RE: DHCP, ARP, oh my Anyone know of an exploit that dupes ARP on wind ows 95?

[Joseph Spears <Joseph.Spears () epit com>]

never seen it on a windows box before, but it would be trivial to do so on
may unix hosts that allow MACs to be altered with ifconfig....

For instance, in redhat, it would be a simple case of writing a perl or
shell script that did (assuming DHCP is already configured for the machine
in the first place)
$mac = "00:00:00:00:00:00";
$remainingAddys = true;

while ($remainingAddys) {
  system ("ifconfig eth0 hw $mac");
  system ("ifdown eth0");
  system ("ifup eth0");
  $remainingAddys = createNewMac($mac);
}

You would have to write the routing that makes $mac get updated and return
whether there are any more mac addresses....

I don't know how you could prevent this though!!! I am sure that using
etherpeek, you could find the machine rather quickly. (at least after if
stomped you a couple of times). If the person is malicious, you would prove
it is them. If the box is compromised, you would reinstall and smack the
admin.



-----Original Message-----
From: Reeves, Michael (GEAE, Compaq) [mailto:michael.reeves () ae ge com]
Sent: Thursday, August 09, 2001 6:29 AM
To: 'incidents () securityfocus com'
Subject: DHCP, ARP, oh my Anyone know of an exploit that dupes ARP on
wind ows 95?


Yesterday we had a machine that caused a nasty ARP storm and started
snagging DHCP addresses as fast as it could (stealing addresses). It was
ARPing as if it were every machine on the network. It was a windows 95 box
and was immediately pulled off of the network. Once the machine was rebooted
it stopped. Doing a quick onceover on the machine and looking through the
registry I didn't see anything that seemed suspect. I have seen bad NICs
cause broadcast storms but this is a first for me. If anyone knows of any
exploits or seen anything like this as a hardware failure could ya let me
know.

Thanks,

Mike Reeves
Security Administrator

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com