Kirkpatrick’s script checks NetSupport to see whether authentication is required and if not it returns useful configuration settings from the hosts. Kirkpatrick also used Wireshark, the free and open-source packet analyzer, for his attack and discovered he could observe the TCP stream of NetSupport service and view its response. Kirkpatrick, a security consultant at Trustwave’s SpiderLabs, blogged about his findings on the company’s Anterior blog Wednesday.Įxploiting the vulnerability relies on using a simple script for the Nmap network scanner and making use of a hole that could allow attackers to go undetected while searching networks.
UPDATE – A vulnerability in older versions of NetSupport Manager, a platform that allows companies to remotely manage machines for desktop support, could yield sensitive configuration settings and lead to compromise.Īccording David Kirkpatrick, the researcher who found the vulnerability, it took him about four dozen lines of code to “easily bypass any Domain or Windows credentials” using version 10 of NetSupport, and that he could “remotely connect to the hosts and compromise them,” if he wanted to.
0 kommentar(er)
