Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Shark on the Network

blog.nodenexus.com

Post reply on HN
Print view View original

41–50 of 54 posts

Re: A Shark on the Network

#41

Post by bluedino »

spydum wrote: post #40
nerd2 wrote: post #4

"If you’re wondering why the network card has access to all messages on the network, consider that you need to see every message in order to determine which ones you are supposed to receive." Whuuut

This is how Ethernet works. Wireless is somewhat similar to a hub vs a switch. The spectrum is mostly a shared medium, just like 10baseT networks, or Ethernet hubs.

People forget this. You can make your wireless AP as secure as you want, but if we're plugged into the same node with our cable modems, you can just run a regular packet sniffer with ARP poisoning and see all the traffic to your neighbors. Not sure if that works with DSL connections or not.

Re: A Shark on the Network

#42

Post by breakall »

lelandbatey wrote: post #20
leeber wrote: post #16

I'm always connected to a VPN that I set up on throwaway cloud servers from AWS, digitalocean, or whatever your preference is. Even on my phone. So all you'd see from me is encrypted stuff being sent to a random IP address.

How do you do this?

Digital Ocean has a great tutorial on setting up OpenVPN [1]. I've used this and gotten decent latency and good throughput over both broadband and LTE service using a small ($5/month) VPS.

1. https://www.digitalocean.com/community/tutorials/how-to-inst...

Re: A Shark on the Network

#43

Post by [deleted] »

nodata wrote: post #33
na85 wrote: post #13

Earlier quoted context omitted.

>What am I missing? Encryption. Your neighbours hopefully have protected their wifi with a password. This prevents casual snooping but of course can't really keep out a dedicated attacker. There are automated tools to break WPA encryption. Additionally, if your neighbours are browsing using SSL/TLS then you theoretically cannot eavesdrop on those sessions.

You'd see their dns lookups.

[deleted]

Re: A Shark on the Network

#44

Post by noselasd »

nodata wrote: post #33
na85 wrote: post #13

Earlier quoted context omitted.

>What am I missing? Encryption. Your neighbours hopefully have protected their wifi with a password. This prevents casual snooping but of course can't really keep out a dedicated attacker. There are automated tools to break WPA encryption. Additionally, if your neighbours are browsing using SSL/TLS then you theoretically cannot eavesdrop on those sessions.

You'd see their dns lookups.

If the WiFi uses encryption, DNS is encrypted too.

Re: A Shark on the Network

#46

Post by ptaffs »

nisa wrote: post #19
stinos wrote: post #17

Earlier quoted context omitted.

Are you saying if the neighbours use an encrypted connection it makes it impossible to just look at packets and see for which host they are or where they are coming from - i.e. the XKCD example as given doesn't work then anymore?

If they use WPA/WPA2 the WiFi signal is encrypted so can't see anything without the key. You can make assumptions about the traffic volume and the involved machines but the data is insivisible. If you are able to get the key or they use no encryption or WEP you can look at the packets and get metadata for SSL sessions and all unencrypted traffic.

agree and adding: i recently learned the Key is different to the password to associate, ie you must capture the session key exchange when each client device joins the network, it's not just enough to know the network's passphrase. If you know the passphrase and capture the key exchange, then you can decrypt traffic. My local coffee spot runs a public/guest WPA network, even though we all know the passphrase, even plain text traffic is moderately secure. I guess forcing a key-exchange is possible, but just sharing what i recently learned. I think it's called EAPOL. https://en.wikipedia.org/wiki/EAPOL

Re: A Shark on the Network

#47

Post by deathanatos »

geoah wrote: post #14

The author seems to be making the assumption that the "target" is an unencrypted network. They provide no information on wireless network security and its effects on the attack and the conditions that need to be met for someone to be able and perform it. Protected networks require more effort depending on the method used, WEP is utterly broken, WPA/WPA2 can be broken but require considerably more effort and processin…

> WPA/WPA2 can be broken but require considerably more effort and processing power.

Can to elaborate? Aside from brute force attacks, my understanding is that WPA2-PSK using AES is secure.

