full-disclosure - TiVo Network Security

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20040103173256.D27169@stackheap.org>
From: attica at stackheap.org (S . f . Stover)
Subject: TiVo Network Security

On 03 Jan 04 12:32:20PM Randal L. Schwartz[merlyn@...nehenge.com] wrote:
: If you're using this only for program guide fetching or remote
: programming (no peer-to-peer HMO), you can probably get away with
: simply punching a hole to talk to the tivo central on a specific port
: from your box.  You can enable WEP to prevent casual sniffing: the
: TiVo understands WEP with a single fixed 40 or 128 bit key.

Another thing to keep in mind is that if you are good about rotating your WEP
keys, you'll be much more secure against casual sniffers.  Maybe run airsnort
(or equivalent) at home and when it cracks the key, drop in another one.

Unless there's a different way of cracking WEP than duplicate/weak IVs, this
should put you in reasonable shape.

-- 
aka Dolph Longhorn                      GPG Key ID: 0xF8F859D0
http://pgp.mit.edu:11371/pks/lookup?search=0xF8F859D0&op=index

"There is no such thing as right and wrong, there's just popular opinion."
-Jeffrey Goines
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040103/b3367525/attachment.bin