Hot answers tagged

209

How does HTTPS work? HTTPS is based on public/private-key cryptography. This basically means that there is a key pair: The public key is used for encryption and the secret private key is required for decryption. A certificate is basically a public key with a label identifying the owner. So when your browser connects to an HTTPS server, the server will ...


92

If what you describe is true, your chat room is designed badly. The view of the server and what packets it receives should be forwarded to other users should be independent from whatever packets are coming in or going out. Manipulating the traffic on a client should only interfere with that client's view of the chat room, never with other clients. If you ...


55

Yes they can but unless your neighbor has the required technical expertise, its highly doubtful. To view incoming and outgoing traffic you need specific software to monitor network packets and the tech knowledge to actually do it. Most routers only keep a syslog and unless they are using software like wireshark to monitor/capture your packets, they cannot ...


50

Monitor mode: Sniffing the packets in the air without connecting (associating) with any access point. Think of it like listening to people's conversations while you walk down the street. Promiscuous mode: Sniffing the packets after connecting to an access point. This is possible because the wireless-enabled devices send the data in the air but only "mark" ...


50

The short answer: use better chat room software. Your question is lacking details about what kind of chat room program you're using. I am going to assume that it's either a simple client-server model, or a direct peer-to-peer. Either way, you have a sender who types and sends a message, and a receiver (either another client, or a centralized server). From ...


47

If you get a VPN and use that for browsing, that will hide all your traffic from both your neighbour and their ISP.


40

The entire point of SSL is its resistance to eavesdropping by man-in-the-middle attacks like the one you're proposing. If you cannot make the client device trust your self-signed certificate, then your only options are: Intercept an initial HTTP request and never let the communication be upgraded to HTTPS (but this will not work if the if the client ...


33

For telecommunications, check out GSM, CDMA, TDMA, and EDGE. The two competing protocols in the United States are GSM and CDMA. The resources linked below are lacking when it comes to CDMA, but using site:defcon.org and site:blackhat.com in your Google searches will turn up some presentations. For interception of GSM, I refer you to a white paper ...


30

What about using tor? Keep in mind that your speed will be affected. As other people said, using any private mode in your browser is not going to be of any help. EDIT : The slowdown heavily depends on the network topology, the number of nodes, how much traffic the nodes are handling and what you are downloading. Here you can find some explanations about ...


27

When you feel your local computer network is insecure, there are five main approaches. Ensure that your computer and the destination computer use encrypted network protocols. (e.g. IPSEC) This encrypts any and all traffic from your machine to the destination machine over the whole of it's journey. Establish an encrypted tunnel between your computer and a ...


25

Yes they can actually. What it boils down to is that they can see which websites you are running by looking at: Clear HTTP traffic DNS requests sent One thing you could do is purchase an encrypted VPN and run all your internet traffic through the VPN. This way your neighbours will not be able to see what you are doing.


25

Your question is lacking detailed description of what's going on. Therefore, it's impossible to solve the problem you described. However, it might be helpful to point out a different one. If what you described is true, that isn't your problem. Your problem is a much bigger one. Namely that you trust the user. Never trust the user! I assume that you tell ...


23

If an attacker has the password, then they could, for example, use Wireshark to decrypt the frames. (Note, however, there's no need to have a WEP password since it is a completely broken security algorithm. WEP keys can be extracted from the encrypted traffic by merely capturing enough packets. This usually only takes a few minutes. Also, keep in mind ...


22

Most likely yes, but it depends Much like PATA, SCSI, and Ethernet devices, USB devices don't directly connect to the computer. They connect to a Host Controller that manages all signaling and communication. All ports are connected to something called a Root Hub, and to each Root Hub you may connect other hubs and subsequently more hubs. Each of these hubs ...


21

You can't. It doesn't matter whether the wifi is encrypted or not: you can't know whether the access point is trustworthy. A WPA2 access point with a strong password doesn't help when the access point itself is a rogue access point put up by someone who may or may not be the café or hotel owner. And yes, it happens — people put up open access points with ...


19

Assuming that users do not click through cert warnings (and assuming that you are running an unmodified client), the answer is: No, the proxy cannot decrypt the data. For a detailed explanation of how HTTPS prevents a man-in-the-middle from decrypting your traffic, see any standard resource on SSL/TLS, e.g., How is it possible that people observing an ...