Re: A Shark on the Network

#48

Post by at-fates-hands »

einrealist wrote: post #15
geoah wrote: post #14

The author seems to be making the assumption that the "target" is an unencrypted network. They provide no information on wireless network security and its effects on the attack and the conditions that need to be met for someone to be able and perform it. Protected networks require more effort depending on the method used, WEP is utterly broken, WPA/WPA2 can be broken but require considerably more effort and processin…

There are many unencrypted networks around: hotels, cafes, hotspots at airports and train stations, inside trains and planes and even cities start to provide their own wireless networks. And I expect less than 10% of the regular users to use VPNs or to keep track of only using HTTPS (or secure connections on other protocols).

Also keep in mind a lot of people have their phones/laptops set to join any available wireless networks without asking them, making a spoofing attack a lot more easier.

Re: A Shark on the Network

#49

Post by spydum »

bluedino wrote: post #41
spydum wrote: post #40

Earlier quoted context omitted.

This is how Ethernet works. Wireless is somewhat similar to a hub vs a switch. The spectrum is mostly a shared medium, just like 10baseT networks, or Ethernet hubs.

People forget this. You can make your wireless AP as secure as you want, but if we're plugged into the same node with our cable modems, you can just run a regular packet sniffer with ARP poisoning and see all the traffic to your neighbors. Not sure if that works with DSL connections or not.

Mostly not possible. DSL has multiple deployment modes PPP (over Ethernet or ATM), Bridged, and routed-bridge encapsulation (RBE).

The upstream router at the ISP is usually connected to an ATM or Frame Relay link, where they create virtual circuits to the DSLAM for each customer/modem (DSLAM is the last "network" device between your DSL modem and the telco -- it's the thing doing the Analog/Digital conversion from ATM/FR/Ethernet to electrical signals on the copper pair).

Since DSL works over a copper pair (phone lines), and you already know phone lines are not shared with your neighbors, there is no chance in intercepting your neighbors traffic over DSL, without someone physically splicing.

However, when ISP router is in plain bridge mode (i doubt anybody does this any longer, RBE so much more effective), there is possibility that the router floods packets for addresses it doesn't know, just like a switch does when it doesnt know where a certain MAC address is. This would broadcast that frame out across all the "virtual circuits". Most DSL modems would then also filter this, so unlikely you would still be able to observe it, unless you had control over the DSL modem/bridge itself.

Re: A Shark on the Network

#50

Post by peterwwillis »

leeber wrote: post #16

I'm always connected to a VPN that I set up on throwaway cloud servers from AWS, digitalocean, or whatever your preference is. Even on my phone. So all you'd see from me is encrypted stuff being sent to a random IP address.

Assuming I wasn't a state actor and just a lowly hacker on a wifi connection, here's some things I can tell about your VPN'd connection:

* The operating system used * Application-specific traffic patterns * Content-specific traffic patterns * The VPN provider and type

First off, I know you're using a phone, because it matches mobile device tcp/ip fingerprints. Second, I can make a reasonable guess about what kind of VPN you're using, both based on the service itself and its traffic or connection pattern. Third, I can make a guess about what kinds of applications you're using, because you are using a phone and the traffic looks a certain way for certain network applications. Fourth, I can guess what kind of content you're looking at, since I have a good idea what kind of browser and application you're using. Fifth, if I can match up all those fingerprints each time, I can identify you as the sole user of that connection, meaning I can now track you whenever I see your traffic. Sixth, by manipulating your traffic in small ways I can also determine more about your host and application(s) by how they respond to network transmission problems.

Based on all that, I can send you a phished e-mail that looks to exploit any of the services or hosts or applications you're using. I don't even need to know who to e-mail; I can just spam tons of addresses and check for results that match the fingerprinted services I discovered earlier.

Another fun attack would be to actually kill every connection you tried to make over a VPN using a specific application and content provider; because it would never work over the VPN, you might eventually try it over your regular connection, giving me a new point of attack.

Hacking is fun!

Post reply on HN