My school requires you run their antivirus program if you have windows or OSX. They make you install a program called SafeConnect which monitors your antivirus status and sends information back to the school. There is an exception for Unix and Linux users.

Last year I could spoof my browser user agent to look like I was on a PDA, that let me access the PDA WiFi network. This year I spoofed it to look like I'm running Linux so I don't need to run their software. It seems to be working, but its only been a few minuets. What other ways can they detect my OS? and how can I spoof it?

Of course the real solution is just to install Linux, but I like my games.

Edit, yea it didn't work. Its still asking me to run their shit.

They can usually determine what basic operating system you are running by probes.

__________________
In Silence I lay for that Fateful Day. 0day.

jamato@email.itt-tech.edu <-- My Email

Get wireshark, and see what information SafeConnect is sending to your school. Shouldn't be too hard to write a script or program that would send spoofed packets I'd assume.

Alright, totally off topic now, but thats fine.

I downloaded Wireshark, determined the location the program was sending the info and intercepted the packets.

When I disable my AV it sends 13 packets that tells the school that my AV is disabled. I immediately get locked out of the network.

When I enable it, it sends 9 packets and I can get back on right away.

I also assume it sends out some info every few hours, because if I disable it, I get locked a little bit later. I'm going to run Wireshark for the next few hours to determine what packets and the frequency of these packets. Though I could probably just send the 9 packets that says my AV is enabled every now and then.

My next big question is how do I resend these packets? I have the packets and I know where they are being sent, what port, what protocol, ect. I know C and Java, but I never got into network programming.

Final question is, is my packet scanning detectable if I'm not running in promiscuous mode?

I am pretty sure most languages have a way to work with your network devices, whether integrated, or through a plug in. I honestly don't have a clue as to actually making a script or program, but someone in Hello World might.

And no, they shouldn't be able to tell that you are running wireshark. It is basically showing you what is already happening behind the scenes.

Alright, cool

I narrowed it down to 9 packets that get sent in the same order in 20min intervals

Now to figure out how to send them on my own....

EDIT: Feck, it seems the packets being sent out are slightly different and are responding to packets sent it by the schools network

New mission is to isolate what parts of the AV it checks to make sure its running. That way I could make a fake AV to cut back on my system resources.

Write a program that emulates the program you want it to emulate. If it's as simple as it sounds, then it'll be easy.

Or you could just install Gnu.

ahaha. I just renamed notepad.exe to McShield.exe (McAffe)

I ran that and it passed the check. Lol

So I'm just going to write a silly little program that hides in the taskbar and I'll name it McShield.exe

Jesus christ, I should have thought of this in the beginning. Start with the simplest solution, no matter how stupid.

Yeah, I was going to suggest something much more complicated if that didn't work. I was assuming this was a fairly well written application, and it would have some kind of signature database for lots of different anti virus programs. I guess they are just a bunch of lazy fuckers.

Hahaha that's fucking funny man. That reminds me of how I finally hacked the admin account at my school last year. I opened an old DOS window (command.com, not cmd.exe) and typed "net user admin pwned" just to see what would happen. It changed the admin password to pwned. I stared at the screen dumbfounded for like 10 minutes because this was after a few months of many failed attempts at password sniffing and hacking.