19

From Philipp C. Heckel's tech blog with some light edits: While attacking unencrypted HTTP traffic can be done without having to deal with X.509 certificates and certificate authorities (CA), SSL-encrypted HTTPS connections encrypt every request and response between client and server end-to-end. And because the transferred data is encrypted with a shared ...


19

Your case is common in the corporate world, it is usually described as corporate MiTM. When you connect to the Internet from inside your network, you're likely connecting to a gateway/router the belongs to your company first. That router can simply hand you public key in a "fake" certificate whenever you connect to an SSL-enabled site and fool your browser ...


19

Sniffing and snooping should be synonyms. They refer to listening to a conversation. For example, if you login to a website that uses no encryption, your username and password can be sniffed off the network by someone who can capture the network traffic between you and the web site. Spoofing refers to actively introducing network traffic pretending to be ...


18

Promiscuous Mode: Capture packets on a network that you have connected to. This is likely what you need to be in if you want to analyze packets (Wireshark, tcpdump, etc.) Monitor Mode: Capture packets regardless of connected network. No association to AP needed (and no authentication). Because it is not connected to a network, you can't process the ...


16

Capturing packets already produces an output file (a capture file, actually) which includes packet contents, timing information, headers, etc. If you want to separate these packets into individual streams, a program like wireshark can do the appropriate searching and filtering for you. It can even decrypt SSL/TLS traffic if you have the certificate key. If ...


16

Sniffing and recording the signal is certainly doable, since that's what both cell phones and base stations do all day long. Now the tricky point is that communications are encrypted, and decrypting the data from the outside can prove tricky. "3G" is a wide term, but (normally) 3G communications use the block cipher KASUMI. The best known cryptanalytic ...


13

Machines create noise that maybe be detected by an attacker. If this noise undermines a physical cryptosystem then its called a side channel attack which is a very interesting and diverse research topic. Like it or not, passwords are the gold standard and the human interface devices we use are very noisy. The electromagnetic noise produced by typing on ...


13

Like any other secured communication, it could be possible to decode the GSM/CDMA wireless traffic; question is how tough it is and how much infrastructure cost is required to decode them. Coming to a simple answer though much details and analysis have already been posted here, it is difficult to intercept them because: There exist a secure element in the ...


13

There has been some work done that I've heard of like anti-sniff, which looks to detect machines in promiscuous mode using timing information. The idea being that machines in promiscuous mode will have to process all packets that they see so if there are large amounts of traffic that need processed the system will be busy and slower to respond to directed ...


13

It is possible to sniff packets on unswitched ethernet or wifi completely passively. Tools like the Throwing Star Lan Tap make this even easier. In this passive case, there is nothing you can really do about it. However if you are on a switched lan, any sniffer would have to start poisoning ARP caches, even if only on the switch. This is something that you ...


13

In a WiFi network, all information which is sent over the network is broadcasted over the air. Usually network interfaces are configured to just ignore any network traffic not addressed to them, but there are tools available which change them to "promiscuous mode" which allows them to also log and show any traffic which they receive even though it is ...


13

With new versions of wireshark: Make sure the traffic is decoded as SSL, i.e. setup the SSL analyzer for this TCP stream in Analyze >> Decode As. Now it will show the SSL details for the packets. Pick the packet which contains the certificate, in this case packet 6. In the packet details expand Secure Socket Layer etc until you get to the certificate ...


12

If I'm using websites that do not use HTTPS, but I'm on a WEP-protected Wi-Fi network, are my cookies safe from being sniffed by third-parties? No. Outsiders can crack WEP networks almost as if they weren't encrypted at all, these days. Insiders have even more ease of access. Even on WPA/WPA2 networks, there are still exploits that enable insiders to ...


11

When my laptop is using a network I don't control (basically anything that's not home) it wears pretty red socks to reroute all traffic into the SOCKS5 proxy built into OpenSSH and then to a server I rent anyways for my website to protect my traffic. You can use tor as well but I intensely dislike tor (for reasons off topic here). This is the socks_up ...


Only top voted, non community-wiki answers of a minimum length are eligible