Re: Audit: don't only focus on heartbleed issue

[Reindl Harald <h.reindl () thelounge net>]

Am 17.04.2014 01:06, schrieb Tim:
> > and the others need a MITM attack which is not *that* easy
> > as connect to a server and send a heartbleed-packet without
> > anything in the logs of the attacked server
>
> I agree with you here.  It seems that Lucky13 requires much more
> access and is much harder to pull off in practice.  Unless there's
> new techniques out there that I haven't kept up on
>
> > frankly outside a public hotspot / untrusted network nobody
> > but the NSA and otehr agencies are able to really to MITM
>
> This I think is a misconception, or at least overstated.  Anyone on
> the same network as you can MitM you.  Anyone on the same network as
> the remote end point can MitM you.  For some reason in this day and
> age people have all forgotten about ARP poisoning, netbios name
> poisoning, DHCP hijacking, and a whole host of other ways to redirect
> traffic.  And apparently random people halfway around the world can
> hijack your DNS resolver[1].

agreed, but was i meant was that the attack surface in a known, maintained
LAN is way lower than for Heartbleed where for sure straight after it
was made public zombie-botnets startet to randomly attack around the
web port 443, 993 and 995, pulling a unknown amount of data which mostly
is not analyzed now and will be used for all sorts of attacks, spamming
and so on if the found user credentials are not changed in the meantime

that hardly happens inside a closed network - even a server in the network
of a public hotspot has a limited attack surface in that context

> The dividing line between "internal network" and the Internet is
> becoming fuzzier every day.  It is getting easier to get inside and
> yet everyone still seems to run an unsegmented internal "trusted"
> network.

sadly true after every random guy installs a WLAN-AP without any
thougt about security or people don't get a punch from the sysadmin
if their brother enters the company and pulls his infected notebook
straight into the next ethernet port he finds

the latter is also the fault of the admin patching every unused port

on the other side in a well managed network with a isolated guest LAN
coming with NAT and the outgoing IP restricted on the main network
as well as on the AP/Router itself there is not much room for ARP
spoofing or DHCP hijacking, even cheap WLAN routers support blocking
traffic between the client stations

Attachment: signature.asc
Description: OpenPGP digital signature

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/