddrfine (Jun 27, 2019)

ralphbsz said:


> That's why being a cop is such a hard job.


One of my sons is a cop. This is so true.You wouldn't believe some of the stories he can tell every day.


----------



## Crivens (Jun 27, 2019)

ralphbsz Sounds fun. The part with the pig shooting itself is not impossible, though. Scondland Yard once released a press notice saying that Mr. Soandso had committed suicide by shooting himself with a high powered rifle from the other side of the street. So we see some impossible stuff any day.


----------



## Deleted member 9563 (Jun 27, 2019)

That sounds like the guy who comitted suicide by shooting himself twice in the back of the head.


----------



## scottro (Jun 27, 2019)

One thing I learned, never joke about suicide after a surgery. I gave a throwaway line about a budget euthanasia option after surgery, and suddenly they had me watched 24 hours, and a meeting with a psychiatrist (not covered by insurance). I'm tellin' ya, no sense of humor these hospital people. Must be the long hours.  Also, if they take blood, they get annoyed if you call it exsanguination.  (Hrrm,  the forum software says that's spelled wrong, but it isn't. )  Though they did have to laugh when I started singing it to the tune of Carly Simon's, "Anticipation."

But seriously, don't make jokes about suicide if you're in the hospital, they'll take longer to let you out.


----------



## ralphbsz (Jun 28, 2019)

There are many cases of highly suspicious suicides. My favorite was Mike Irvine ... he may be the guy who Scottro refers to. He owned the Irvine company, which at the time owned a large amount of what is today Orange County, CA (the big area south of LA), and after whose family the city of Irvine and the co-located university is named. Even today, the Irvine company has giant land holdings, including many office tracts here in Silicon Valley. So here is this super-rich person, and suddenly one day he withdraws a very large amount of money (like 1/2 million, which in those days was still real money) in cash from the bank. The next day he is found dead in the basement, and his death is ruled a suicide. It turns out he shot himself TWICE with a shotgun. If you have ever seen a shotgun wound from close range (I've never seen it live, but the effects are well known in the gun community), they leave a crater that is typically 15cm deep and 5cm wide. After doing that, he calmly proceeded to shoot himself with a handgun in the head, but on the right side of the head using his left hand, even though he was right-handed. After that, he expired. From a purely mechanical and medical standpoint, this makes absolutely no sense. But where he lived, his company owned all land for miles around, so the sheriff's department gave the reason that caused the least legal trouble for his family and company.

The other good one was the CFO of Enron. As they were getting into a little bit of trouble, the CFO suddenly agreed to testify about the Enron case. Shortly after that, he was found dead, and his death was ruled suicide. Supposedly he shot himself in the head. The only unfortunate thing is that he didn't use a regular bullet, but "snake shot", which are small cartridges loaded with tiny lead balls, under 1mm diameter each. They work well against soft-skinned animals (like snakes), but would not penetrate a human skull. Furthermore, no smoke (technically propellant) traces were found on him, so he must have shot himself from a distance larger than 1m ... which is kind of difficult in a suicide. But Enron was such a dominating force in Houston politics at the time (in spite of their financial troubles) that the authorities ruled it a suicide.

Actually, that Enron story goes on. Eventually the company collapses, and the CEO is tried in criminal court for financial crimes. Shortly before the completion of the trial, he dies, I think of a heart attack. Because a dead person can not be convicted, he is still considered innocent (after all, innocent unless found guilty), which has created giant problems for civil cases that have tried to go after assets of former Enron stakeholders. Interesting coincidence.


----------



## Crivens (Jun 28, 2019)

And then there are those who are rumored to have used the wrong detergent when cleaning the financial assets of a respectable family business. IOW loosing some 100 millions while money laundering for the mob and having those deals backed by an insurance of some thousand $. I am tempted to call that self inflicted ceasing of coherent function.

scottro Yes, be careful what you say. I have family wearing the white and boy do they have stories to tell...


----------



## phoenix (Jun 28, 2019)

ralphbsz said:


> In the department of "wrong party being blamed", did you all hear about the fracas with the new Neil Gaiman / Terry Pratchett movie "Good Omens"? It's about an angel (from heaven) and a daemon (from hell), both who are stationed on earth, becoming sort of double agents, and trying to prevent armageddon, and save humanity. The humorous depiction of religion has ultra-conservative christians upset, and they demanded that Netflix stop the series. Only problem is: it isn't Netflix, it's Amazon. Oops.



There's been some interesting back and forth between Amazon Prime and Netflix.  Amazon will cancel _Stranger Things_ if Netflix cancels _Good Omens_.    Will any of the other streaming services jump in to try and cancel shows they aren't streaming?


----------



## phoenix (Jun 28, 2019)

ralphbsz said:


> The movie (or more accurately series) is very good too. I loved the book when it came out, and read it often enough that I can quote lines from it. Usually, knowing a book well makes one less inclined to like the movie, but I enjoyed that a lot.
> 
> Time for funny anecdote. We live in relatively remote mountains, near Silicon Valley. There is a deep valley near our house, which is difficult to inhabit (no electricity, nasty terrain, water sources are small springs and seasonal creeks, no paved road, some areas only accessible via seasonal temporary bridges), and the folks who live there are refugees from society: outcasts, drug addicts, psychological problems, released criminals. One family there are ultra-conservative christians, who want to live far away from the sins of modern society (20 minutes from Silicon Valley!), and raise their children in near perfect isolation. To do that, they have chickens and a large vegetable garden. Another person there is a vietnam veteran and multiple-times convicted criminal (drugs, guns), who keeps a few small pigs as pets: they are his best friends, and after a while he eats them. Well, one day one of his pigs got away, and ran to the christian's vegetable garden. He ran after it to catch it, and while trying to catch and recover it, he said some words they didn't like, like f*** and s***. They didn't like those words so badly that they beat him up. So badly that he called the sheriff, and they were arrested. It leads to a court case, where they defend themselves by saying: their kids having to hear these 4-letter words is so offensive, it gives them the right to stop those words from being said. Well, the judge didn't agree, and restraining orders were issued by the judge. Which didn't make things better, it just transferred the vendetta to different victims: the chickens died. Then one of the pigs died of a gun shot wound, and we can safely assume that it was not self-inflicted (pigs don't have trigger fingers). Unfortunately, the area doesn't have electricity (no refrigerated storage), so a small part of the pig had to be prepared and roasted right away, and the rest was wasted.
> 
> This was several years ago; the parties involved still live there (well, except for the chickens and pigs which remain dead), and I have no heard of further murder and mayhem from them. Now, imagine being a regular police officer (we call them sheriff's deputies here), and being called to deal with 4-letter words, beatings, and dead pets. That's why being a cop is such a hard job.



Let me guess, their last names are Hatfield and McCoy?


----------



## Deleted member 30996 (Jul 3, 2019)

Crivens said:


> Yes, be careful what you say. I have family wearing the white and boy do they have stories to tell...



If you get arrested and say something like that they'll take your shoestrings, even if you didn't really mean it. If you get arrested again years later they'll take them again even if you don't say anything about it.

Alcohol: There's a reason they call it ignorant Oil.


----------

