From owner-freebsd-security  Mon Apr 19 14:13:59 1999
Delivered-To: freebsd-security@freebsd.org
Received: from biggusdiskus.flyingfox.com (parker-T1-2-gw.sf3d.best.net [209.157.165.30])
	by hub.freebsd.org (Postfix) with ESMTP id 1951E1545B
	for <security@FreeBSD.ORG>; Mon, 19 Apr 1999 14:13:52 -0700 (PDT)
	(envelope-from jas@flyingfox.com)
Received: (from jas@localhost)
	by biggusdiskus.flyingfox.com (8.8.8/8.8.5) id PAA04114;
	Mon, 19 Apr 1999 15:15:25 -0700 (PDT)
Date: Mon, 19 Apr 1999 15:15:25 -0700 (PDT)
From: Jim Shankland <jas@flyingfox.com>
Message-Id: <199904192215.PAA04114@biggusdiskus.flyingfox.com>
To: camposr@MATRIX.COM.BR, imp@harmony.village.org
Subject: Re: poink attack (was Re: ARP problem in Windows9X/NT)
Cc: liam@tiora.net, nicole@ispchannel.net, security@FreeBSD.ORG
In-Reply-To: <199904192059.OAA27640@harmony.village.org>
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org

Warner Losh <imp@harmony.village.org> writes:

> Define vulnerable.  ARP has no security in it whatsoever[*], so there
> is *NO* way to effectively defend against this attack w/o keeping a
> database ....

Bingo.  Note the close cousin of poink, the "ifconfig attack":

ifconfig fxp0 <address-I-want-to-poink>

And you don't even need libnet, or whatever it was called.

Jim Shankland
NLynx Systems, Inc.


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message