[66667] in North American Network Operators' Group
Re: sniffer/promisc detector
daemon@ATHENA.MIT.EDU (Brett Watson)
Tue Jan 20 01:27:05 2004
Date: Mon, 19 Jan 2004 23:26:30 -0700
From: Brett Watson <brett@the-watsons.org>
To: Alexei Roudnev <alex@relcom.net>, <nanog@merit.edu>,
Paul Vixie <vixie@vix.com>
In-Reply-To: <04cf01c3df18$68deb1e0$6401a8c0@alexh>
Errors-To: owner-nanog-outgoing@merit.edu
>> i wish you were right. i wish you were even close to right. but we've
> been
>> attacked many times over the years by some extremely smart adolescent
>> psychopaths -- where adolescence is a state of mind in this case, rather
>> than of years -- and i wish very much that they would either stop being
>> so smart, or stop being so psychotic, or stop being so adolescent.
>
> Hmm.
>
> It depends of, what is _attack_. For example, if I have old, unpatched sshd
> daemon (which is easy to hack), but
> run it at port 30022, how long do I need to expose it on Internet to be
> hacked? (Answer - you will never be hacked, if
> you use nonstandard port, except if you attracks someone by name, such as
> _SSH-DAEMOn.Rich-Bank-Of-America.Com_.
Uhm, that would be wrong. This is simply "security through obscurity".
Go grab nessus (www.nessus.org), modify the code a bit, and I guarantee you
that your ssh daemon running on a non-standard port can still be found,
identified, and exploited. Trivial.
-b
