Hot answers tagged

15

You can use an nmap script for locating a server that will send DHCPOFFER (so long as it's in your broadcast domain): nmap --script broadcast-dhcp-discover This will give DNS domain name, your IP, who offered it, lease info..all of the fun stuff. You can also include a list of hosts that have anything to do with port 67: nmap --script broadcast-dhcp-...


11

Some ISPs force a connection reset every 24h and you get a new IP address assigned, others don't force you and yet others give you a fixed ip address. There are laws requiring the ISPs to log the User - IP association (which in turn is associated with your contract)... but e.g. in the EU there is the data retention directive that requires ISPs to even log ...


9

In a PXE environment, as a pentester, I have 2 major classes of attack I can choose from. 1: I can capture a full machine image. Do your systems automatically connect to the domain controller after setting up the machine? If so, this image probably has domain controller credentials on it, that I can capture and use elsewhere. 2: I can manipulate images on ...


8

In order to reproduce this vulnerability on *nix systems follow these steps: Install dnsmasq. On Ubuntu machine it can be done by running following command: sudo apt-get install dnsmasq Add following lines to /etc/dnsmasq.conf configuration file: interface="iface_server" dhcp-range="ip_start","ip_end",12h dhcp-option-force=100,() { :; }; echo 'You are ...


8

Yes. The dhclient-script network-configuration shell script is run during the DHCP process, and a number of parameters from the server (such as domain-name) are passed to it in environment variables. The script is set to be interpreted by /bin/sh, so if your system has that symlinked to /bin/bash (which is quite common), you're vulnerable. What's more, on ...


8

The top security concern is that the only protection of traditional PXE booting is physical security. There is no encryption or authentication anywhere in the process from power-on to OS start. The basic PXE process: Computer makes a DHCP request DHCP server responds with address and PXE parameters Computer downloads boot image using TFTP over UDP The ...


8

MACs are predictable in many existing environments. For example, on a typical enterprise network, you're likely to find many physical machine that are part of the same shipment from the same manufacturer and therefore have similar MACs (same OUI and consecutive low-order portion). Any system whose security depended on unpredictable MACs would fail in a ...


8

The answer to this will largely depend on how good the management software on your network is. Assuming that it's reasonable, I'd say that this wold be done by looking at the MAC address of the packets from the rogue server and then reviewing the management interface for your switches to see which port that MAC address is connected to. Then trace from the ...


8

Since the hacker now controls any communication between the victim and the outside world, he could now reuse the real certificate issued by GeoTrust Global CA for mail.google.com domain when I access the HTTP server at 192.168.1.50. No he can't. To identify yourself with a certificate (which needs to be done to fake the server) you need to have access to ...


7

Yes. ISPs do store all DHCP ip assignment logs. They know exactly who had what IP address and when. For them it is a legal obligation to harvest this information to facilitate any legal queries and investigations. In the US, they have to follow The Federal Communications Commission (FCC) regulations. In the US, ISPs keep track of these items (as available)...


6

As the owner and operator of an ISP, I can say that most of us (90%) keep connection logs. We need these internally for troubleshooting purposes. From these logs I can tell you exactly which user account was assigned what IP address and how long they had that address for (start stop times). I further have MAC address information on the device that made ...


6

Let's not mix things. Modern cell phones can use at least three different "wireless" protocols: The main "phone" protocol, in all its incarnations (CDMA, GSM, GPRS, UMTS...), from which comes the expression "cell phone". The phone "number", SMS and voice channels use that. That's the protool for which you pay your provider. WiFi, aka "802.11". Shorter range ...


6

MAC addresses are already quite predictable since they are only 48-bit values which are attributed by ranges to hardware vendors (see for instance this file). It is possible to change the MAC address used by a network interface, but most people do not. Also, a given device will broadcast its MAC address quite freely (it is included in the header of each ...


5

Steffen is right in saying that the hacker cannot fake the remote server certificate over HTTPS and therefore cannot intercept the encrypted data exchange without the user getting invalid certificate alert warnings. However: This does not prevent SSL Stripping attacks. This does not prevent sessions fixation attacks over HTTP (the difficult bit is ...


5

I just happen to be writing a series of articles covering such network attacks from a practical point-of-view. Here is the article on DHCP, ARP will follow. DHCP and ARP are indeed two different attacks allowing the attacker to achieve a MITM within a subnet. DHCP Spoofing is done by a rogue DHCP server on the network which replies to DHCP requests ...


