Hot answers tagged sniffer
21
When you feel your local computer network is insecure, there are four main approaches.
Don't use it at all. (e.g. Only do your online banking at home)
Establish an encrypted connection to your destination. (e.g. make sure you do your email over an HTTPS connection.)
Establish an encrypted connection to a trusted network. (e.g. bring up a VPN tunnel to ...
18
For telecommunications, checkout GSM, CDMA, TDMA, and EDGE. The two competing protocols in the United States are GSM and CDMA. The resources linked below are lacking when it comes to CDMA, but using site:defcon.org and site:blackhat.com in your Google searches will turn up some presentations.
For interception of GSM, I refer you to a white paper on ...
9
There's no way to easily automate this in any useful way, because protocols are designed by humans. As such, they don't really follow any set pattern or rules. You're going to have to put the brain-work in yourself to dissect them.
However, there are some tricks:
Use Wireshark to separate out individual conversations and identify the high-level ...
8
In order to trace back the source you first need to figure out which device is generating the traffic. The best, in my opinion, would be to set up a flow collector of some sort. There are generally two ways to do this,
Exporting flows from the device
Software analysis to generate flows
Most high end network gear will generate some kind of flow record, ...
8
WPA2 is the only secure method. WEP and WPA are "broken". Also, WEP is easier to crack than WPA. However, any security, even WEP, is better than no security as it will effectively prevent opportunistic connections to your network.
I just checked and indeed the new Mac Books Pro don't have an Ethernet port. All I can say is WTF?!?
8
There has been some work done that I've heard of like anti-sniff, which looks to detect machines in promiscuous mode using timing information.
The idea being that machines in promiscuous mode will have to process all packets that they see so if there are large amounts of traffic that need processed the system will be busy and slower to respond to directed ...
7
It is possible to sniff packets on unswitched ethernet or wifi completely passively. Tools like the Throwing Star Lan Tap make this even easier. In this passive case, there is nothing you can really do about it.
However if you are on a switched lan, any sniffer would have to start poisoning ARP caches, even if only on the switch. This is something that you ...
6
you're right, wireless communications are all around us. We can detect them, but they are encrypted.
3G security seems to be based around the concepts of secure authentication and encrypted communication.
Here's an interesting article on the subject.
3G Security Architecture
There are five different sets of features that are part of the ...
6
The vulnerability is not in allowing plaintext authentication, but in using plaintext authentication. For instance, an open telnet service on a Unix system does not make the Unix system weak -- the people who actually use that service do make it weak.
Human nature being what it is, when a service it available, people will use it, so this is a good reason to ...
6
This is totally normal. There are thousands of bots on the internet that have the sole purpose of scanning every single IP address and attempting to infect it. Any information they discover will be put into a database somewhere, and there's nothing you can do about it. If you change your IP then that one will be discovered too unless you enable a firewall ...
6
You can technically start sniffing away without "connecting" to the network. Terry is correct, if the network is open (no encryption, WEP/WPA/WPA2) then you can just "Join" the network and sniff the traffic. However, you do not need to join the network to sniff the traffic. WLANs use radio frequencies, all you have to do is match the freq (channel) and ...
5
Tools such as this SSL MITM proxy from Stanford can automatically generate certificates and provide an SSL-to-SSL cutover. You'll need to set the key used by the proxy to be trusted by your browser, but that will provide you with the ability to see the cleartext traffic that is leaving from your machine.
While you can try to rewrite any HTTPS redirect ...
5
Not really,
The only who can sniff data is the last node between the three. And even then, it can't tell who this data belongs to unless this data contains identifying information.
The reason the others can't sniff is that TOR uses onion routing, as its name suggests. That is, when you send a request to a certain server, and suppose it's going to pass ...
5
The attacker can try to flood the MAC table of the switch, and then the switch could fall down in "hub" mode. Then the switch would send the packets of Alice and Bob on all port. So Eve could sniff their network packets.
Another way to hack is to poison the switch MAC table. If Eve knows the MAC address of Alice and Bob, Eve could tell the switch that he ...
5
First, let's clarify what is meant by a static arp entry. The Address Resolution Protocol is used to map the layer 2 address to the layer 3 address, typically this is Ethernet and IP. A static arp entry means that you always expect a specific IP to be at a given hardware address. With a default Windows or Linux implementation, you will be using a TCP/IP ...
