Full Disclosure mailing list archives
Re: Linux - Indicators of compromise
From: jerry () riskologist com
Date: Fri, 27 Jul 2012 12:11:16 -0400
I can't tell if I'm being trolled or not...
Good question.
Is I am on your network, good luck is find me especially in is post exploitation as I am is liable to float around is piggyback from one machine is to the next. You can is assume all you want about port security in is in fact, utterly worthless in post exploitation as is likely I am not even in your physical network. Please is go back to CCNA studies and is stop bastardize is something you know a ''modicum'' of is about. You fail is off jump with word 'assume'Whatever layer-2 feats you've performed or will continue to perform, you're still very trackable and monitoring/blocking you at layer-3 is trivial.
Assuming it's not a troll, my suspicion is that it's common where Musntlive comes from to use unmanaged switches at the distribution level. I think he has a great point in that case - if you can't associate MAC's with ports and hence physical connections, you do indeed have a problem. And to cut off any rebuttal from Musntlive, yes I am fully aware of how easy it is to spoof MAC addresses. However, if you want your packets on the network, the switch is going to be aware of that your MAC is coming from a particular system (again, assuming managed switches and a one to one relationship of servers to switch ports). If you have a way around that, I suspect you'll have a great talk for Defcon next year. In this mess of emails, I somehow completely lost the context of how we went from a question on being able to analyze a Linux system to determine if it's compromised to arguing about whether we can track back an attacker sending (malicious?) broadcast packets on a network to a specific server. Jerry _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: Linux - Indicators of compromise, (continued)
- Message not available
- Re: Linux - Indicators of compromise Григорий Братислава (Jul 18)
- Re: Linux - Indicators of compromise Leutnant Steiner (Jul 20)
- Re: Linux - Indicators of compromise Giles Coochey (Jul 25)
- Re: Linux - Indicators of compromise Григорий Братислава (Jul 25)
- Re: Linux - Indicators of compromise Scott Solmonson (Jul 26)
- Re: Linux - Indicators of compromise Григорий Братислава (Jul 26)
- Re: Linux - Indicators of compromise valdis . kletnieks (Jul 26)
- Re: Linux - Indicators of compromise Григорий Братислава (Jul 26)
- Re: Linux - Indicators of compromise Scott Solmonson (Jul 28)
- Re: Linux - Indicators of compromise Григорий Братислава (Jul 30)
- Re: Linux - Indicators of compromise jerry (Jul 28)
- Re: Linux - Indicators of compromise coderman (Jul 16)
- Re: Linux - Indicators of compromise Григорий Братислава (Jul 19)
- Re: Linux - Indicators of compromise Scott Solmonson (Jul 23)
- Re: Linux - Indicators of compromise Benji (Jul 16)