full-disclosure - AW: RE: Computer Sabotage by Microsoft

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

From: rgerhards at hq.adiscon.com (Rainer Gerhards)
Subject: AW: RE: Computer Sabotage by Microsoft

As I said, I do not have an XBOX... Somebody who can confirm? 

> Rainer Gerhards wrote:
> > I may be wrong, but I thought they would obtain the MAC address via
> > some API they have in their XBOX, that is they talk to the box, ask
> > it for its address and the box replies with it. Then, the router
> > won't help.
> Surely that would make it even worse - as all that is needed 
> is the xbox
> itself, and a hack of the API that increments the mac by one 
> every time it
> is queried?

I assume, if they are not dumb-minded, that the communication is using
strong cryptography and that the API also deals with cryptography (if it
exists). So it should be hard to do. But if you hack the box, that could
probably make it really worse.

One safeguard against this would be to only allow one MAC address per IP
within a given period of time. That doesn't mitigate the total risk, but
it would reduce such a DoS on innocent XBOXes... As would a whitelist of
shipped MACs.

Rainer