Timeline for Can data coming into my UDP server be sniffed?
Current License: CC BY-SA 3.0
8 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Apr 18, 2016 at 17:39 | vote | accept | jskidd3 | ||
| Apr 18, 2016 at 17:08 | comment | added | jskidd3 | Thanks so much for this information - it's invaluable to me. On that basis I will ensure that we use TLS/TCP when interacting with the API. | |
| Apr 18, 2016 at 17:06 | comment | added | Trey Blalock | UDP scanning is trivial. It's just not fast due to timing restrictions which means lots of people make newbie mistakes when doing it. That said anyone who knows how to do it correctly can do it easily and for those who can't that data will still eventually show up on sites like scans.io | |
| Apr 18, 2016 at 17:03 | comment | added | Dog eat cat world | UDP scanning is not that trivial as you suggest. ICMP unreachable throttling etc. | |
| Apr 18, 2016 at 17:03 | comment | added | Trey Blalock | Absolutely. People are using linux-based LTE range extenders to run WireShark and look at traffic over the LTE (similar method for GSM) all the time. Also never assume your API is secure or that your authentication can't be bypassed or brute-forced. Has your API had a pentest performed ? API's are a GREAT way to break into databases. | |
| Apr 18, 2016 at 16:57 | history | edited | Trey Blalock | CC BY-SA 3.0 |
added paragraph about encryption
|
| Apr 18, 2016 at 16:55 | comment | added | jskidd3 | Thanks for your answer Trey. Our device actually connects to mobile networks rather than any specific wireless hotspot. On that basis is it still possible? Thanks for clarifying scanning tools, though I think that won't be a problem as knowing the hardcoded device ID is required to interface with the API. | |
| Apr 18, 2016 at 16:52 | history | answered | Trey Blalock | CC BY-SA 3.0 |