Hot answers tagged

92

If what you describe is true, your chat room is designed badly. The view of the server and what packets it receives should be forwarded to other users should be independent from whatever packets are coming in or going out. Manipulating the traffic on a client should only interfere with that client's view of the chat room, never with other clients. If you ...


57

Yes they can but unless your neighbor has the required technical expertise, its highly doubtful. To view incoming and outgoing traffic you need specific software to monitor network packets and the tech knowledge to actually do it. Most routers only keep a syslog and unless they are using software like wireshark to monitor/capture your packets, they cannot ...


53

Monitor mode: Sniffing the packets in the air without connecting (associating) with any access point. Think of it like listening to people's conversations while you walk down the street. Promiscuous mode: Sniffing the packets after connecting to an access point. This is possible because the wireless-enabled devices send the data in the air but only "...


50

The short answer: use better chat room software. Your question is lacking details about what kind of chat room program you're using. I am going to assume that it's either a simple client-server model, or a direct peer-to-peer. Either way, you have a sender who types and sends a message, and a receiver (either another client, or a centralized server). From ...


48

If you get a VPN and use that for browsing, that will hide all your traffic from both your neighbour and their ISP.


42

The entire point of SSL is its resistance to eavesdropping by man-in-the-middle attacks like the one you're proposing. If you cannot make the client device trust your self-signed certificate, then your only options are: Intercept an initial HTTP request and never let the communication be upgraded to HTTPS (but this will not work if the if the client ...


31

What about using tor? Keep in mind that your speed will be affected. As other people said, using any private mode in your browser is not going to be of any help. EDIT : The slowdown heavily depends on the network topology, the number of nodes, how much traffic the nodes are handling and what you are downloading. Here you can find some explanations about ...


27

When you feel your local computer network is insecure, there are five main approaches. Ensure that your computer and the destination computer use encrypted network protocols. (e.g. IPSEC) This encrypts any and all traffic from your machine to the destination machine over the whole of it's journey. Establish an encrypted tunnel between your computer and a ...


26

Yes they can actually. What it boils down to is that they can see which websites you are running by looking at: Clear HTTP traffic DNS requests sent One thing you could do is purchase an encrypted VPN and run all your internet traffic through the VPN. This way your neighbours will not be able to see what you are doing.


25

Your question is lacking detailed description of what's going on. Therefore, it's impossible to solve the problem you described. However, it might be helpful to point out a different one. If what you described is true, that isn't your problem. Your problem is a much bigger one. Namely that you trust the user. Never trust the user! I assume that you tell ...


22

Most likely yes, but it depends Much like PATA, SCSI, and Ethernet devices, USB devices don't directly connect to the computer. They connect to a Host Controller that manages all signaling and communication. All ports are connected to something called a Root Hub, and to each Root Hub you may connect other hubs and subsequently more hubs. Each of these hubs ...


22

Sniffing and snooping should be synonyms. They refer to listening to a conversation. For example, if you login to a website that uses no encryption, your username and password can be sniffed off the network by someone who can capture the network traffic between you and the web site. Spoofing refers to actively introducing network traffic pretending to be ...


21

You can't. It doesn't matter whether the wifi is encrypted or not: you can't know whether the access point is trustworthy. A WPA2 access point with a strong password doesn't help when the access point itself is a rogue access point put up by someone who may or may not be the café or hotel owner. And yes, it happens — people put up open access points with ...


19

From Philipp C. Heckel's tech blog with some light edits: While attacking unencrypted HTTP traffic can be done without having to deal with X.509 certificates and certificate authorities (CA), SSL-encrypted HTTPS connections encrypt every request and response between client and server end-to-end. And because the transferred data is encrypted with a shared ...


19

Promiscuous Mode: Capture packets on a network that you have connected to. This is likely what you need to be in if you want to analyze packets (Wireshark, tcpdump, etc.) Monitor Mode: Capture packets regardless of connected network. No association to AP needed (and no authentication). Because it is not connected to a network, you can't process the ...


19

Your case is common in the corporate world, it is usually described as corporate MiTM. When you connect to the Internet from inside your network, you're likely connecting to a gateway/router the belongs to your company first. That router can simply hand you public key in a "fake" certificate whenever you connect to an SSL-enabled site and fool your browser ...


