full-disclosure - Re: what can be done with botnet C&C's? (fwd)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <200608141713.k7EHDSgc009271@turing-police.cc.vt.edu>
Date: Mon, 14 Aug 2006 13:13:28 -0400
From: Valdis.Kletnieks@...edu
To: Dude VanWinkle <dudevanwinkle@...il.com>
Cc: full-disclosure@...ts.grok.org.uk, Gadi Evron <ge@...uxbox.org>
Subject: Re: what can be done with botnet C&C's? (fwd)

On Sun, 13 Aug 2006 08:32:16 EDT, Dude VanWinkle said:
> When I worked at a university, the students were always getting
> compromised till we implemented sandboxing. People DHCP'ing into the
> network were placed in a subnet by themselves till a scan revealed
> that they had:
> 1: up to date AV
> 2: up to date patches
> 3: a Functioning firewall

OK, I'll bite - if you detect a functioning firewall, how do you scan for
up to date patches and A/V?  Seems like you'd have to have at least a stub
client on the machine to answer the "What patchlevel you at?" query.

(And this is the sort of thing that is easy to force install in a corporate
environment where you own the machine.  It's also easy to do if you're a
regular ISP, and you can get away with saying "If you don't like it, go to
another ISP".  It's a can of worms when you don't own the machine, and you're
a de facto monopoly because the student lives in the dorms - a Hobson's
choice "install this or don't get net access" doesn't make you many friends...)

Content of type "application/pgp-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/