A friend of mine teaches a "Basic IT Security" class at a .edu and asked what demonstrations he can do, live, to show why certain practices are bad.
Currently, we have cobbled together a Firesheep demo, which is impressive, but it's becoming unreliable as the browser ages (it only works on Firefox 3.6.x) and as more websites handle their cookies properly.
Can anyone suggest a good demonstration of why doing X is bad? The more "impressive" to a lay-person, the better
So far some ideas have been:
- Use wireshark to sniff a password/email that has been insecurely transmitted
- Show how a phish works from the attackers point of view
- Perform a dictionary/brute force attack against a weak password
- Pull the (unencrypted) HDD from a laptop and get some files off it
So far we don't think any of these are terribly impressive, from the point of view of a bored Joe Ordinary. Appreciate any suggestions!