A Shark on the Network • Hacker News Board

Re: A Shark on the Network

#31

Post by mbrownnyc » Tue, Dec 02, 2014, 11:20 AM UTC

abalone wrote: post #24

Can somebody explain all the brown on that HostShark circle gif? Looks like >90% of the requests are going to xo.net, an ISP. http://blog.nodenexus.com/assets/img/hostshark.gif

DNS?

Re: A Shark on the Network

#32

Post by fensipens » Tue, Dec 02, 2014, 11:22 AM UTC

cranklin wrote: post #26

"A Shark on the Network" is more appropriate than "How to listen in on wireless network traffic" for this particular post. If it's a "how to listen in...", I would expect the article to introduce better passive attacks (in monitor mode) and raw packet injection attacks that don't require you to be associated to a particular access point, and finally the different wifi chipsets that allow you to perform these types of…

This.

I was hoping to read some recommendations on chipsets that are able to monitor multiple channels simultaneously.. but then it was just another misleading headline.

Re: A Shark on the Network

#33

Post by nodata » Tue, Dec 02, 2014, 12:04 PM UTC

na85 wrote: post #13

Kiro wrote: post #7

So I don't know anything about this stuff but looking at the XKCD example it looks really easy to see virtually everything my neighbours are doing on the web. What am I missing? Or is it really this insecure to use wireless?

>What am I missing? Encryption. Your neighbours hopefully have protected their wifi with a password. This prevents casual snooping but of course can't really keep out a dedicated attacker. There are automated tools to break WPA encryption. Additionally, if your neighbours are browsing using SSL/TLS then you theoretically cannot eavesdrop on those sessions.

You'd see their dns lookups.

Re: A Shark on the Network

#34

Post by justquest » Tue, Dec 02, 2014, 12:22 PM UTC

geoah wrote: post #27

justquest wrote: post #18

This is pretty standard wireshark stuff; showing data that was on an unencrypted network. What I've been wondering about for a while now is, can wireshark show data on an encrypted network, assuming it has the key? Can wireshark take a known WEP/WPA2 key and use it to decrypt the packets on an encrypted network on the fly? I haven't found any CLI's or GUI's that have been able to do this out of the box. But surely so…

You can decrypt keys in wireshark once you have the key, you can also provide a key to wireshark to decrypt streams on the fly using said key. http://wiki.wireshark.org/HowToDecrypt802.11

Thanks, I'd been wondering this in the back of my head for a while, last time I searched for some reason I couldn't find much.

edit: Now that I see the wiki, I remember correctly that the version of Linux I was using didn't work with this feature in the GUI. Maybe I'll look for the CLI version again soon.

Re: A Shark on the Network

#35

Post by Kiro » Tue, Dec 02, 2014, 12:51 PM UTC

nodata wrote: post #33

na85 wrote: post #13

Earlier quoted context omitted.

>What am I missing? Encryption. Your neighbours hopefully have protected their wifi with a password. This prevents casual snooping but of course can't really keep out a dedicated attacker. There are automated tools to break WPA encryption. Additionally, if your neighbours are browsing using SSL/TLS then you theoretically cannot eavesdrop on those sessions.

You'd see their dns lookups.

So basically I can see if my neighbours are surfing on porn sites regardless of WPA or SSL/TLS?

Re: A Shark on the Network

#36

Post by icebraining » Tue, Dec 02, 2014, 1:00 PM UTC

Kiro wrote: post #35

nodata wrote: post #33

Earlier quoted context omitted.

You'd see their dns lookups.

So basically I can see if my neighbours are surfing on porn sites regardless of WPA or SSL/TLS?

Regardless of WPA, no. Regardless of SSL/TLS, yes.

Re: A Shark on the Network

#37

Post by chopin » Tue, Dec 02, 2014, 1:01 PM UTC

Kiro wrote: post #35

nodata wrote: post #33

Earlier quoted context omitted.

You'd see their dns lookups.

So basically I can see if my neighbours are surfing on porn sites regardless of WPA or SSL/TLS?

If you break their WPA, then yes, you can see which servers they connect to. For your purpose that possibly would be enough to know.

Re: A Shark on the Network

#38

Post by icebraining » Tue, Dec 02, 2014, 1:01 PM UTC

stinos wrote: post #21

nisa wrote: post #19

Earlier quoted context omitted.

If they use WPA/WPA2 the WiFi signal is encrypted so can't see anything without the key. You can make assumptions about the traffic volume and the involved machines but the data is insivisible. If you are able to get the key or they use no encryption or WEP you can look at the packets and get metadata for SSL sessions and all unencrypted traffic.

the data is insivisible And that includes source/destination IP? Didn't know that..

Yes, sure. All they can see is the AP you're talking to; everything "above" is encrypted.

Re: A Shark on the Network

#39

Post by icebraining » Tue, Dec 02, 2014, 1:02 PM UTC

mschuster91 wrote: post #22

What bothers me is that neither the author nor anyone here metioned that HTTPS does leak metadata in the form of the SNI extension which provides the server with the requested host before the cert exchange.

And even without SNI (e.g. IE on XP), there must be only one SSL site hosted on that particular IP, so the attacker can just connect to it and see what site (s)he gets.

Re: A Shark on the Network

#40

Post by spydum » Tue, Dec 02, 2014, 1:03 PM UTC

nerd2 wrote: post #4

"If you’re wondering why the network card has access to all messages on the network, consider that you need to see every message in order to determine which ones you are supposed to receive." Whuuut

This is how Ethernet works. Wireless is somewhat similar to a hub vs a switch. The spectrum is mostly a shared medium, just like 10baseT networks, or Ethernet hubs.