Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have recently discovered that a co-worker (who has sudo privileges on my machine) has installed dsniff, and it has been there for a while. I have no idea when they ran it (if at all), the only command I found in their bash_history with dsniff is apt-get install dsniff although bash_history doesn't show commands run with a screen session. Could my emails and other accounts be compromised even if they use SSL? Is there anyway to get more information about what sort of information the program has been collecting about me?

share|improve this question
add comment

1 Answer

DSniff is a set of tools which do traffic analysis on the network. A machine which has DSniff installed can spy upon the local network and reveal every data element which is not protected. Nominally, SSL protects against that; that's what SSL was designed to do. One of the DSniff tools is webmitm, which purports to intercept and crack SSL connections -- it can do that only by making the client accept a fake server certificate, as part of a Man-in-the-Middle attack. If you never got a warning from your browser (the big scary warning which tells you that the server's certificate looks fishy) and clicked through it, then you should be safe. The validation of the server's certificate is the part which prevents MitM attacks.


Your real problem is that potentially malicious people have administrative access on your machine. If they wanted to read your files, grab your passwords and generally plunder your secrets, then they could have perfectly done it and then removed their traces. That you find in their .bash_history file an installation command for dsniff does not mean that installing dsniff is the only thing they did. Having "sudo privileges" implies being able to run arbitrary things without any restriction on the machine. That kind of power includes the power to edit log files to remove all traces of funky activity.

To sum up, if your co-workers want to see your emails, then they already have them and there is no guarantee that you could find any trace of the act.

That's why in most workplaces they have this wonderful thing in place, called trust. Personally I would not accept to work with people that I could not trust with not trying to read my personal emails.

share|improve this answer
Unfortunately, it seems that I cannot trust this one coworker. They have been running other network commands with malicious intent too such as tcpkill. I am aware bash_history does not show everything, but assuming they have not been careful enough to erase their traces is there anyway to get some information on what they have collected, at the very least to prove that they have been sniffing data? I am not really sure how to handle this at work; I have revoked their access to the machine, but it is still a concern to me. –  hesson Aug 29 '13 at 23:12
@hesson At some point you need to get management involved. –  Michael Hampton Aug 30 '13 at 2:04
I second that. In fact, when there are some rather definite clues of malicious behaviour, not involving management kind of makes you an accomplice, which is not good. Reporting such occurrences is your duty and you can get blamed (and be fired and even prosecuted) for not having done such. –  Tom Leek Aug 30 '13 at 12:55
I did that today and he claimed he had done it for administration purposes; management didn't do anything. So now I'm just going to find a new job. Thanks for the suggestions. –  hesson Aug 30 '13 at 23:14
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.