Sponsored By:


www.tenablesecurity.com


http://twitter.com/pauldotcom


http://www.facebook.com/group.php?gid=6678027341


www.youtube.com/pauldotcom




PaulDotCom Security Weekly - Episode 63 - March 15, 2007

| | Comments (2)
Live from the PaulDotCom Security Weekly Studio....

Hosts: Larry "Uncle Larry" Pesce, Paul "PaulDotCom" Asadoorian, Nick "Twitchy" Depetrillo, Joe "Mr. C" Conlin
Email: psw@pauldotcom.com

Direct Audio Download

(Bandwidth provided by OSHEAN)

Audio Feeds:

2 Comments

It's a bit complicated to do with just one command as you say. Well, actually it's probably very simple but I haven't been able to find a simple way to do it so I've came up with this weird and ugly solution:

hcitool -i hci0 info `hcitool -i hci0 scan | grep -i '\([0-9a-f]\{2\}:\)\{5\}[0-9a-f]\{2\}' | cut -b 2-18`

The info option, which is the one you want, requires the "baddr" as an agument so what I do is to scan for devices, use with grep to filter lines that say things like "scanning", and then cut the MAC Address and feed it to the info option. It works for me.

Enjoyed the podcast, although twitchy seemed pretty mellow. are you guys slipping him some rum in those cokes?

You mentioned a tool that would take advantage of Windows use of netbios broadcast for name resolution. This is configurable in windows, it's called the "netbios node type". They used to recommend nodes (Client winders boxes) be set to a hybrid node type (0x8 iirc), and defaults are either 0x1 or 0x8, both of which broadcast. a p-type node does not broadcast, and is 0x2. THAT should be the default setting handed out via DHCP Servers, and manually set on servers in an organization. see: http://support.microsoft.com/kb/160177 for some reference.

I say that, yet turning off WINS and netbios broadcasting still breaks a lot of legacy apps so handle with care.

With Win2003 and AD MS purports that you may be able to "turn off" wins but in practice I rarely see that as possible, except for shops with little or no legacy windows applications that depend on MS/WINS/Netbios retardedness for proper operation.

YMMV.

thanks for the great podcasts, I really enjoy them.

Matt/Pfft@Freenode