On 7/27/06, Carlos de Oliveira <carlos.oliv@gmail.com> wrote:
Hello friends,
As a manager of my network, I am woried of security. Recently we
changed the HUB's for switch's in hope that we get more securitty.
In a few days ago, we have seeing another Access concentrator in our
network sending PADO's to the clients that wanted to connect.
This access concentrator have the same MAC address of one of my clients.
I would like to know what do you think that could be?
I've searched google for this, but I didn't found any attack baseed on
PPPoE + switch.
Could this other access concentrator be trying to give connection to
some of my clients just to sniff their connection?
It doesn't matter whether you use a switch or not. The PPPoE client
will broadcast PADI packets, so they will arive at all hosts on the
subnet. Whether you use a switch or not.
If this is not simply some mistake of having a wrong setup, this looks
like an attack. First of all, do you use some kind of MAC-address
based filtering? That would explain why someone would forge the MAC
address. Much more likely though it is not forged, I think the client
you are talking about /IS/ the attacker!
I think the attacker wants to steal other people's login stuff... I'm
not familiar with Radius, but the PADO packets can include information
on where the client should authenticate with. So I suppose this could
be used to steal the logins of other clients in some way.
That's my guess,
Good luck.
--
Regards,
Rob klein Gunnewiek
---------------------------------------------------------------------------
This list is sponsored by: Norwich University
EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The NSA has designated Norwich University a center of Academic Excellence
in Information Security. Our program offers unparalleled Infosec management
education and the case study affords you unmatched consulting experience.
Using interactive e-Learning technology, you can earn this esteemed degree,
without disrupting your career or home life.
http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------