15

With new versions of wireshark: Make sure the traffic is decoded as SSL, i.e. setup the SSL analyzer for this TCP stream in Analyze >> Decode As. Now it will show the SSL details for the packets. Pick the packet which contains the certificate, in this case packet 6. In the packet details expand Secure Socket Layer etc until you get to the certificate ...


14

It is possible to sniff packets on unswitched ethernet or wifi completely passively. Tools like the Throwing Star Lan Tap make this even easier. In this passive case, there is nothing you can really do about it. However if you are on a switched lan, any sniffer would have to start poisoning ARP caches, even if only on the switch. This is something that you ...


14

There has been some work done that I've heard of like anti-sniff, which looks to detect machines in promiscuous mode using timing information. The idea being that machines in promiscuous mode will have to process all packets that they see so if there are large amounts of traffic that need processed the system will be busy and slower to respond to directed ...


13

When my laptop is using a network I don't control (basically anything that's not home) it wears pretty red socks to reroute all traffic into the SOCKS5 proxy built into OpenSSH and then to a server I rent anyways for my website to protect my traffic. You can use tor as well but I intensely dislike tor (for reasons off topic here). This is the socks_up ...


13

In practice, it depends on the router they're using (and, specifically, on the firmware it's running). Basically all home WiFi routers have the technical ability to log visited URLs, as long as their firmware includes such a feature (and it's not exactly a complicated one). The main questions are: whether the router firmware supports such a logging ...


13

In a WiFi network, all information which is sent over the network is broadcasted over the air. Usually network interfaces are configured to just ignore any network traffic not addressed to them, but there are tools available which change them to "promiscuous mode" which allows them to also log and show any traffic which they receive even though it is ...


11

Any suggestions? Is is doable? You need to own a certificate trusted by the device to intercept the traffic. How this can be achieved depends on how proper and open the certificate validation on the device is. The device might have a buggy or non-existing validation of certificates. This is typically No validation at all, in which case you could use any ...


9

One thing to realise is that you can't completely block what you kids do on the Internet and probably the best thing to do is to try and educate them on avoiding sites you think they shouldn't visit and also how to recognise dangerous situations (e.g. strangers looking to message them or meet up in real life). That said there are products which can help to ...


9

As you guessed, Facebook uses HTTPS, what that means is that requests to Facebook.com regardless of whether they are GET or POST requests are not sent over HTTP, instead they are sent over HTTPS in an encrypted form which the 'http' filter in Wireshark wont be able to display as regular HTTP requests. If you want to view the encrypted HTTPS traffic including ...


8

Right, the corporate network admins implement a man-in-the-middle attack against the TLS client with their own CA so that they can see what's leaving their network. They will probably have a device that will create a certificate on the fly that is valid for gmail.com when you visit gmail.com. The reason they do this isn't to play Dr. Evil, it's so they can ...


8

Depending on the configuration of the network that you're on, it may be possible for administrators to view the contents of HTTPS connections (and possibly VPNs). It is obviously possible to intercept traffic on the network, but the usual problem is that they can't issue valid certificates for all the sites that you visit, so you would see a lot of ...


8

If the system runs the sniffer, its interface will be in promiscuous mode. The test works like this: Send a ping with the correct IP address into the network but with a wrong mac address. The sniffing host will answer the ping packet, as it will receive every packet in promiscuous mode. There is a ready-to use script in nmap to support this detection. http:/...


8

Tools such as this SSL MITM proxy from Stanford can automatically generate certificates and provide an SSL-to-SSL cutover. You'll need to set the key used by the proxy to be trusted by your browser, but that will provide you with the ability to see the cleartext traffic that is leaving from your machine. While you can try to rewrite any HTTPS redirect ...


8

The NSS SSL Keylog file is a non-obtrusive way to extract SSL session keys from an application using the NSS library for SSL/TLS, but there is no standard way to do the same in all applications. (A generic approach would involve a man in the middle attack, but this is not really non-obtrusive.) The idea of the extracting session keys directly from the ...


Only top voted, non community-wiki answers of a minimum length are eligible