Re: [aclug-L] Security Question: How safe is it?

[Jeremy Johnstone <jsjohnst@xxxxxxxxxxx>]

Kinda weird to reply to my own reply but had one last thought I forgot to
mention:

This issue / scenario just happens to be why I refuse to ever by a cable
modem if they become available any time this or next millenium. On cable
modems everyone in your neighborhood (maybe larger) is on the same
"network segment" and any can snoop anyone else's packets with the right
knowledge or software. Also, everyone shares the same bandwidth so if
everyone in you neighborhood jumps on the bandwagon and gets a cable modem
then there goes the bandwidth. (In some test markets with high usage the
segments have gotten so bogged down that people where reporting
throughputs of less than 1k during peak usage, might as well go back to
a 14.4 if your gonna get that crappy of speeds, IMHO)

Jeremy

On Tue, 29 Sep 1998, Jeremy Johnstone wrote:

> Then you come across the people who argue "Security by obscurity is no
> security at all" I agree with both sides. The chances of someone actually
> intercepting your password are slim to none. Then again, using Linux, it
> is real (and I mean real) easy to write a packet sniffer that will log
> every packet (i sure hope you have a fast and big i/o subsys if its a
> busy network) to your drive then at you leisure you can run a script that
> goes through and awk/sed/grep's the info you wanted. It's actually really
> easy, but the thing saving the world (or so we hope), is that most people
> either don't have the knowledge to implement the afore mentioned method or
> that they don't have root access to a 'Nix box on your segment. 
> 
> Jeremy
> 
> P.S. 
> Basically the above method is how the caught "world hacker" Kevin Mitnick.
> They logged all packets going through Netcom (real big shitload of them)
> and grep/sed/awk 'ed them to death until the could follow a pattern of
> attacks and locations. (unfortunately they used sparc servers and laptops
> not linux boxes, oh well their loss).
> 
> 
> On Tue, 29 Sep 1998, Bob Deep wrote:
> 
> > Jeremy Johnstone wrote:
> > > 
> > > True, but don't both ends have to support it at a system level? Otherwise,
> > > if you only have it in your bin dir in your personal account you will have
> > > to login insecurely then start it up and then login securely. OR am I
> > > flawed somewhere?
> > > 
> > 
> > Ah yes... The Chicken and egg thing..  Even if this was a new service,
> > the encoding of passwords would have to be well known in advance, so
> > even then the sending of the password would be risky, even if it was
> > encoded some how.
> > 
> > This is an interesting issue of security.. I wonder how many folks,
> > sitting at their home computer, would be routed traffic that contained
> > such information from their ISP?
> > 
> > Further, assuming somebody actually had a direct attachment to a segment
> > of the backbone, how much password information they could filter out of
> > the data stream...   Consider that they would only be able to see
> > traffic on that specific segment and that you need three pieces of
> > information to log into a computer....
> >     1.  The IP address of the host (or the host name to look up the IP).
> >     2.  A valid user name,
> >     3.  The password for that user name.
> > 
> > Getting a socket connection requires quite a number of packets, which
> > would all have to be intercepted to be sure to get all the required
> > information to monitor the connection.  Then you must be able to
> > interpret the service to sniff out a user name and password... How
> > easily can this be done?  It does not sound very easy, and it is limited
> > to traffic on the local network segment to start with...
> > 
> > I don't mean to suggest that there is no danger, but that sending
> > passwords in the clear is not as risky as some would lead you to
> > believe.  There is an element of security when you can "hide in the
> > crowd" of data flowing around.  It's not totally effective, but is it
> > good enough?
> > 
> > -= bob =-
> > ---
> > This is the Air Capitol Linux Users Group discussion list.  If you
> > want to unsubscribe, send the word "unsubscribe" to
> > aclug-L-request@xxxxxxxxxxxx.  If you want to post to the list, send your
> > message to aclug-L@xxxxxxxxxxxx.
> > 
> 
> 

---
This is the Air Capitol Linux Users Group discussion list.  If you
want to unsubscribe, send the word "unsubscribe" to
aclug-L-request@xxxxxxxxxxxx.  If you want to post to the list, send your
message to aclug-L@xxxxxxxxxxxx.