Conversation

Notices

1. djsumdog (djsumdog@djsumdog.com)'s status on Thursday, 07-Dec-2023 10:13:54 JST djsumdog

   • † top dog :pedomustdie:
   • this ad CAN be blocked, bitch
   or physically separate networks. Also can't you get past vlan protections if you have root access on a box and can just tag your packets however you want?
   • † top dog :pedomustdie: likes this.
   • djsumdog (djsumdog@djsumdog.com)'s status on Thursday, 07-Dec-2023 10:29:11 JST djsumdog

     in reply to

     • arcanicanis
     • † top dog :pedomustdie:
     • this ad CAN be blocked, bitch

     I saw a talk at Kiwicon yonks ago where a guy broke a Cisco switch. The thing was crazy. The switch ran a Linux kernel, but the shell/system barely had anything except for once massive 500MB binary. If you ran ip a, it only showed one Ethernet adapter, because the binary connected to the PCI bus and the other adapters using user-mode PCIe (which is a thing).

     He didn’t say it in the talk, but I think what happened was Cisco use to make their own OS. As time went on, it was just easier to use Linux since it supported like all the SoCs at the time .. so they’d use a tiny thin layer of Linux + shims to connect to the binary which use to be the entire OS, but is now just an iOS blob running on Linux.

     † top dog :pedomustdie: likes this.
   • arcanicanis (arcanicanis@were.social)'s status on Thursday, 07-Dec-2023 10:29:12 JST arcanicanis

     in reply to

     • † top dog :pedomustdie:
     • this ad CAN be blocked, bitch
     Only if the switch is configured to accept tagged packets of that VLAN ID on that specific port, otherwise it gets dropped.
     
     Nonetheless, I'm really really curious if there's anyone in recent years bothering to pentest network switch firmware, because I wouldn't be surprised if it was a total blindspot, as many things are.