4
I recall a video I saw from one of the big conventions, in which a researcher was able to decode emissions from a PS/2 keyboard using nothing but a slow oscilloscope - he simply observed the ground pin of the target machine and he could pick bits straight off. I had previously assumed that such attacks required spectrum analysers and a degree in RF black ...
4
Like any other secured communication, it could be possible to decode the GSM/CDMA wireless traffic; question is how tough it is and how much infrastructure cost is required to decode them. Coming to a simple answer though much details and analysis have already been posted here, it is difficult to intercept them because:
There exist a secure element in the ...
4
Another method is to attach strace to the process (and it's children). Input/output will be logged there after decryption, yielding the password. In my experience this sort of thing works more reliably than mucking about with the log levels of sshd (but of course YMMV).
write(5, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\nPassword: \0\0"..., 34) = 34
read(5, ...
4
If you run ssh in full debug mode you can have it log the content of all packets and then go back and extract the passwords from that. you can do this bu running
ssh -dddddddd
or add it to your /etc/ssh/sshd_config:
LogLevel DEBUG3
this runs it once, in non-daemon mode and logs way more than you care about. you can improve this by disabling the sshd ...
4
The first step in any sort of MITM attack on a network is connecting to the network. With a wired network, that involves somehow connecting your machine to the network through the use of an Ethernet cable. With a wireless network, you just need to connect to the network.. well, wirelessly. Without a requiring a password to connect to a wireless network, ...
3
I understand that I am late to the party, but still I would like to add my few words:
Quick answers:
TOR works opening a random anonymous path between two hosts using others computers that have TOR installed
No. Have installed TOR, are using TOR and agreed that they will be nodes. (They can also chose what type of nodes they will be)
everybody can ...
3
In terms of tracking this down I'd be inclined to start by looking at volume of traffic and then narrowing down the to/from addresses.
Probably the best place to start this will be on the Firewall device. There's likely to be some level of monitoring available on it to show which ports are generating what volume of traffic. From that you should be able to ...
3
GSM has an encryption which other form of standards has not, but it doesn't mean interception is not feasible.
There are plenty of references to this, most of them requires the use of special hardware:
http://www.hackcanada.com/blackcrawl/cell/gsm/gsm-secur/gsm-secur.html
The European Telecommunications Standards Institute (ETSI) is the governing body for ...
3
Governments purchase spyware from private companies.
Some companies like VUPEN are known for building complex 0-day exploits against browsers and selling them privately to anyone for hundreds of thousands of dollars.
Recently the Obama Administration has moved to block the sale of such technology to Iran and Syria. Iran is known to be performing ...
3
You're misinterpreting the categorization.
**[Expert Info (Chat/Sequence): HTTP/1.1 200 OK\r\n]**
[Message: HTTP/1.1 200 OK\r\n]
[Severity level: Chat]
Other things that might show up there are "note", "warn", and "error". If this were expanded to two words, it would be protocol chat. What this is pointing out is that this packet ...
2
I think you may misunderstand the difference between malware and MitM attack tools. The former runs on the victim, the latter runs on the attacker.
If (through other means) you were able to get the victim's HTTP requests routed to you instead of their intended destination, sure. But there are other better tools that both perform the full process, not just ...
2
If you are using GMail or Yahoo all credentials should be transmitted over HTTPS and there for you are safe. If you where connecting to http://security.stackexchange.com or StackOverflow over an open WiFi network then someone is able to sniff your cookie and immediately login as you. This is because StackOverflow and secuirty.se are violating OWASP a9. ...
2
Yes, of course. Service and OS fingerprinting is one of the first steps in the methodology.
Nmap does service fingerprinting and OS detection. But that requires that the service be available to the network (web server, SMB, etc.). You can even connect to a network port with telnet and request the service banner.
If you want to know an installed program ...
2
You can use justniffer. It's a cool http sniffer that logs network traffic in apache log format.
So you can postprocess logs with any web log analyzer, such as awstats or Piwik
2
I don't know of any attacks on Ethernet or USB, but here are two related topics that might interest you.
Fault attacks. A fault attack involves injecting some sort of error or faulty data into a computation. It is sort of the dual of a side-channel attack. Some research papers you might enjoy:
Optical Fault Induction Attacks, CHES 2002.
Tamper ...
Only top voted, non community-wiki answers of a minimum length are eligible
