full-disclosure - Re: SLAAC Attack - 0day Windows Network Interception Configuration Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Mon, 04 Apr 2011 12:17:09 -0400
From: Valdis.Kletnieks@...edu
To: Adam Behnke <adam@...osecinstitute.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: SLAAC Attack - 0day Windows Network
	Interception Configuration Vulnerability

On Mon, 04 Apr 2011 10:34:51 CDT, Adam Behnke said:

> InfoSec Institute security researcher Alec Waters has just released a new
> article on SLAAC Attacks. The basic premise is to use the default network
> configuration found on all Windows 7 (as well as Server 2008, Vista)
> installations to intercept and hijack all network traffic without any user
> knowledge or interaction. 

Please read RFC4862, section 6, Security Considerations.  Nothing
actually new here, unless you've found issues above and beyond the
ones mentioned in that RFC.

Content of type "application/pgp-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/