flat assembler
Message board for the users of flat assembler.

Index > Heap > Fun and Harmless "Hacking"

Goto page Previous  1, 2, 3, 4  Next
Author
Thread Post new topic Reply to topic
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 17249
Location: In your JS exploiting you and your system
revolution
Just set a proper password on router B and the AP hacker can't see any logs.

Also, can you really tell a router something doesn't exist? How would you do that? The router sees all traffic on the ports it connects with. It will always see C's broadcasts, I don't think you can hide them.
Post 09 Apr 2010, 14:15
View user's profile Send private message Visit poster's website Reply with quote
kohlrak



Joined: 21 Jul 2006
Posts: 1421
Location: Uncle Sam's Pad
kohlrak
revolution wrote:
Just set a proper password on router B and the AP hacker can't see any logs.


Erm, you totally missed the point. The modem itself is downstream of the router, and thus i can see anything downstream.

Quote:
Also, can you really tell a router something doesn't exist? How would you do that? The router sees all traffic on the ports it connects with. It will always see C's broadcasts, I don't think you can hide them.


Lie to B what C's mac is, and it's as good as non-existent. As far as B is concerned, C only connects to A long enough to broadcast.
Post 09 Apr 2010, 14:17
View user's profile Send private message Visit poster's website AIM Address Yahoo Messenger MSN Messenger Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 17249
Location: In your JS exploiting you and your system
revolution
No you are not really seeing things downstream. What you see is only what your gateway chooses shows you. And anyhow, that is just part of how the Internet works, you can never overcome that "flaw". And it doesn't help any hackers anyway.

I did forget to mention one thing, your routers should be set for NAT mode.

And, BTW, I see no point in trying to use MACs as some sort of security blanket. They are not a secure feature in any way. They are forgeable and thus useless for security.
Post 09 Apr 2010, 14:22
View user's profile Send private message Visit poster's website Reply with quote
kohlrak



Joined: 21 Jul 2006
Posts: 1421
Location: Uncle Sam's Pad
kohlrak
Quote:
No you are not really seeing things downstream. What you see is what your gateway shows you. And anyhow, that is just part of how the Internet works, you can never overcome that "flaw". And it doesn't help any hackers anyway.


Obviously the gateway shows people what the gateway wants to show people. However, it typically shows people everything they ask for downstream, hence why i can see my modem which is downstream (Yes, the modem's IP would be the same even if i was connecting directly to the modem).

Quote:
And, BTW, I see no point in trying to use MACs as some sort of security blanket. They are not a secure feature in any way. They are forgeable and thus useless for security.


No, not using MACs to prevent people from connecting to the router, using MACs to point to a fake MAC. Then the computer will attempt to connect to the fake mac (ARP, remember?) and fail to do so, since it's the wrong mac.
Post 09 Apr 2010, 14:32
View user's profile Send private message Visit poster's website AIM Address Yahoo Messenger MSN Messenger Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 17249
Location: In your JS exploiting you and your system
revolution
kohlrak wrote:
Obviously the gateway shows people what the gateway wants to show people. However, it typically shows people everything they ask for downstream, hence why i can see my modem which is downstream (Yes, the modem's IP would be the same even if i was connecting directly to the modem).
But the IPs are easily findable with traceroutes and other standard tools. There is no value in the data you see from your gateway.
kohlrak wrote:
No, not using MACs to prevent people from connecting to the router, using MACs to point to a fake MAC. Then the computer will attempt to connect to the fake mac (ARP, remember?) and fail to do so, since it's the wrong mac.
I think you don't realise what ARP is for. If a hacker cannot connect the neither can you, or anyone else that is supposed to.
Post 09 Apr 2010, 14:38
View user's profile Send private message Visit poster's website Reply with quote
kohlrak



Joined: 21 Jul 2006
Posts: 1421
Location: Uncle Sam's Pad
kohlrak
revolution wrote:
kohlrak wrote:
Obviously the gateway shows people what the gateway wants to show people. However, it typically shows people everything they ask for downstream, hence why i can see my modem which is downstream (Yes, the modem's IP would be the same even if i was connecting directly to the modem).
But the IPs are easily findable with traceroutes and other standard tools. There is no value in the data you see from your gateway.


