JekHyde and Carl physical penetration engagement INVOLVES Carl
The engagement involved Carl as the hardware and rogue-device specialist.
Explicit Confidence 99% · Jack Rhysider EP 41 Details
“The team consists of JekHyde and Carl.”
Person
person:carl
Member of the physical penetration-testing team who handles hardware and rogue devices.
Member of the physical penetration-testing team who handles hardware and rogue devices.
“I’m Carl. I basically do the hardware and our rogue [00:15:00] device side.”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | USES | rogue device | Explicit | 41 |
| outgoing | USES | tcpdump | Explicit | 41 |
| outgoing | USES | passive packet capture | Explicit | 41 |
| outgoing | USES | MAC address spoofing | Explicit | 41 |
| outgoing | USES | TTL manipulation | Explicit | 41 |
| incoming | INVOLVES | JekHyde and Carl physical penetration engagement | Explicit | 41 |
JekHyde and Carl physical penetration engagement INVOLVES Carl
The engagement involved Carl as the hardware and rogue-device specialist.
Explicit Confidence 99% · Jack Rhysider EP 41 Details
“The team consists of JekHyde and Carl.”
Carl USES rogue device
Carl carried, connected, and planted the rogue device during the engagement.
Explicit Confidence 99% · Jack Rhysider EP 41 Details
“Carl had a rogue device and a laptop”
Carl used tcpdump to observe traffic on candidate network ports.
Explicit Confidence 99% · Jack Rhysider EP 41 Details
“Carl is using a program called tcpdump to watch what traffic is being broadcast”
Carl USES passive packet capture
Carl initially performed passive listening at layers 2 and 3 rather than assigning the device an IP address.
Explicit Confidence 96% · Carl EP 41 Details
“It’s kind of a gamble based on within that one or two minutes. I’m looking at the traffic”
Carl USES MAC address spoofing
Carl changed the rogue device's MAC address to resemble observed workstations.
Explicit Confidence 99% · Carl EP 41 Details
“then change the MAC address to make myself look like the workstations I’ve been observing”
Carl USES TTL manipulation
Carl changed the TTL so the device would appear to be a Windows workstation rather than Linux.
Explicit Confidence 99% · Carl EP 41 Details
“Then I’ll also change the TTL so if I’m pinged, I’ll also look like a Windows workstation”