Autor: Rafal Maszkowski (rzm_at_dain.oso.chalmers.se)
Data: Thu 26 Jan 1995 - 14:15:19 MET
Szymon Sokol (szymon_at_uci.agh.edu.pl) wrote:
> Tomasz Kokowski (kokowski_at_CS.PUT.Poznan.PL) wrote:
> : Przesylam kopie magazynu FlashBack (Sun) traktujacego o ostatniej serii
> : wlaman. *To nie bylo po source routing*.
> No, teraz sie troche wyjasnia - rzeczywiscie, sprawa jest nieco powazniejsza
> niz pierwotnie myslalem:
> : > To gain access, intruders create packets with spoofed source IP
> : > addresses. This exploits applications that use authentication based on
> : > IP addresses and leads to unauthorized user and possibly root access on
> : > the targeted system. It is possible to route packets through
> : > filtering-router firewalls if they are not configured to filter
> : > incoming packets whose source address is in the local domain. It is
> : > important to note that the described attack is possible even if no
> : > reply packets can reach the attacker.
> Innymi slowy: nie pomoze 'no ip source route' na routerze, i nie pomoze
> ZADEN TCP wrapper. Nie ma bowiem sposobu, zeby TCP wrapper na docelowej
> maszynie odroznil pakiet falszywy od prawdziwego. To musi robic router.
> Przyznaje sie bez bicia, ze jeszcze nie wiem, jak zmusic Cisco, zeby to robilo.
Czyli source-routing tych pakietow nie jest potrzebny?
> : > If you monitor packets using network-monitoring software such as
> : > netlog, look for a packet on your external interface that has both its
> : > source and destination IP addresses in your local domain. If you find
> : > one, you are currently under attack. Netlog is available by anonymous
> Swietny pomysl, tylko na ogol do swojego ZEWNETRZNEGO interfejsu (lacza
> do NASK) uzytkownik (abonent NASK) nie ma dostepu. Stawiac 2 routery jeden
> za drugim? Absurd.
A to?
From: jgp_at_socrates.ceas.rochester.edu (Jim Prescott)
Newsgroups: alt.security,comp.security.misc,comp.security.unix
Subject: Re: CERT advisory -- details
[...]
tcpdump -l ether src A:A:A:A:A:A and ! src host B.B.B.B and
src net C.C.C
where A is the ethernet address of your router port, B is the IP address
of your router and C is the network that your router routers to you.
[...]
R.
-- Rafal Maszkowski rzm_at_oso.chalmers.se http://www.mat.uni.torun.pl/~rzm Opinia publiczna powinna byc zaalarmowana swoim nieistnieniem - St. J. Lec
To archiwum zostało wygenerowane przez hypermail 2.1.7 : Wed 19 May 2004 - 15:49:49 MET DST