Um, what? I've successfully connected to a downstream computer (using the IP it assigned itself), what isn't right? I fail to see the problem.

Quote:
kohlrak wrote:
No, not using MACs to prevent people from connecting to the router, using MACs to point to a fake MAC. Then the computer will attempt to connect to the fake mac (ARP, remember?) and fail to do so, since it's the wrong mac.
I think you don't realise what ARP is for. If a hacker cannot connect the neither can you, or anyone else that is supposed to.


The real MAC is remembered by router A, which is all that's necessary for router C to do it's duty, since all legitimate connections will come from router A. Ruining router B's point of view of C will not actually affect C.
Post 09 Apr 2010, 14:48
View user's profile Send private message Visit poster's website AIM Address Yahoo Messenger MSN Messenger Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 17249
Location: In your JS exploiting you and your system
revolution
kohlrak wrote:
Um, what? I've successfully connected to a downstream computer (using the IP it assigned itself), what isn't right? I fail to see the problem.
There is no problem, this is perfectly normal, and is what makes the Internet work.
kohlrak wrote:
The real MAC is remembered by router A, which is all that's necessary for router C to do it's duty, since all legitimate connections will come from router A. Ruining router B's point of view of C will not actually affect C.
Some routers now have ARP protection included for this. But this is only a problem when you don't trust all clients on your LAN. If you use the three router config, you don't need to care about the AP foreigners, they can all fight over who wants to be ARP master as much as they like, it won't affect your LAN one bit.
Post 09 Apr 2010, 14:58
View user's profile Send private message Visit poster's website Reply with quote
kohlrak



Joined: 21 Jul 2006
Posts: 1421
Location: Uncle Sam's Pad
kohlrak
revolution wrote:
kohlrak wrote:
Um, what? I've successfully connected to a downstream computer (using the IP it assigned itself), what isn't right? I fail to see the problem.
There is no problem, this is perfectly normal, and is what makes the Internet work.


Then what are you getting at?

Quote:
kohlrak wrote:
The real MAC is remembered by router A, which is all that's necessary for router C to do it's duty, since all legitimate connections will come from router A. Ruining router B's point of view of C will not actually affect C.
Some routers now have ARP protection included for this. But this is only a problem when you don't trust all clients on your LAN. If you use the three router config, you don't need to care about the AP foreigners, they can all fight over who wants to be ARP master as much as they like, it won't affect your LAN one bit.


Wouldn't it be better to employ 2 routers with ARP protection in the first place?
Post 09 Apr 2010, 16:28
View user's profile Send private message Visit poster's website AIM Address Yahoo Messenger MSN Messenger Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 17249
Location: In your JS exploiting you and your system
revolution
kohlrak wrote:
Then what are you getting at?
Nothing really, I was just saying that you can't see past your LAN and you mentioned that you can "see" all your ISPs routers.
kohlrak wrote:
Wouldn't it be better to employ 2 routers with ARP protection in the first place?
ARP protection is just a kludge, not a proper solution. Use three routers and you don't even have to care about ARP protection. You won't have to care about whether your router has a good ARP protection algo or worry about if it has a bad implementation. I hope you are not accepting the "expert" router's manufacturers word that their router's ARP protection is perfect?
Post 09 Apr 2010, 16:53
View user's profile Send private message Visit poster's website Reply with quote
kohlrak



Joined: 21 Jul 2006
Posts: 1421
Location: Uncle Sam's Pad
kohlrak
Quote:
Nothing really, I was just saying that you can't see past your LAN and you mentioned that you can "see" all your ISPs routers.


