1. Password Cracking, Network Sniffing, Man-in-the-Middle attacks, and Virtual Private Networks Lab 2 – Class Discussion Group 3 Ruhull Alam Bhuiyan Keon Copeland Group 4 Scott McCans Peter Mehravari

2. Outline Password Cracking Network Sniffing Man-in-the-Middle Virtual Private Networks

3. Password Cracking Efficient against weak passwords, takes matter of seconds For strong passwords, large amounts of time and processing power needed Brute force only logical way to break passwords (and luck) Be aware of key loggers

4. Defense – Password Cracking Avoid short common dictionary words apple, sheep, window, etc. Avoid common passwords password, passwd, abc123 Should be long (at least 8 characters) and contain numbers, letters, and symbols

5. Sniffing HTTP and FTP easy to sniff, not a secure connection SSH uses a secure connection, sniffed packets unreadable Easy to sniff TCP sessions using Ethereal or similar applications

6. Defense – Sniffing Detecting Sniffers Check local host by running ifconfig, if RUNNING PROMISC machine is in promiscuous mode (which usually indicates a sniffer) Utilities such as ARPwatch, monitor ARP caches to look for duplicates Intrusion Detection Systems which monitor ARP spoofing on a network Sniffing is very hard to detect usually until too late Sumit Dhar, Sniffers Basics and Detection, http://www.rootshell.be/~dhar/downloads/Sniffers.pdf,, dharvsnl@yahoo.com

7. Defense – Sniffing Prevention Use encryption programs for all Internet traffic Secure Socket Layers Transport Layer Security Secure Shell (SSH) Tunnel Use switch networks instead of Hubs, packets not visible at every node of network Anti-sniffing tools: Anti Sniff, Neped, Snort

8. Man-in-the-Middle: How it Works Application (Ettercap) sends out ARP messages with wrong MAC address Causes traffic to go through third party host Sender/Receiver don't know about the third party

9. Man-in-the-Middle: Threats Acts as a sniffer Can drop traffic for specific ports Can hijack existing connections

10. Defense – Man in the Middle Detection Traceroute for extra hops most likely will not work Different ARP responses from one computer Increase in RTT of packets possible?

11. Defense – Man in the Middle Prevention Manually enter ARP entries Firewall to prevent initial setup of Man in the Middle

12. Virtual Private Networks (VPN) Uses key to create secure connection All traffic between VPN hosts is secure Allows secure use of insecure protocols Hosts appear to be on same subnet

13. Defense – VPN Use secure method to transfer keys Check for man-in-the-middle