full-disclosure - Re: Ip address and mac address hardcoded

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20131117104557.9793A601EC@smtp.hushmail.com>
Date: Sun, 17 Nov 2013 10:45:57 +0000
From: mramelie@...hmail.com
To: "full-disclosure" <full-disclosure@...ts.grok.org.uk>
Subject: Re: Ip address and mac address hardcoded

Hello,
  I have check it with IDA, its used in the case, but I'm still
working on the details. Its a public routable ip address and the mac
is a valid one from the same vendor. Doesn't make sense to be the mac
from the device, because the firmware I'm analyzing is an upgrade so
it must be generic. I will give more information has I have it.
MRA

On 11/17/2013 at 10:24 AM, "Burak CIFTER"  wrote:Even if it's a
factory default configuration after reset, I see no reason to hardcode
a MAC address. 
Check the firmware with IDA and control if the MAC/IP addresses are
used for a condition. Not far ago, we've seen the D-Link Router
backdoor was using a hardcoded user-agent. So it is slightly possible
to by-pass authentication from a pre-configured IP address or MAC
(from a local network). 
On Sat, Nov 16, 2013 at 1:59 PM,   wrote:
 Hi all,
  I've been doing some investigation, and I come acrosss an ip address
and a mac address hardcoded in some libraries of a firmware for a
vendor. Why should it be there this kind of hardcode? 
MRA
_______________________________________________
 Full-Disclosure - We believe in it.
 Charter: http://lists.grok.org.uk/full-disclosure-charter.html
 Hosted and sponsored by Secunia - http://secunia.com/

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/