full-disclosure - Re: DoD ...and r57(!?)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <BANLkTi=h=OwJanU9rZqhF6JGwioanpiJ6w@mail.gmail.com>
Date: Sat, 28 May 2011 14:10:08 -0700
From: coderman <coderman@...il.com>
To: t0hitsugu <tohitsugu@...il.com>
Cc: "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Subject: Re: DoD ...and r57(!?)

On Sat, May 28, 2011 at 6:13 AM, t0hitsugu <tohitsugu@...il.com> wrote:
>...
> I noticed my connection had suddenly slowed to a crawl and did a scan on
> myself (running bt5 gnome 32) and was quite surprised to see I had around 18
> open ports, most of them connected to a server with the ip of
> 26.195.181.202. Curious, I did  a GET on one of them 33644 and saw the r57
> spider pop up. I tried to ncat a couple more in hopes of getting a bind to
> trace but they all closed shortly after.
>
> According to wireshark, nmap and whois they werent being spoofed. The server
> also happens to be registered to the DoD...lol.
>
> Has anyone ever encountered something like this before? Seems a lot of
> trouble youd be risking borrowing the address of a military/gov domain.

how do you know they weren't being spoofed? a local attacker on
wireless can pretend to be any endpoint in your path.

bet you weren't watching arp tables. (static arp; an oldie but goodie...)

wpa2 is a fig leaf, and wifi carries far beyond the walls of your
coffee shop. you need kismet not wireshark for these situations.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/