full-disclosure - Re: Drive-by Pharming

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <7BE8B2EFA7D0DE4F9E31B7F69EA2CF3D02384E29@MAILER.er.ucsd.edu>
Date: Fri, 16 Feb 2007 10:08:06 -0800
From: "McCarty, Eric C." <emccarty@...ucsd.edu>
To: Knud Erik Højgaard <kokanin@...il.com>,
	"James Matthews" <nytrokiss@...il.com>
Cc: Oliver Friedrichs <oliver_friedrichs@...antec.com>,
	full-disclosure@...ts.grok.org.uk
Subject: Re: Drive-by Pharming

One item is that I have not seen considered is how this could be used in a corporate network just the same as a home user scenario (it's possible I missed it). True that a good amount of Home users don't actually change device passwords, but lets be honest, same applies to many businesses as well.

Use a JavaScript port scanner to scan internal devices for web interfaces or telnet responses, and then add a few routines to try to login using default passwords, and then modify dns settings or other such settings (even hardcode entries into local hosts file) on the device and viola. 

As for defenses, let's state the obvious:

1). Change Default Passwords
2). Hard Code ACL's to allow administration from only certain IP's (this is more from a business environment admittedly)
3). Turn off JavaScript or use the No Script Plug-in

That's it off the top of my head, maybe some monitoring of outbound connections and log file analysis to round it off but really the common sense issue is #1.

Eric McCarty

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/