full-disclosure - Re: DoD ...and r57(!?)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <BANLkTi=TSGTXAT2DoBTTS8Y=LEW0aRfHsw@mail.gmail.com>
Date: Sat, 28 May 2011 14:50:09 -0700
From: t0hitsugu <tohitsugu@...il.com>
To: coderman <coderman@...il.com>
Cc: "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Subject: Re: DoD ...and r57(!?)

 No, you are correct, I wasnt :/ Kismet would have been a good idea..it just
happened so fast I was goingwith the first thoughts in my mind.

Whoever it was must have been very disappointed..nothing on my box anyone
would want as I just formatted it for bt.

One possibility is someone with a tmobile phone using a debian chroot was
nearby, as they happen to share the same ip...I need to recheck the packet
headers

> On May 28, 2011 2:10 PM, "coderman" <coderman@...il.com> wrote:
> > On Sat, May 28, 2011 at 6:13 AM, t0hitsugu <tohitsugu@...il.com> wrote:
> >>...
> >> I noticed my connection had suddenly slowed to a crawl and did a scan
on
> >> myself (running bt5 gnome 32) and was quite surprised to see I had
around 18
> >> open ports, most of them connected to a server with the ip of
> >> 26.195.181.202. Curious, I did  a GET on one of them 33644 and saw the
r57
> >> spider pop up. I tried to ncat a couple more in hopes of getting a bind
to
> >> trace but they all closed shortly after.
> >>
> >> According to wireshark, nmap and whois they werent being spoofed. The
server
> >> also happens to be registered to the DoD...lol.
> >>
> >> Has anyone ever encountered something like this before? Seems a lot of
> >> trouble youd be risking borrowing the address of a military/gov domain.
> >
> >
> > how do you know they weren't being spoofed? a local attacker on
> > wireless can pretend to be any endpoint in your path.
> >
> > bet you weren't watching arp tables. (static arp; an oldie but
goodie...)
> >
> > wpa2 is a fig leaf, and wifi carries far beyond the walls of your
> > coffee shop. you need kismet not wireshark for these situations.

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/