/* Shitty globals */

This is nothing earth-shattering so I'll try to make it short and sweet.  And I'll add the pertinent links later.  If I feel like it.

A couple of weeks ago, the InfoSec Institute announced a privilege escalation problem with wicd in Backtrack 5 R2, which caused the BT people to go into Butthurt Mode and emit a Class 3 Shit Storm.

"Tut, tut," they proclaimed, "you can't escalate privileges on a system designed to be run as root and besides it's not our fucking code."

The InfoSec people said "Ooopsie!", the wicd wonks fixed it, and everyone went on with their lives.

Meanwhile, Hinky stumbles onto a really insecure network while he's hacking around on BT5 R2.  Digging into the available BT tools, he finds netdiscover-0.3beta7, which is basically an arp-spoofing tool in the Information Gathering→Network Analysis→Identify Live Hosts "hive".

It worked great, except the built-in OID list was ancient and didn't identify over 90% of the hosts I found.  So I search around for the code and found this, in which the author states:

I’ve written a patch for NetDiscover 0.3-beta7 (the last release) that eliminates libnet dependency. 

Apparently he had some religious objection to linking the software with both libnet (old) and libpcap (well maintained), so he fixed it.  He then gives a link to the package at backtrack.it, the Italian headquarters of Backtrack.  So I figure hot damn this must be the place!  He then gives a link to the package, and the link doesn't fucking work.

Just my luck.

But this is the Internet, so it has to be somewhere.  I find "an equivalent package" here, also with the same notes about eliminating the dependencies on libnet.

Great.  Well that settles that.  And there's an OUI update script!  Great stuff.  I update the OUIs and compile the program and then...

I am disappoint.  : (

It works, but it doesn't find the hosts that the stock BT5/R2 version finds.  WTF is going on here?

So I run both programs through Wireshark to see the differences.  And the difference is: the BT5 version sends the correct MAC address of my NIC and the "equivalent package"—same version number and beta level, mind you—sets my MAC to...

ca:fe:ca:fe:ca:fe

How about that?  So I look into the code and sure enough, in the source file ifaces.c, under a comment titled...

/* Shitty globals */

... is an array of unsigned chars representing just that value.  As an experiment, I change the array to my MAC address, recompile, and run it.

It works fine.  It finds the same hosts that the standard, off the shelf, BT5 code—same version number and beta level—finds.  And now it identifies the OIDs properly.

So... what is the difference in the code, besides the OID issue?  Intrigued, I ran both executables through "strings" and discovered that the BT5 version is linked to libnet.  Try it yourself:

#~strings /usr/local/sbin/netdiscover | grep libnet

No denying this is not the same code.  The fine folks at Backtrack took "netdiscover-0.3beta7" and put the libnet stuff back in.

Like I said, this is not earth-shattering, but I have to take Backtrack's "not our code" position with a grain of salt from now on.  I ended up hacking "netdiscover-0.3beta7" to put the real MAC into the "CAFE" array, but I wouldn't have had to do that if BT would release their code.

Shitty globals or not.

The Unending Saga Of the Disappearing Access Point

Yeah... about that.

I rewrote my scripts to double-check the availability of the AP. It waits 30 seconds and checks again. The "problem" disappeared immediately.

That lasted about a month before it came back. Now, it dies about twice a week. Seven times since rewriting the script, and only once when anyone was at home to notice it (and no one did).

It's not a power failure issue, since it's on the UPS. It is using POE (Power Over Ethernet) now, so that's another change.

The next step is either triple-checking or using a dedicated wireless NIC to do the scan.

"subrepticious"

About 3,870 results.

Srsly?

UPDATE: 09/05/2011

I now have the #1 Google hit for this silly non-word. However, when searching for it, I spelled it right and discovered "subreptitious" is a real adjective derived from from the noun "subreption", which means:

1. A calculated misrepresentation through concealment of the facts.
2. An inference drawn from such a misrepresentation.

I did not know that.

Neither did the guy who wrote "subrepticiously" when he meant "surreptitiously".

You learn something new every day. If not, you're doing it wrong.

Corporative Nets Attack

WTF is that supposed to mean?

My best professional guess is "something lost in translation".

(Yes, I did it for the Google search result.)

You get five points if you know where it came from.

23,000 IPs: 104 Proxies

The smackdown is on for 23,000 BitTorrent users who downloaded a Sylvester Stallone B-movie no one has ever heard of.  You can find the story at Wired.

You can also find a list of all the IP addresses here (PDF).

I figured this was right up my alley, so I compared the 23,000 addresses with the 3.7 million proxies in the database and got 104 hits (a whopping 0.45%).

149 if you count repeat offenders (the same IP address listening on different ports).

There is a smattering of obvious malware ports, mostly the ports Koobface has loved so much over the past two years (8085 and 9090), and our mystery port 27977.  There are a few traditional CERN type proxy ports (8080, 8000, etc), but the rest of them are all across the board, just like the SOCKS recidivists I mentioned on Proxy Obsession just before it went dark.

Are these repeat SOCKS4 offenders that we see in the proxy lists every fucking day actually BitTorrent clients on TOR?

I have to confess complete, utter stupidity on the inner workings of TOR, but I did some quick armchair research and it appears the likelihood is high that they are.  Or, at least, many may be.  TOR does indeed leverage SOCKS functionality, and, being part of the network, you'd have to leave the ports open, just waiting to be scanned by an army of proxy hunters.

And, the market for anonymizing BitTorrent over TOR is out there.

You learn something new every day.

If you have more information, enlighten me.