Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm a pentest newbie. Recently I've learned about sniffing in LANs. From the books and internet resources I'm studying, the sniffing (or packet capture) is always done on either Wired LANs (Ethernet 802.3) or Wireless Lans (Wifi 802.11).

But what about others like cell phone communication, SMS etc. They also use wireless. The information is all around us like in the case of Wifi. Why can't they be sniffed? Why didn't I find any example/situation or any resource where they explain these things.

Kindly, just tell me what all can be sniffed and what not?

share|improve this question
    
+1 great question. –  Rook Dec 24 '11 at 6:33
1  
+1 great title. –  LarsTech Dec 24 '11 at 14:33
add comment

2 Answers

up vote 10 down vote accepted

Machines create noise that maybe be detected by an attacker. If this noise undermines a physical cryptosystem then its called a side channel attack which is a very interesting and diverse research topic.

Like it or not, passwords are the gold standard and the human interface devices we use are very noisy. The electromagnetic noise produced by typing on a regular WIRED keyboard can be sniffed. As if that wasn't bad enough the vibrations from your keyboard can be sniffed with a laser.

Using an FPGA the HyperTransport bus was sniffed on the XBOX to obtain its secret key and break its (poorly designed) anti-piracy system. Microsoft should have been aware of this, because bus sniffing isn't new. Its also been used to break password protected hard drives.

Communication with a smart card can also be sniffed.

CRTs and even modern LCDs are vulnerable to Van Eck Phreaking.

The MPAA is using canines to sniff for pirated dvd's.

share|improve this answer
    
+1 Five edits so far in past 8 hours. Thanks a lot for really caring about your answer. :) –  claws Dec 24 '11 at 15:27
    
@claws, heh :), its an important question. –  Rook Dec 24 '11 at 15:30
2  
+1 for the canines, rofl, I thought that was a joke –  Lohoris Dec 25 '11 at 22:13
1  
@Lohoris hehe, yeah I included it as a joke. But its totally an attack on a computer system. Its also pretty absurd. –  Rook Dec 25 '11 at 22:14
    
@Rook: Ironically, I do have an electronics academic background. Could you kindly point me to the resources to learn more about this stuff. I mean, I want to build one of those stuffs –  claws Dec 27 '11 at 8:20
show 3 more comments

The short, definitive answer is: if it generates electromagnetic (EM) radiation (or signals of any kind, really) then it can be potentially sniffed.*

Whether it can be tuned-to, decoded, decrypted, and formed into a cohesive information stream within a specific budget using well-defined tools and techniques is another matter entirely.

So with your example of cell phones, the answer is yes. They can be sniffed. You require specific equipment OTHER than a general laptop computer with a 802.11 wireless receiver ethernet card because cell phones operate on a variety of different frequencies. Ever wonder why your radio, GPS, television, cell phone, and wifi all operate quite happily in a confined space with one another? This is the beauty of carving up the EM spectrum.

Even if you happen to get a tunable EM receiver, you may still have problems trying to sniff the traffic because of other characteristics in how that EM wave is built. Once you figure out how the wave has been built, you then need to figure out the underlying coding scheme, THEN figure out the protocol, THEN figure out any encryption built on top of that protocol, etc., etc.

When it comes to investigating interesting signalling schemes, you'll find some pretty smart people over at 2600, for example. I'm sure other people can point you at other resources as well.

*Read up on something called "TEMPEST" attacks for really interesting signal sniffing allowing you to, say, recreate the image on someone's monitor from afar or discern the password they type on their keyboard. These are extremely difficult and sensitive attacks, but theoretically possible and highlight that pretty much anything that uses electricity, makes a noise, creates a vibration, or otherwise can be detected and analyzed.

share|improve this answer
    
+1 Holyshit! @ TEMPEST Demo: youtube.com/watch?v=ZZ5HS8GWIec –  claws Dec 24 '11 at 15:24
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.