Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email firstname.lastname@example.org
Re: [Full-Disclosure] Viral infection via Serial Cable
From: Über GuidoZ (uberguidozgmail.com)
Date: Fri Sep 03 2004 - 01:24:47 CDT
I understadn where you're coming from if speaking about protocol.
However, in most cases there will be many more ways to exploit
something over TCP/IP then over a raw RS232 connection. The serial
port will need to have something listening on it, that is also
exploitable. Compare this to the amount of exploitable services and
such listening on a TCP/IP connection over the network. Matter of
propability is what I was getting at... I apologize if I wasn't clear
on this point.
Accepting the fact that MANY viruses exist in the wild that are
designed to infect over TCP/IP, the chance of running into one that
infects over a serial port is little to none. (Granted, unless that
connection is being used as a network comunication device, which then
in turns changes the entire argument back over to TCP/IP and network,
not RS232 data.) Interesting thoughts all, please keep them coming.
On Tue, 31 Aug 2004 02:49:41 +0200, Christian <evilg-house.de> wrote:
> Über GuidoZ wrote:
> > even though it's officially a serial connection... the assumtion is
> > talking about RS232 specs: http://www.google.com/search?q=rs232 I
> > think we're all aware a virus can most certainly traverse through a
> > USB connection.)
> hm, i fail to see the point here. isn't a serial connection to the
> outside world "just another link"? who cares, if it is a serial
> connection or ethernet? maybe i am biased with SLIP under linux - Serial
> Line IP, so the serial device really gets an ip-address and then it's
> tcp/ip all the way and no application/virus would care if this is
> "serial link". or is all data just sent to "com1"?
> BOFH excuse #416:
> We're out of slots on the server
Full-Disclosure - We believe in it.