full-disclosure - Re: Linux - Indicators of compromise

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 25 Jul 2012 12:04:55 +0100
From: Giles Coochey <giles@...chey.net>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: Linux - Indicators of compromise

On 18/07/2012 13:10, Григорий Братислава wrote:
> On Wed, Jul 18, 2012 at 3:18 AM, Giles Coochey <giles@...chey.net> wrote:
>
>>> Is you have much more to worry than is ICMP/GRE tunnels. Is I send to
>>> Broadcast and I am is on your network, how do you is plan to pinpoint
>>> who I am when is everyone see broadcast
>> By your source MAC address
>>
>>
>> --
>> Regards,
> Really? I am so glad your company is has you for security. So a
> message is broadcast to everyone. Everyone on say is /21 is listen and
> you is going to pick me out, out of is everyone else who is listen?
> Genius! Nobel Prize A+++ number one is seller! Is not only is idea you
> mention genius, is good that no one can is change their MAC address!
> Is proof MusntLive must go back is study CISSP and now is CCNA
If you broadcast using a MAC address you are on the same subnet, layer 2.

On a wired network I don't really care whether you spoofed your mac 
address or not, you still registered the mac address on the switch, and 
I can see what port you connected to. Then I just need to follow the 
cable to find you.

In any case, this is an internal intrusion or post-exploitation issue 
we're talking about, not an external one, assuming the layer-2 
environment has a modicum of protection.

-- 
Regards,

Giles Coochey, CCNA, CCNAS
NetSecSpec Ltd
+44 (0) 7983 877438
http://www.coochey.net
http://www.netsecspec.co.uk
giles@...chey.net

Download attachment "smime.p7s" of type "application/pkcs7-signature" (4941 bytes)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/