Links for FAQ

2003-08-04 Thread Justin Pryzby
The following links were distributed at Defcon 11, and I'm familiar with most of them. I think these should be included in the FAQ. The links were distributed in association with InfoSec News of attrition.org, which which I have no affiliation. http://www.c4i.org/ http://www.nmrc.org/

Re: Windows XP computer spewing packets

2003-08-01 Thread Justin Pryzby
I would suspect a compromzied host; recommend a portscan. Justin On Fri, Aug 01, 2003 at 11:55:19PM +, chris wrote: ---

Re: IP address allocation

2003-07-31 Thread Justin Pryzby
Not sure if this is understood or not. If someone wanted to hijack that ipi address, they would have to control a computer on the same network as that ip address. Otherwise packets they wanted to receive (to the hijacked address) would go to the wrong network. With TCP, that means they cannot

Re: 2NIC's on same network, possible?

2003-07-29 Thread Justin Pryzby
That should definitely be possible, though I don't know how it will decide which NIC to use for what. What do you mean 192.168.0.6/24? A NIC has an address, and that notation represents 2**8 - 1 addresses. Justin On Tue, Jul 29, 2003 at 03:04:04AM +, Vineet Mehta wrote: Hi all, My

Re: 2NIC's on same network, possible?

2003-07-29 Thread Justin Pryzby
a netmask appropriate for a /e network. Justin On Tue, Jul 29, 2003 at 08:25:03PM +, chris halverson wrote: I am not sure what you are asking when you refer to the 2**8 - 1 addresses. Can you clarify? From: Justin Pryzby [EMAIL PROTECTED] To: Vineet Mehta [EMAIL PROTECTED],[EMAIL

Re: problem on personal pc not server

2003-07-25 Thread Justin Pryzby
Make sure you don't have voice-recognition turned on. I had one client who though she was the victim of a virus/hack; needless to say, we were puzzled. Fortunately, voice recognition occured to *one* technician... Justin On Thu, Jul 24, 2003 at 07:10:02PM +, Enquiries wrote: Dear

Re: ARP Spoof Question

2003-07-24 Thread Justin Pryzby
It shouldn't. The TCP sequence number *should* be cryptographically strong. (As opposed to the IP ID number which is usually incremental). It is strong in the sense that, even if I make 100 connections to a host, and watch which sequence numbers it uses (and even of those are 100 consecutive

Re: Sendmail banner Network start output suppression

2003-07-16 Thread Justin Pryzby
SIOCADDRT: File exists is a message from the kernel. Justin On Wed, Jul 16, 2003 at 06:17:08PM +, Pessoft wrote: 1) Exist any way how to disable, or change sendmail banner to not show sendmail's version. 2) When i'm starting network using service network start for example, it writes

Re: Continued probing with source IP 10.x.x.x

2003-07-08 Thread Justin Pryzby
First off you should make sure its not internally-generated traffic. Then you should make sure your router and your ISP's router are not passing those packets. RFC X (requirements for ip routers or something) requires that, I think. Justin On Mon, Jul 07, 2003 at 11:33:02PM +, Damon

Re: Port scanning question

2003-07-03 Thread Justin Pryzby
Linux has scanlogd and scandetd, both of which are short and simple. Probably Sun has their own, too. I don't know if anyone supports this, but this could also be implemented on a router/switch, which would save you time managing different OS. Justin On Wed, Jul 02, 2003 at 08:26:02PM +,

Re: Firewall on server itself

2003-06-26 Thread Justin Pryzby
Sure, you could set up the hardware firewall to do general pupose filtering (don't pass mallicious icmp, block the virus-of-the-day port, etc) and then set the individual hosts' firewalls to do things like allow only establisted connections and connections to tcp:80, plus connections to tcp:22

Re: AW: security-basics Digest 18 Jun 2003 22:09:15 -0000 Issue 618

2003-06-26 Thread Justin Pryzby
In the heirarch of network devices, a repeater is the stupidest. A hub is a multiport repeater. What goes in one port goes out off of the others. A *switch* otoh, actually looks at its input. At, methinks, OSI-2, there is a hardware address. A switch looks at that address. It keeps a list of

Re: security-basics Digest 18 Jun 2003 22:09:15 -0000 Issue 618

2003-06-25 Thread Justin Pryzby
If you are connecting to the firewall host through an unknown/insecure network, then the owners of that network will be able to see your password. If you are connecting to the firewall host through a local network, and are connected through a hub (rather than a switch), than local users (with

Re: Firewall configuration statistics

2003-06-20 Thread Justin Pryzby
am not looking for a philosophical answer. I was looking statistics for marketing. Does anyone know of a good reference site for firewall and other security statistics. SKP -Original Message- From: Justin Pryzby [mailto:[EMAIL PROTECTED] Sent: Friday, June 06, 2003 6:18 PM

Re: Monitoring Tools

2003-06-06 Thread Justin Pryzby
From what I've heard a video camera is your best bet. Not a webcam, just a VHS from walmart. Put it on super long play. Maybe you could look into windows 3.0 recorder feature. Justin On Sat, Jun 07, 2003 at 12:41:17AM +, Chris Burton wrote: I am looking for a tool that I can load on a

Re: Firewall configuration statistics

2003-06-06 Thread Justin Pryzby
Security, 100% of firewalls are misconfigured. I guarantee that no firewall administrator has considered all of the posibilities that are out there. Moreover, there are guaranteed bugs in the firewalling software itself. No firewalls are misconfigured. Computers do what they are told, and the