full-disclosure - Re: Linux - Indicators of compromise

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 27 Jul 2012 12:11:16 -0400
From: jerry@...kologist.com
To: "Scott Solmonson" <scosol@...sol.org>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Linux - Indicators of compromise

> I can't tell if I'm being trolled or not...

Good question.

>> Is I am on your network, good luck is find me especially in is post
>> exploitation as I am is liable to float around is piggyback from one
>> machine is to the next. You can is assume all you want about port
>> security in is in fact, utterly worthless in post exploitation as is
>> likely I am not even in your physical network. Please is go back to
>> CCNA studies and is stop bastardize is something you know a
>> ''modicum'' of is about. You fail is off jump with word 'assume'
>
> Whatever layer-2 feats you've performed or will continue to perform,
> you're still very trackable and monitoring/blocking you at layer-3 is
> trivial.

Assuming it's not a troll, my suspicion is that it's common where
Musntlive comes from to use unmanaged switches at the distribution level. 
I think he has a great point in that case - if you can't associate MAC's
with ports and hence physical connections, you do indeed have a problem. 
And to cut off any rebuttal from Musntlive, yes I am fully aware of how
easy it is to spoof MAC addresses.  However, if you want your packets on
the network, the switch is going to be aware of that your MAC is coming
from a particular system (again, assuming managed switches and a one to
one relationship of servers to switch ports).  If you have a way around
that, I suspect you'll have a great talk for Defcon next year.

In this mess of emails, I somehow completely lost the context of how we
went from a question on being able to analyze a Linux system to determine
if it's compromised to arguing about whether we can track back an attacker
sending (malicious?) broadcast packets on a network to a specific server.

Jerry

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/