Re: [Full-disclosure] Ip address and mac address hardcoded

[mramelie@xxxxxxxxxxxx]

Hello,
  I have check it with IDA, its used in the case, but I'm still
working on the details. Its a public routable ip address and the mac
is a valid one from the same vendor. Doesn't make sense to be the mac
from the device, because the firmware I'm analyzing is an upgrade so
it must be generic. I will give more information has I have it.
MRA

On 11/17/2013 at 10:24 AM, "Burak CIFTER"  wrote:Even if it's a
factory default configuration after reset, I see no reason to hardcode
a MAC address. 
Check the firmware with IDA and control if the MAC/IP addresses are
used for a condition. Not far ago, we've seen the D-Link Router
backdoor was using a hardcoded user-agent. So it is slightly possible
to by-pass authentication from a pre-configured IP address or MAC
(from a local network). 
On Sat, Nov 16, 2013 at 1:59 PM,   wrote:
 Hi all,
  I've been doing some investigation, and I come acrosss an ip address
and a mac address hardcoded in some libraries of a firmware for a
vendor. Why should it be there this kind of hardcode? 
MRA
_______________________________________________
 Full-Disclosure - We believe in it.
 Charter: http://lists.grok.org.uk/full-disclosure-charter.html
 Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/