Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Throughout my readings on cryptography, Eve is always assumed to have the capability to be a passive listener and obtain every message exchanged between two communicators. How can one demonstrate this? I have a presentation and would like to know if there is a software I can demonstrate to the audience and show them that every message sent through is obtained by me, but are useless because they are encrypted.

share|improve this question

migrated from Oct 18 '13 at 16:58

This question came from our site for software developers, mathematicians and others interested in cryptography.

For communication protocols it is most of the time better to think of Eve (or Malory) to be able to perform man in the middle attack. Most of the time if you can access the data in transport, you can also change the data in transport. This is especially true if you can setup a WiFi hotspot for instance. And in that case you also need integrity and authenticity (e.g. to avoid padding oracle attacks that may lead to exposure of the plaintext). – Maarten Bodewes Oct 15 '13 at 23:10

I'd recommend grabbing Wireshark and listening on a Wifi network. If your network card can be put into promiscuous mode, and it probably can, then Wireshark will show all packets on the network that it picks up... e.g., everything on the network, essentially.

You could demonstrate the difference between HTTPS (say, have someone browse their Gmail account) and HTTP (say, browse reddit).

The reasons why I suggest using a Wifi network are twofold: first, Wifi networks model a very real-world scenario (say, public wifi at Starbucks), and second, Wifi networks have a "broadcast everything" model that makes picking up traffic really easy.

For more complex network topologies, e.g. a good ethernet with switches and whatnot, there are other techniques that can be used to sniff/MITM hard-to-reach packets, like ARP spoofing. But these are probably outside of the scope of what you want to demonstrate — you may decide to mention them in passing, though.

share|improve this answer
There are a lot of practical presentations you can achieve with Wireshark and a computer acting as Internet gateway. There you can show what a router is capable of... and corrupted routers are a real thing. It's not only showing unencrypted communication, but you can also show man in the middle attacks for HTTPS (and make your users click away those pesky "I don't know this certificate" windows; once per session and certificate is enough). – tylo Oct 15 '13 at 15:37
WiFi generally allows for active attacks. So just performing encryption may not be enough to provide confidentiality of messages (e.g. padding oracle attacks). – Maarten Bodewes Oct 15 '13 at 23:24

The key word missing here is even. That is, even if Eve sees all of the ciphertexts, security is still preserved. This is a threat model and one that makes sense. Communication is often done through insecure channels. Since we can't rely on the security of the channel, we can make no assumptions about it other than the worst. And in this case, the worst scenario is that Eve can intercept the messages. So, we design schemes that are secure even if Eve intercepts all of the (encrypted and/or signed) messages.

As for your presentation, you say that you want software to "demonstrate to the audience and show them that every message sent through is obtained by me, but are useless because they are encrypted.".

To demonstrate this, you don't need software to intercept! Rather, show that even if you give an adversary the message, they have no value. So, rather than focusing on software to obtain the messages and how the adversary would get them, focus on the next step and say: even if the adversary somehow gets these messages, they are useless.

And if someone asks you how the adversary might go about that, the answer is simple: we don't have a secure channel through which we can communicate and be sure that messages are not intercepted. So, we show that even of they are all intercepted by Eve, everything is still fine and confidentiality/integrity can still be maintained.

share|improve this answer
Your answer is correct from a theoretical standpoint but what you suggest is exactly what the OP wants to do. I'm guessing the audience is non-technical so a security proof wouldn't be as good as a practical demonstration of an intercept (which is what the OP is asking for). – rath Oct 15 '13 at 1:52
The OP references the reason for wanting this: Specifically because all of the crypto literature assumes that Eve has this power. That suggests that they misunderstood why the literature assumes this. And if the audience is nontechnical, then the presentation will still fall on deaf ears as the OP wants to "demonstrate to the audience and show them that every message sent through is obtained by me, but are useless because they are encrypted". The latter part still requires a security proof. – AFS Oct 15 '13 at 1:57

