03.05.01
Only a few years ago, the threat of a hacker being able to actually
intrude and affect a network was much less likely than today. Now,
with so many companies utilizing an internet presence, and so many
home and small office networks using always-on connections, hackers
now have literally millions of targets. As a demonstration
of some of the free tools available to hackers and the complexity of
such tools, I conducted a small experiment. I spent less than ten
minutes searching the internet before finding a powerful and
potentially malicious tool. Please read on and as always, if you have
any questions, or suggestions for topics for articles, let me know.
Jay Fougere
NetworkNewz Editor
Windows 2000 magazine has selected Panda Antivirus Platinum as the
best antivirus product on the market:
www.pandasecurity.com/ientry-platinuminfo.htm
Before we get started, I would like to say that today's article deals
with some sensitive security issues. In light of that, let me issue a
warning. The purpose of this article is for the education of Network
Engineers and System Administrators and is not meant to be a guide
for any illegal use. Before you install and run this type of
software, be sure that you have the proper authorization to do so.
Now that we have gotten that out of the way, let's see how easy it is
for a hacker to "sniff" packets on your network and what those
packets can reveal. This is just an overview and does not discuss
encryption; many sources on the internet cover different facets of
this topic and will even provide encryption algorithms, etc.
This discussion will focus around plain text information found in
the header of a network packet; however, one can imagine the
vulnerabilities that could be exposed by a hacker with knowledge of
encryption technologies.
First of all, what is a packet sniffer? A packet sniffer is a
combination of software and a network card (NIC) utilizing a special
driver. The result of this combination is the ability to read
information contained within all network packets traversing a local
subnet. The program that I am going to discuss is free and easy to
use. That is why you should be concerned. Anyone with limited network
knowledge and access to your network can utilize these tools to
effectively strip network packets of potentially sensitive data
while remaining undetected, unless you have installed software
somewhere on the network aimed at detecting such intrusions. There
is also available software that will hide promiscuous sniffers from
sniffer detecting software.
Another interesting point to keep in mind is that often times a
hacker will install this type of software on a machine on your
network that has already been compromised by a program such as
Back Orifice. This way he can scan your local subnet from afar by
using your own machine(s) against you. Once a series of packets (or a
"capture") have been captured, the intruder can then send the
capture to himself via email or a free "X-drive" on the internet.
Once the hacker has the capture, he can then utilize decryption
technologies to translate encrypted information on his own system.
Once the hacker has one Administrator or Root password your entire
network has been compromised.
I understand that Network Monitor, which is packaged with Windows
2000, can reveal much the same information as the scanner I found.
My argument is that few people have access to Network Monitor while
anyone with an internet connection has access to the scanner program.
Also, I found this program to be easier to use than Network Monitor.
The first thing that we need to do is obtain the software and the
packet driver. The packet driver is a specialized network driver
that will let your NIC operate in promiscuous mode. Promiscuous mode
is a mode in which the network card will listen to all network
traffic on a subnet and has the ability to "capture" all packets
traversing that subnet. The program that I will be discussing is
called analyzer.exe, was written by Piero Viano, and can be found
here.
While you are there do not forget to pick up your packet driver.
Most of the documentation on the program is written in Italian,
however it is intuitive enough so that documentation should not be
necessary.
