Security measures against packet sniffing

Question

I work in a environment where packet sniffing can be easily done . I was worried about my confidential data . Please suggest how is it done and precaution which i can take at client level.

Answer 1

When you feel your local computer network is insecure, there are four main approaches.

1. Don't use it at all. (e.g. Only do your online banking at home)
2. Establish an encrypted connection to your destination. (e.g. make sure you do your email over an HTTPS connection.)
3. Establish an encrypted connection to a trusted network. (e.g. bring up a VPN tunnel to home, and connect onwards from there.)
4. Encrypt the data individually before sending it over the network. (e.g. zip up the document with AES encryption turned on before sending it.)

Answer 2

Using VPN technology can protect all of your communication, not just communication to websites that support SSL/TLS. Here are 5 VPN services but you can set up your own VPN at home for a low cost.

A basic method of detecting and stopping a class of network interception attacks is managing your ARP table. Here are tools that provide ARP security:

• XArp: Advanced ARP spoofing detection, active probing and passive checks. Two user interfaces: normal view with predefined security levels, pro view with per-interface configuration of detection modules and active validation. Windows and Linux, GUI-based.
• anti-arpspoof
• Arpwatch
• ArpON: Portable handler daemon for securing ARP against spoofing, cache poisoning or poison - routing attacks in static, dynamic and hybrid networks.
• Antidote: Linux daemon, monitors mappings, unusually large number of ARP packets.
• Arp_Antidote: Linux Kernel Patch for 2.4.18 - 2.4.20, watches mappings, can define action to take when.
• Arpalert: Predefined list of allowed MAC addresses, alert if MAC that is not in list.
• Arpwatch/ArpwatchNG/Winarpwatch: Keep mappings of IP-MAC pairs, report changes via Syslog, Email.
• Prelude IDS: ArpSpoof plugin, basic checks on addresses.
• Snort: Snort preprocessor Arpspoof, performs basic checks on addresses

Answer 3

Simply encrypt your data (using SSL/TLS for example). Else there is no countermeasure against sniffing.

Answer 4

I feel you need to provide more details. On one level, you suggest your environment is one in which packet sniffing can be done, but then ask how this is done. How do you know you are working in an environment which is vulnerable if you don't know how this can be done?

The type of environment has some baring on what you can do and what you need to do. For example, if you feel you are at risk becase you are connecting to the network over wireless, then using 802.x, based security may be enough. If you are concerned because you are using a public wired network in a library or internet cafe etc, then perhapse ensuring all outgoing connections are encrypted with ssl, ssh etc may be sufficient. On the other hand, if you are concerned about a remote network you need to access, the answer may be VPN. If on the other hand you feel your home network is at risk, you may only need to make some minor changes to your router/modem to get sufficient protection.

In addition to the environment, it is also important to consider the data you are concerned about. For example, if you are talking about your email messages, then the real issue may be whether email is the right communication channel to use and the solution may be as simple as just encrypting files before sending them. On the other hand, if you are involved in multi-million dollare stock trades, the requirements may be much higher.

Security is not an absolute. You can never be 100% 'secure'. All you can do is try to understand what the risks are and apply reasonable measures to mitigate them. I'm assuming that is what has prompted your question. Unfortunately, there is not sufficient information to provide any real non-generic advice past "use encryption" answers, which may not actually be correct. Failing to get the right balance will mean that things become harder and more inconvenient to do while not actually providing you with any real benefit.