Omphalos: Difference between revisions
| Line 105: | Line 105: | ||
* Covert channel detection at all layers via [[Hackery#Zetetic|Zetetic]] | * Covert channel detection at all layers via [[Hackery#Zetetic|Zetetic]] | ||
* Opportunistic, secure remote control via [[Hackery#liburine|liburine]] | * Opportunistic, secure remote control via [[Hackery#liburine|liburine]] | ||
* Network analysis and debugging | ===Network Analysis=== | ||
* Network analysis and debugging ought be spun out into [[Hackery#drbenway|Dr. Benway]] | |||
{| class="wikitable" border="1" | |||
! Layer | |||
! What's tracked | |||
! Notes | |||
|- | |||
| Layer 2 | |||
| | |||
* From packets: | |||
** All source hardware addresses seen in packets | |||
** All destination hardware multicast addresses | |||
* From netlink: | |||
** All hardware addresses in the kernel neighbor cache | |||
** Our hardware addresses | |||
** Hardware broadcast addresses | |||
| | |||
* Node allocation is backed by a statically-sized [[WLRU]] | |||
** At the point an attacker can overwhelm our WLRU, there's effectively nothing on the network but junk packets. | |||
* If something's a source, it's being claimed as present here on the network. A destination means nothing, except in the case of multicast. | |||
* Someone else sending with our MAC address ought be noted, unless we stole their MAC address | |||
* We can't generally differentiate between two other physical hosts using the same MAC | |||
* We can't detect a spoofed MAC, but we can send our own ARP probes and at least determine whether the MAC's being serviced | |||
|- | |||
| Layer 3 | |||
| | |||
| | |||
|- | |||
|} | |||
==Attack Capabilities== | ==Attack Capabilities== | ||