4

If you only allow ONE MAC through a port I can't see how DHCPstarv is going to work (unless it is some kind of distributed DHCPStarv attack). DHCPStarv works by sending a lot of DHCP petitions so that the server doesn't have new IPs to provide to new clients. But if you can only ask for one a time it is not likely the attack is going to succeed. After @...


4

DHCP servers will allocate the IP given in the offer temporarily to negate race conditions. Assume two clients ask for an IP in the same time period, the server must give each client a different address, if it doesn't put aside the first client's IP it might give the second client the same IP causing a collision. So when offering the server locks the address ...


3

DHCP supersedes BOOTP; you keep BOOTP around only to help old hardware and software which does not know DHCP. Anyway, both are about offering a service to whoever asks (namely, IP address allocation and publication of network configuration) so they are no more, and no less, a security issue than what their definition entails: by running a DHCP or BOOTP ...


3

There are some specific vulnerabilities associated with PXE boot images. Unauthenticated Images. If someone gets onto your network, it's trivial to boot a PXE image from VirtualBox or VMWare. Which means that you now have a rogue host on your network, loaded with all your proprietary software. Local Administrator exploits. (Windows only) Since this someone ...


3

Both dhclient and dhcpcd call configuration scripts that invoke a system shell, so they are vulnerable. However, based on my testing it looks like you can run at least dhcpcd successfully without the config script (if you rename/move the script): $ pkill dhcpcd $ ping -c 1 www.google.com ping: unknown host www.google.com $ mv /usr/lib/dhcpcd/dhcpcd-run-...


3

Personally I don't think so. The only potential security issue relating to knowledge of MAC addresses I can remember seeing is the privacy concern around disclosure of wireless AP MAC addresses over the Internet, as with all the geo-location databases there are that can amount to a physical location.


3

DHCP on its own isn't capable of this. YaRi's answer doesn't do anything to separate the networks - if you plug a non domain system in to a domain assigned VLAN port you would be on the wrong network. You could maintain a list of MAC addresses for your domain systems and base your ranges on this (if you aren't in the list, you aren't included in the domain ...


3

DHCP alone can't do this. However, this can be easily accomplished using NAC (with DHCP pools). NAC (Network Access Control) establishes a network "vestibule" where higher level processes can be applied to move the device into another zone, apply patches, or AV updates, or any number of things. You can spend as much on NAC as you want, but a decent NAC ...


3

After some comments, you are on the road... now you must locate exactly your problem. To launch sslstrip I can recommend you this nomenclature: sslstrip -f -p -k -l 10000 -l to listen on port. so 10000 is default, you can avoid this or change port. -k this kills possible previous sslstrip sessions in progress, recommended. -f this change the favicon to a ...


3

You can leverage arpwatch to notify you the second it broadcasts on your network again and also use a tool like Wireshark to capture traffic and see what the device is communicating to (logging DNS queries sometimes works too). Sometimes IoT devices like thermostats, toys, equipment or even certain operating systems will call home on a regular basis looking ...


3

Because ARP has no authentication or verification on it, you can set up a rogue DHCP server, send out bogus ARP packets telling servers that you are the DHCP server, then hand out DHCP reservations that suit your needs. With DHCP and ARP poisoning you can do things such as allowing your computer to connect via SSH to a host, despite the host having a ...


3

No it is not pointless. The easiest example: You want nobody to know what's your nickname, in which channels you are and what you're writing in queries (private messages). To address the concrete question Should I be concerned that any router between my IRC client at home and my server hosted in a different country could steal my authenticated, yet ...


2

No, what you are asking is fundamentally not possible. The primary function of the MAC address sublayer is allow for the communication of numerous devices(OSI Layer 2) via a physical medium (OSI Layer 1). Nothing is preventing an attacker from assigning their NIC an arbitrary MAC address value. One side effect is that your DHCP server will then issue ...


2

You need to specify the legal jurisdiction, when asking a question about the law. In the US, I do not know of any legal requirement to record and retain this information (there have been some proposals but I do not believe any were enacted into law), but I believe most ISPs do anyway. In the EU, I believe there is a requirement to retain and record this ...


2

Many captive portals are a self contained httpd/dhcpd/router/whatever else (some routers have bittorrent clients but that is beside the point). I don't think that this Wikipedia page disagrees with that. The attack being discussed in the last part of this excerpt is referring to DNS tunneling. If its a very large network, such as a WISP, then they are ...


Only top voted, non community-wiki answers of a minimum length are eligible