Matasano Chargen - Latest Comments in Debunktraq: More Mac Wireless Chaff Posts

Re: Debunktraq: More Mac Wireless Chaff Posts

Jim Thompson — Sat, 19 Aug 2006 04:31:02 -0000

Sure, if I'm wrong, I'll apologize.

But pretty sure I'm not. After reviewing a high-resolution version of the video, its quite clear that the USB device was not in-use during the attack (at least, it wasn't passing frames).

Its the internal Airport card (!!) that has the 192.168.1.50 IP address.

Details here: http://www.smallworks.com/a...

Do I think that a highly similar attack is possible? Of course, but Maynor and Ellch haven't demonstrated anything thats even close to what they claim.

Re: Debunktraq: More Mac Wireless Chaff Posts

Thomas Ptacek — Sun, 06 Aug 2006 17:09:38 -0000

Matthew, I think you're going to find that if you read the coverage carefully, the "Apple pressure" accusations aren't directly quoted. If you, like most Mac people, are deeply suspicious of Brian Krebs to begin with, I suggest you step back and consider whether there are alternate explanations.

It is very obviously "easy" to assume bad fath and poor motives; just read Mac blogging coverage of Maynor's presentation.

The problem is this: lost in the shuffle here is the teeny, tiny little detail that Cache and Maynor's presentation ISN'T ABOUT APPLE. It's about vulnerabilities in wireless drivers, and how a remote attacker can figure out what chipset and drivers you're running to target an attack.

Want to put this in perspective? Here's some coverage Maynor got BEFORE THE WASHINGTON POST STORY:

http://www.darkreading.com/...

Funny, I don't see the Mac-baiting.

Re: Debunktraq: More Mac Wireless Chaff Posts

Matthew Brown — Sun, 06 Aug 2006 16:26:34 -0000

I think "what is it about Maynor’s talk that is eating into people’s brains?" is the way the story was told. Too much of an appearance of sleight-of-hand, of mirrors and illusions. Too much of an appearance of showmanship and headline-grabbing. And some pretty ill-chosen things to say outside of the video.

Perhaps those in the "black-hat" community like showmanship; however, outside, it leaves a taste of falsehood, regardless of the underlying exploit.

I think for this reason every time something is not shown, or shown misleadingly, it's easy to assume bad faith and the worst possible explanation of Maynor's motives.

E.g. the external USB wireless device used. I don't buy the explanation "Apple wouldn't let us show the exploit with the internal wireless". It could simply be that it was easier to craft an exploit for the external - not necessarily that the internal is safe - but if so, say so.

Re: Debunktraq: More Mac Wireless Chaff Posts

dre — Sun, 06 Aug 2006 00:44:17 -0000

tom, you're not only right - but it seems that you can also predict the future.

jim/ron/rui are obviously in tenent #1 of the kubler ross model of vulnerability management.