[Snort-users] Promiscuous interface hacks?

Slighter, Tim tslighter at ...5174...
Thu May 1 09:20:22 EDT 2003


Much of this is based on the assumption that any of these given daemons are
being run by root or superuser, which in many cases is true.  I have
hopefully mitigated many of these potential incidents by running with an
unprivileged user.

-----Original Message-----
From: Frank Knobbe [mailto:fknobbe at ...652...]
Sent: Thursday, May 01, 2003 9:38 AM
To: Paul Schmehl
Cc: snort-users at lists.sourceforge.net
Subject: Re: [Snort-users] Promiscuous interface hacks?


On Thu, 2003-05-01 at 09:47, Paul Schmehl wrote:
> Is anyone aware of any methods (or white papers describing methods) that 
> describe ways that can be used to hack a box through a NIC that is in 
> promiscuous mode?  I'm curious because I'm wondering how serious the
recent 
> vulnerabilities in snort really are to a box that's set up in promiscuous 
> mode.


Paul,

I would say that when you have an interface in promiscuous mode, most
(if not all) of the time you also have a second interface in normal
mode. So any buffer overflow in Snort, tcpdump, ethereal etc could lead
to execution of code. That code could establish a connection back to the
attacker (reverse shell). That does not have to occur on the same
interface. Instead, when you create a socket, the system will probably
route the packets through the interface with the IP address
automatically.

Even if the box only has one NIC, the code could just wipe out all data
on the hard disk. As long as there are applications using data from the
network (promiscuously or not), and these apps have vulnerabilities, you
are at risk. In other words, don't differentiate between promiscuous
mode and normal mode. :)

Regards,
Frank







More information about the Snort-users mailing list