But i can, through the gateway. Just as through the gateway/router i see everything else on this level of the network.

Quote:
ARP protection is just a kludge, not a proper solution. Use three routers and you don't even have to care about ARP protection. You won't have to care about whether your router has a good ARP protection algo or worry about if it has a bad implementation. I hope you are not accepting the "expert" router's manufacturers word that their router's ARP protection is perfect?


It either has projection or it doesn't (it discards them or it doesn't, as they're quite easy to identify). I personally consider an extra router as kludge. Though there's something to be said about bad design.
Post 09 Apr 2010, 17:12
View user's profile Send private message Visit poster's website AIM Address Yahoo Messenger MSN Messenger Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 17249
Location: In your JS exploiting you and your system
revolution
kohlrak wrote:
But i can, through the gateway. Just as through the gateway/router i see everything else on this level of the network
Well of course you can connect to it. It is called the Internet. That is its purpose after all. Razz But you are not really seeing it all. You are only getting the filtered traffic relevant to your IP, you can't see all the internal traffic of your ISP, that would be madness.
Post 09 Apr 2010, 17:16
View user's profile Send private message Visit poster's website Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 17249
Location: In your JS exploiting you and your system
revolution
kohlrak wrote:
It either has projection or it doesn't (it discards them or it doesn't, as they're quite easy to identify). I personally consider an extra router as kludge. Though there's something to be said about bad design.
Protection comes in degrees, it is not a binary yes or no. And the three routers thing is not a kludge, it is proper network design. Any ISP that tries to cut corners and do a similar type of thing with only two routers would soon find themselves in deep shit with all sorts of problems. Like I mentioned, I am not an expert by any means, but even I know that a two router setup with protocol mangling kludges is a path to insecure design methodology.
Post 09 Apr 2010, 17:24
View user's profile Send private message Visit poster's website Reply with quote
kohlrak



Joined: 21 Jul 2006
Posts: 1421
Location: Uncle Sam's Pad
kohlrak
revolution wrote:
kohlrak wrote:
But i can, through the gateway. Just as through the gateway/router i see everything else on this level of the network
Well of course you can connect to it. It is called the Internet. That is its purpose after all. Razz But you are not really seeing it all. You are only getting the filtered traffic relevant to your IP, you can't see all the internal traffic of your ISP, that would be madness.


I see all the routers subordinate to me. Fortunately, that isn't many, actually. After it hits a modem, the devices and routers don't have to have an IP, then it can easily come out at the ISP's gateway and go from there (which would be the internet which i'm quite capable of seeing all around).
Post 09 Apr 2010, 17:25
View user's profile Send private message Visit poster's website AIM Address Yahoo Messenger MSN Messenger Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 17249
Location: In your JS exploiting you and your system
revolution
kohlrak wrote:
I see all the routers subordinate to me.
So can you do ARP poisoning and grab all of your ISPs traffic? Confused
Post 09 Apr 2010, 17:30
View user's profile Send private message Visit poster's website Reply with quote
kohlrak



Joined: 21 Jul 2006
Posts: 1421
Location: Uncle Sam's Pad
kohlrak
revolution wrote:
kohlrak wrote:
I see all the routers subordinate to me.
So can you do ARP poisoning and grab all of your ISPs traffic? Confused


I haven't exactly tried, but i would expect comcast to be smart enough to get rid of ARP broadcasts if they are smart enough to monitor what we do to throttle our internet accordingly. I used to have problems with them explicitly blocking ports (before comcast took over). Plus, if you're right that the router doesn't forward ARPs, then the modem surely wouldn't, either. Plus, the way that the ISP acts sometimes (static IPs for the most part with weird refresh rates), i wouldn't be surprised if they use static ARP caches.
Post 09 Apr 2010, 17:37
View user's profile Send private message Visit poster's website AIM Address Yahoo Messenger MSN Messenger Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 17249
Location: In your JS exploiting you and your system
revolution
kohlrak wrote:
i wouldn't be surprised if they use static ARP caches.
But ARP doesn't work that way. I think you can't make it static without causing problems. What if you replace your modem with another (maybe it went faulty or something)? Now the MAC is different and you're effectively dead on the network until it updates everyone with a new ARP broadcast with the new MAC. If you are correct, and your ISP (somehow) is ignoring the ARP, then you could never get to talk to anything because the MAC values are all wrong, still pointing to the previous device.
Post 09 Apr 2010, 17:47
View user's profile Send private message Visit poster's website Reply with quote
kohlrak



