[EMAIL PROTECTED] said: > Say I configure a router with a read-only SNMP community of "public" and > make it Internet accessible. What vulnerabilities or information > disclosure does that open up that would be better left closed? A switch? > > Thanks, > Lee >
Well, they'd probably get the firmware version -- instantly giving info on what may possibly be known as exploitable. They'd get the system's contact information, if it's in there (frequently with email address and phone number) which is handy if you're doing any social engineering. You'd also get the exact hardware spec, it's uptime, how many interfaces it has, and with what IPs (to maybe get around ACLs; something folks often want to do). You learn all the MAC addresses, as well -- if you can get on a local subnet and start spoofing that, you can basically shut down the network. You get the system's name, which is handy, too. Say it's "vodka" -- there's a strong chance there's also a "gin", "scotch", or "brandy" elsewhere on the network that they may not havefound yet. You get ther status of all the interfaces, and how much traffic is going through them (probably not too useful). You also learn it's CAM table (the MAC addresses of the machines it sees at layer-2) which is handy for spoofing and sniffing. I can go on, and on, and on. Why not get a copy of snmpwalk, and check out what your equipment shows you, and think like an attacker would. There's a lot there. A whole lot. Cheers, -tcannon _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
