3

If two persons use the same router, which has an embedded WiFi access point, for accessing the Internet, is it possible that one can see

  • HTTP traffic
  • HTTPS traffic
  • TOR traffic

of the other in the below mentioned scenarios?

  1. Both connect to the router via its WiFi access point.
  2. One connects to the router via its WiFi access point, the other via Ethernet.
  3. Both connect to the router via Ethernet.

The router's WiFi access point uses the WPA or WPA2 protocol.

3

It is not secure at all.

Anything you transmit that is not encrypted can potentially be read in this scenario. Read up on the recent Firesheep snafu for an example of how this particular issue has been exploited recently.

The details of what can easily be accessed in your scenario will depend a bit of the make, model and setup of your networking equipment. How easy it is to trick such hardware into using a broadcast mode when sending out packets or setting up an eavesdrop on somebody else's channels varies widely, but as a rule of thumb it is usually possible to compromise any network you have physical access too.

Basically if you are an the same physical network and layer you should assume that you traffic can be observed by others on the same network and layer. This is part of the reason Windows prompts you when you connect to a new WiFi access point for whether the network is a shared public one or a private home or business network. In the later cases it can be assumed that the other machines that can see the traffic are friendlies and the guard will be lowed a little bit for things like file sharing and other networked services.

If you are on a shared network or connecting through any networks not in your direct and exclusive control, anything you do that you don't want in the open needs to be secured before it leaves your machine.

2

Whether they use Wifi or ethernet makes no difference, when trying to monitor traffic on the same LAN.

I don't know in how far other computers can see all network traffic for all other computers. I know that in the past, all packets were sent to all computers, but I believe nowadays routers or switches know to which computer a package should be send.

If the Wifi uses encryption, that doesn't matter for these cases. The encryption is only between the device and the router. Whatever network traffic is shared with other computers is shared after it has reached the router.

It is however not that difficult to crack wifi encryption by just picking up the wifi signal. This makes it possible to get the wifi password, and then login to it. If this makes it possible and easy to listen to (non ssl) traffic between laptop and router, I don't know.

  • 1
    Packages are routed to a specific IP these days, but you can also spoof it. You can sent special packages to distort this routing. owasp.org/index.php/Man-in-the-middle_attack en.wikipedia.org/wiki/ARP_spoofing – D. Schalla Jun 5 '14 at 13:01
  • 3
    Mac addresses (Layer 2) are used to direct packets on a local network. (IP addresses are looked at by routers and not hubs or switches). Hubs forward packets to everyone, switches only forward packets to the intended target (or ARP spoofed one) that the switch has learnt. Routers with built in wifi will almost certainly have switches and not hubs built into them. – Stu W Jun 5 '14 at 15:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.