This is the last thing you must be concerned with when you study cryptoraphy. We don't have secure communication channels and this can be instantiated in practise with numerous ways as already defined. The lack of secure communication channels has triggered and is triggering the cryptographers to construct crypto protocols and primitives in which data are kept confidential even when eavesdropping is happening.Sniffing a wireless network is a simple case. Hacking a non-trivial server of the network or your machine is also a practical case

share|improve this answer
Sorry, downvoted as I found this answer very hard to read and understand. Misspelling cryptography also does not do you any good :P – Maarten Bodewes Oct 15 '13 at 23:14

As others have posted, and you opened with, cryptographers accept as a given that Eve always exists, and that she can always eavesdrop on any conversation. Anyone who works with computers understands that the internet is not secure, but many non-cryptographers still won't understand; sometimes people just have to be reminded.

Instead of talking them to death, it sounds like you want to use showmanship to convince your audience. There's nothing wrong with a dramatic demo, by the way, but it has to be fast, and it has to help make your point. If you can pull off a one minute hack on screen with everyone watching, you will hold their attention long enough to make your point.

I'd start by setting up a small server, getting a copy of metasploit, and practicing the use of meterpreter to inject a packet sniffer, and Wireshark to display the traffic. Here's a quick guide to using it:

It's better to have different physical boxes so that the audience gets a sense for what's happening -- telling a non-technical audience that you're using virtual machines isn't very convincing. But they all can understand Alice and Bob sitting at their laptops or holding their iPads.

For the server, any old laptop will do. For all the demo equipment, choose something light weight, easy to carry, and quick to boot up and run on a stage. You are just going to run enough of a server to host a little messaging service, bulletin board, or wordpress site.

The victim server needs an operating system or application that has known, reliable vulnerabilities, and one you can practice on - a lot. Windows XP SP2 with an old version of Wordpress might be a good choice.

Avoid describing the server environment to the audience, because some people are likely to argue with you and say "nobody runs XP for servers!" If someone does notice and asks, say "I chose it only to make the demo go smoothly, and if you'll please excuse me, I have to get back to the demo."

You'll also need some kind of networking hardware: an old switch, or perhaps an old home router, possibly with a wireless access point.

Besides thorough rehearsals, get everything set up and running on stage before the audience arrives, and perform two final walk-throughs with your volunteers.

As you introduce yourself, introduce your mini-internet. Explain that Alice and Bob are going to exchange messages through this server. Call it for a cheap laugh.

Get some assistants or compliant volunteers to help, and introduce them as Alice and Bob. It would be showy if you can pull your Alice and Bob from the audience carrying their own laptops or iPads, but they'd have to be in on it with you and set up in advance, as you can't waste any time configuring their computers. Otherwise, you could provide working laptops for them.

Have them exchange a couple of messages (perhaps arrange for them to tell an audience-appropriate knock-knock joke) just to show how it works. All this needs to be done quickly, before you lose the audience.

Now is the time to introduce yourself as the eavesdropper, Eve. Eve will need to bring out her laptop and connect it to the network. For extra laughs, she could have a big NSA lettered on the lid of her laptop that reveals itself to the audience when she opens it, or use an NSA logo as the background for her desktop.

Finally, it's demo time. Have Eve use metasploit to break into the server and install a packet sniffer. Have Alice and Bob exchange some more messages, then use Wireshark to show everyone Eve's screen with copies of the network traffic. If you can keep that entire circus to 60 seconds in rehearsals, you'll wow the crowd.

Hopefully, you'll be at the point where your audience is demanding encryption. Have Eve start the packet capture again, and have Alice and Bob use the https port to exchange messages again. Now Eve's Wireshark capture will show the captured traffic is encrypted, and no longer readable.

Remember, don't focus on the hack. You're not trying to prove facebook servers can be hacked, or that you're some kind of super-hacker. You can even tell them you downloaded the demo off the internet, and it was just that easy. But make sure they understand the entire point of the demo is to show Eve can see all the traffic, even if she can't understand the encrypted contents of the messages.

By now, hopefully your audience wants to hear the rest of your talk.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.