Re: FW: RE Modem identification

From: olle (olleat_private)
Date: Wed Sep 26 2001 - 05:15:36 PDT

  • Next message: mat_private: "Re: Non-GUI intrusion"

    On Tue, Sep 25, 2001 at 10:01:01AM +0200, Dawes, Rogan (ZA - Johannesburg) wrote:
    > 
    > Re the prompting, one of the most common "Silent" modems seems to be Windows
    > NT RAS. This sits there until you give it a particular string.  I am
    > intending to capture the initial string using PortMon, and replay it blindly
    > whenever I get no initial characters. That should help identify a number of
    > systems, I think.
    
    NT RAS is just PP with MSCHAP authentication.
    
    pppd will suffice both to identify and bf NT RAS.
    
    /olle
    
    ----------------------------------------------------------------------------
    This list is provided by the SecurityFocus Security Intelligence Alert (SIA)
    Service. For more information on SecurityFocus' SIA service which
    automatically alerts you to the latest security vulnerabilities please see:
    https://alerts.securityfocus.com/
    



    This archive was generated by hypermail 2b30 : Wed Sep 26 2001 - 08:01:31 PDT