Re: [cobalt-security] re: Telnet security

[Frank Smith <fsmith@xxxxxxxxxxx>]

--On Wednesday, April 25, 2001 08:05:33 -0500 "William P. N. Smith" <wpns@xxxxxxxxxxxxxxx> wrote:

> Reinoud van Leeuwen wrote:
> > If you login through *telnet* over a public network, you have a lot to worry
> > about! Telnet is so insecure, people can just sniff your password to get
> > into your box... (no hacking needed)
>
> Which people are those who can sniff your password?  Network administrators
> and such, but how does an 'ordinary' user watch theinternet promiscuously?
  You can't sniff "the Internet" but you can certainly sniff pieces of it.
At the server end it can be a little difficult, especially if it is fully
switched (no hubs).  Even then you could crack a router or managed switch, or
crack another box on the same subnet and install software to hijack the
target IP, sniff the traffic for passwords, and forward the traffic to the
original IP so no one notices. (If you want to prevent this, program your
switch to lock port/MAC pairs and run something like arpwatch to alert you
of any changes to MAC/IP relationships).
  On the client end it is much easier, especially now that cable modems are
proliferating and many people can now sniff the traffic of 200 of their
neighbors.


Frank

--
Frank Smith                                                fsmith@xxxxxxxxxxx
Systems Administrator                                     Voice: 512-374-4673
Hoover's Online                                             Fax: 512-374-4501