Joined: 21 Jul 2006
Posts: 1421
Location: Uncle Sam's Pad
kohlrak
revolution wrote:
kohlrak wrote:
i wouldn't be surprised if they use static ARP caches.
But ARP doesn't work that way. I think you can't make it static without causing problems. What if you replace your modem with another (maybe it went faulty or something)? Now the MAC is different and you're effectively dead on the network until it updates everyone with a new ARP broadcast with the new MAC. If you are correct, and your ISP (somehow) is ignoring the ARP, then you could never get to talk to anything because the MAC values are all wrong, still pointing to the previous device.


I'm pretty sure you have to have your modem registered with the ISP (my modem isn't even mine, actually, but the ISP's). Any time they buy a new one, they register it. With their own custom equipment, they could effectively ignore standards along the way as well. So neither static tables nor ignoring would be difficult. I think static ARP tables is more likely. Assign a specific IP to a specific MAC. Heck, even my router's capable of that.
Post 09 Apr 2010, 17:57
View user's profile Send private message Visit poster's website AIM Address Yahoo Messenger MSN Messenger Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 17249
Location: In your JS exploiting you and your system
revolution
revolution wrote:
...the ... router's manufacturers word ...
Small offtopic, English Q: Is the possessive case used properly there? Especially the apostrophe(s), did I get it correct? Or is it best to reword the whole sentence and avoid the construct altogether?
Post 09 Apr 2010, 17:57
View user's profile Send private message Visit poster's website Reply with quote
kohlrak



Joined: 21 Jul 2006
Posts: 1421
Location: Uncle Sam's Pad
kohlrak
revolution wrote:
revolution wrote:
...the ... router's manufacturers word ...
Small offtopic, English Q: Is the possessive case used properly there? Especially the apostrophe(s), did I get it correct? Or is it best to reword the whole sentence and avoid the construct altogether?


You missed the apostrophe, but it was understood anyway. You can chain possession, though, which is unfortunate since it makes talk about distant relatives quite wordy. "She's my aunt's son's brother in law's mother."
Post 09 Apr 2010, 18:02
View user's profile Send private message Visit poster's website AIM Address Yahoo Messenger MSN Messenger Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 17249
Location: In your JS exploiting you and your system
revolution
kohlrak wrote:
I'm pretty sure you have to have your modem registered with the ISP (my modem isn't even mine, actually, but the ISP's). Any time they buy a new one, they register it. With their own custom equipment, they could effectively ignore standards along the way as well. So neither static tables nor ignoring would be difficult. I think static ARP tables is more likely. Assign a specific IP to a specific MAC. Heck, even my router's capable of that.
I think you should look for a new ISP. If what you say is correct then how can you know that some other hacker is not freely catching/altering your data? By not following standards that open themselves (and their customers) up for all sorts of shenanigans. Remember the MAC is easily forged. So if they have a static MAC system used as some sort of protection mechanism then someone can simply forge their MAC to be anyone they please.

I think it more likely that the port number is used to assign your IP address and that that MAC and ARP are used in the normal fashion, This is normal behaviour for ISPs.
Post 09 Apr 2010, 18:02
View user's profile Send private message Visit poster's website Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  
Goto page Previous  1, 2, 3, 4  Next

< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum


Copyright © 1999-2020, Tomasz Grysztar.

Powered by rwasa.