From: Brian Berg <brianberg@xxxxxxxxx>
Date: November 7, 2005 2:01:22 PM PST
To: Dewayne Hendricks <dewayne@xxxxxxxxxxxxx>
Subject: A constant state of insecurity
FYI. Brian
A constant state of insecurity Passwords are in the air, and it
isn't even spring
Security Adviser, By Roger A. Grimes
November 04, 2005
For the past few months an acquaintance of mine has been sniffing
various public wireless and wired networks around the world,
looking to see what plain text passwords are visible. It was an eye-
opening experiment.
She used a bunch of different tools, but mostly Cain. At the
moment, it collects 18 different passwords or password
representations, including plain text passwords sent over HTTP,
FTP, ICQ, and SIP protocols, and will automatically collect the
user's log-in name, password (or password representation), and
access location.
Other than a few simple validity reviews and summary counts, my
friend doesn't look at the log-in names or passwords, and she
deletes any collected information after obtaining the counts. She
hasn't used ARP (Address Resolution Protocol) poisoning or done
anything other than to count plain text passwords passing by her
traveling laptop's NIC when she's in a hotel, airport, or other
public network.
Although some -- including me -- might question her ethics, the
information she shared is useful in understanding our true state of
insecurity.
She said about half the hotels use shared network media (i.e., a
hub versus an Ethernet switch), so any plain text password you
transmit is sniffable by any like-minded person in the hotel. Most
wireless access points are shared media as well; even networks
requiring a WEP key often allow the common users to sniff each
other's passwords.
She said the average number of passwords collected in an overnight
hotel stay was 118, if you throw out the 50 percent of connections
that used an Ethernet switch and did not broadcast passwords.
The vast majority, 41 percent, were HTTP-based passwords, followed
by e-mail (SMTP, POP2, IMAP) at 40 percent. The last 19 percent
were composed of FTP, ICQ, SNMP, SIP, Telnet, and a few other types.
More at:
<http://www.infoworld.com/article/05/11/04/45OPsecadvise_1.html>