1

I'm requesting some help with a particular breach of access that we've experienced in our environment. the attacker is an internal employee who has made a few notes about the environment that I simply do not understand clearly.

here are a few things he has claimed that I would like a little clarification on if someone would be kind enough to help me out.

1) "The router is accessible through this address - 0 x bdb38"

2) "memory tag (for transferring data) subnet is accessible through this address 0x00007fff78c6f2a8"

both of these comments have me a little stumped as they are written in short hand and I am unable to interpret them clearly.

3
  • It's hard to tell what "address" the attacker is talking about without knowing what system the attacker breached and in what way. The more context you can provide about the nature of the breach the more useful any answers will be.
    – Philipp
    May 14, 2014 at 16:24
  • You may also just want to go back to the employee who made the notes and ask him what they mean.
    – Xander
    May 14, 2014 at 17:42
  • Based on your comment below, do you trust his business ethics - one way to get the contract renewed/extended and show ROI would be to report 'vulnerabilies' in technobable credible to managers yet meaningless to you.
    – mattnz
    May 15, 2014 at 2:07

1 Answer 1

1

The addresses seem to be hex-encoded numbers. The first is 20 bit and the second 64 bit (only the lower 48 bit are used). The first one is 777016 in decimal and the second 140735219692200.

They are unlikely to be network addresses. the first one is too large to be a port and too small to be an IP address. The second is too large to be an IPv4 address and too small for an IPv6 address.

But they could be 64bit memory addresses where the first one omits leading zeros. The attacker might have tried to exploit a vulnerability in the system(s) which required to know the exact location in the system memory of something he wanted to read or manipulate. He found these addresses somehow and wrote them down.

The second, however, is much too large for that. It would imply over 100 TB of memory.

4
  • Thanks Philipp, sadly this is all the info I have to go on at the moment, which is starting to lead me to believe the guy is just screwing with us. I cannot ask him as the situation is an odd one, he's contracted to discover vulnerabilities but he is not entitled to explain to us what they are (makes my job exceptionally difficult, but simulates a real threat situation. The information he provided truly doesn't add up to anything I can put my finger on so I decided to ask the community :)
    – ero10000
    May 14, 2014 at 18:05
  • 1
    A huge address doesn't imply a huge amount of physical memory. Just because you've got something at address whatever doesn't mean all whatever addresses lower than that correspond to real, available memory. May 14, 2014 at 19:16
  • If he doesn't need to document the vulnerability, how can your organisation know for sure he doesn't just make them up?
    – pfyon
    Jun 13, 2014 at 20:58
  • Moreover, even on most embedded solutions, memory address locations aren't (usually) going to stay the same (essentially to prevent behavior related to this) between application/machine start. So the information would be largely useless anyways. I agree with pfyon - you need to have him document his work, if for no other reason so as to enable you to close the gaps. Jun 14, 2014 at 7:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .