5

Is it possible to crash a packet sniffer through a specially-formed packet to stop website administrators from tracking down the source? If it is possible, has it been done before? Or is it just not an effective method of attack that nobody tried to do so?

I know that a huge amount of packets can crash a packet sniffer, but that won't stop a determined administrator from finding the first packet from the attack.

4

You have to know what software the administrators are using to sniff the packets, additionally you have to know a vulnerability that is capable of crashing the application.

If these requirements apply, the answer to your question is yes.

For reference, take a look at past wireshark vulnerabilitys: https://www.cvedetails.com/vulnerability-list/vendor_id-4861/cvssscoremin-9/cvssscoremax-/Wireshark.html

0

It is absolutely possible. Not only crashing, but arbitrary code execution is possible. The popular tcpdump tool has had more remote code execution vulnerabilities than we can count. And yes, vulnerabilities that allow for crashing the packet sniffing utility are also quite common. You should never run a packet sniffer on a sensitive system of you suspect an intelligent attacker with access to your network will be targeting you.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.