Re: Unencrypted password security question. at a major university
From: Alex (alex.ferguson@NOSPAMdartmouth.edu)
Date: 04/08/03
- Previous message: Kent Smith: "Re: Unencrypted password security question. at a major university"
- In reply to: Kent Smith: "Re: Unencrypted password security question. at a major university"
- Next in thread: Michael Janke: "Re: Unencrypted password security question. at a major university"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
From: "Alex" <alex.ferguson@NOSPAMdartmouth.edu> Date: Mon, 7 Apr 2003 19:25:44 -0400
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
It is possible sometimes, if not all the time or most of the time, to capture traffic on your subnet of a switched lan. Check out Dug Song's dsniff suite, particularly arpspoof. Used with fragrouter the tool is a kiddie-friendly way to trick a target into sending all its packets to you instead of the gateway. Fragrouter or your kernel can then forward everything to its correct location so the victim is none the wiser. I've only tried this against a linksys router as I'm a little worried about tripping an IDS at my college, but it did work where I tested it. Anyway, moral of the story is that (3) doesn't save you, necessarily.
- --Alex
On Mon, 07 Apr 2003 22:42:07 GMT
Kent Smith <ksmith@ipsoinc.com> wrote:
> It is bad, but not as bad as you think it is. Yes, the userid and
> password are sent in cleartext across the network, but the network is
> almost certainly segmented, and may even be fully switched. This
> means that it would not be easy for someone to snoop your traffic
> unless (1) they were on the same subnet as you were when you were
> sending this unencrypted data, (2) were running a packet sniffer, and
> (3) the concentrator into which your PC is plugged was a non-switching
> one.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (OpenBSD)
iD8DBQE+kgj4DryxAoSMgO8RAlPbAJsFlUSBliN6aVIYtTko7GMU7c6gDACfdbJj
RPMPZlYTEDSgMc4RH2F971c=
=gNkj
-----END PGP SIGNATURE-----
- Previous message: Kent Smith: "Re: Unencrypted password security question. at a major university"
- In reply to: Kent Smith: "Re: Unencrypted password security question. at a major university"
- Next in thread: Michael Janke: "Re: Unencrypted password security question. at a major university"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
