Elias N. Khan
Prof. Session
CRJ 115
7 December 2015
Packet Sniffers: A Bittersweet Software Packet sniffing software is a controversial subject and a double-edged sword. It can be used to analyze network problems and detect Internet misuse. But at the same time, it allows hackers and people with malicious intention to "sniff" out your password, get your personal information, and invade your privacy. That is also why securing and encrypting data is so important. In this paper, the definition of packet sniffing will be introduced and several functionality and possible uses of packet sniffers will be explained. Also, information on how to protect against sniffers and man-in-the-middle attacks will be provided. An example of a packet sniffer program, Wireshark, will be given, followed by a case study involving the restaurant chain Dave & Buster's, which will show the negative consequences that can occur when organizations are not aware of the threat of packet sniffing by hackers. A packet sniffer is "a computer program or a piece of computer hardware that can intercept and log traffic passing over a digital network or part of a network" (Connolly, 2003). Packet sniffers are known by alternate names including network analyzer, protocol analyzer or sniffer, or for particular types of networks, an Ethernet sniffer or wireless sniffer (Connolly, 2003). As binary data travels through a network, the packet sniffer captures the data and provides the user an idea of what is happening in the network by allowing a view of the packet-by-packet data (Shimonski, 2002). Additionally, sniffers can also be used to steal information from a network (Whitman and Mattord, 2008). Legitimate and illegitimate usage will be explained in later sections. Packet sniffing programs can be used to perform man-in-the-middle attacks (MITM). This type of attack occurs when "an attacker monitors network packets, modifies them, and inserts them back to the network" (Whitman, et al., 2008). For example, a MITM attack could occur when two employees are communicating by email. An attacker could intercept and alter the email correspondence between each employee, without either knowing that the emails had been changed. MITM attacks have the potential to be a considerable threat to any individual or organization since such an attack compromises the integrity of data while in transmission. Packet sniffing programs work by capturing "binary" data that is passing through the network, and then the program decodes the data into a human-readable form. A following step called "protocol analysis" makes it even easier for the data to be read. The degree of these analyses varies by individual packet sniffing program. Simple programs may only break down the information in the packet, while more complicated ones can provide more detailed information and analysis, for example, by highlighting certain types of data such as passwords that pass through the network ("Packet Sniffing", Surasoft.com, 2011). As for today's networks, switch technology is commonly used in network design. This technology makes it increasingly easy to set up sniffing programs on servers and routers, through which much traffic flows. In addition, there are already built-in sniffing modules being used in today's networks. For example, most hubs support a standard called Remote Network Monitoring (RMON). This kind of standard allows hackers to sniff remotely with the SNMP (Simple Network Management Protocol), used in most network devices, and only requires weak authentication. Network associates "Distributed Sniffer Servers" are used by many corporations. These servers are set up with passwords that are quite easy to guess or crack. In addition, computers with Windows NT system usually come with "Network monitoring agent," which also allows remote sniffing ("Packet Sniffing", ISS.net, 2011). Essentially, these sniffing programs are set up for the use of network administrators. However, the threat exists that hackers can gain access to the network and view the program logs. Packet sniffers capture all of the packets that travel through the point where the sniffer is located. For example, if the program was installed next to the server of an organization, the user could have access to all the data being transferred across the company through that server. Typical types of packets intercepted by attackers include the following:
SMTP (email): The attacker can intercept unencrypted emails ("Packet Sniffing", ISS.net, 2011).
HTTP (web): Web traffic information and history can be easily captured ("Packet Sniffing", ISS.net, 2011).
Telnet Authentication: Login information to a Telnet account can be intercepted ("Packet Sniffing", ISS.net, 2011).
FTP traffic: Access to an FTP account can be sniffed in clear text ("Packet Sniffing", ISS.net, 2011).
SQL database: Information from web databases is also vulnerable ("Packet Sniffing", ISS.net, 2011). Like any tool, a packet sniffer is a "double-edged sword" because it can be used for good or bad purposes (Orebaugh, Ramirez, and Beale, 2007). It can be used by security professionals to investigate and diagnose network problems and monitor network activity (Orebaugh, et al., 2007). Conversely, it can be used to eavesdrop on network traffic by hackers, criminals, and the like, who can use the data gathered for harmful purposes (Orebaugh, et al., 2007). Professionals such as system administrators, network engineers, security engineers, system operators, and programmers use packet sniffers for a variety of uses, including troubleshooting network problems, figuring out system configuration issues, analyzing network performance (including usage and bottlenecks), debugging during the development stages of network programming, analyzing operations and diagnosing problems with applications, and ensuring compliance with company computer usage policies (Orebaugh, et al., 2007). When an error occurs on a network or within an application, it can be very difficult for administrators to determine what exactly went wrong and how to correct the error. Many consider the packet sniffer to be the best tool for figuring out what is wrong with programs on a network (Neville-Neil, 2010). Examining packets as a starting point for solving problems is useful because a packet is the most basic piece of data and holds information, including the protocol being used and source and destination address (Banerjee, Vashishtha, and Saxena, 2010). Basically, at the packet level of analysis, nothing is hidden when all layers are visible (Neville-Neil, 2010). In addition to solving network communication problems, packet sniffers can help administrators plan network capacity and perform network optimization (Shimonski, 2002). A packet sniffer allows users to view data that travels over a network packet by packet (Shimonski, 2002). However, rather than having to examine each packet, the appropriate sniffer program will perform the analysis for the administrator. The tools are especially useful because depending on the packet sniffing program used, the packet data will appear in an easy-to-understand format. Packet sniffers can often generate and display statistics and analyze patterns of network activity (Shimonski, 2002). Data can appear in graphs and charts that make analysis and comprehension easy. Additionally, the network administrator can filter by selected criteria to capture only the relevant traffic rather than having to sort through irrelevant data (Shimonski, 2002). Knowing what programs and which users use the most bandwidth can help administrators manage resources efficiently and avoid bandwidth problems. Intruders maliciously and illegally use sniffers on networks for an innumerable number of things. Some of the most common are to capture clear text usernames and passwords, discover usage patterns of users, compromise confidential or proprietary information, capture voice over IP (VoIP) telephone conversations, map out a network's layout, and fingerprint an operating system (Orebaugh, et al., 2007). The previously listed uses are illegal unless the user is a penetration tester hired to detect such types of weaknesses (Orebaugh, et al., 2007). An intruder must first gain entry to the communication cable in order to begin sniffing (Orebaugh, et al., 2006). This means that he must be on the same shared network segment or tap into a cable along the path of communication (Orebaugh, et al., 2007). This can be done in many ways. Firstly, the intruder can be physically on-site at the target system or communications access point (Orebaugh, et al., 2007). If this is not the case, the intruder can access the system in a variety of ways. These include breaking into a certain computer and installing sniffing software that will be controlled remotely, breaking into an access point such as an Internet Service Provider (ISP) and installing sniffing software there, using sniffing software that is already installed on a system at the ISP, using social engineering to gain physical access to install the software, working with an inside accomplice to gain access, and redirecting or copying communications to take a path that the intruder's computer is on (Orebaugh, et al., 2007).
Intruders can use sniffing programs designed to detect certain things such as passwords and then use other programs to have this data automatically sent to themselves (Orebaugh, et al., 2007). Protocols that are especially vulnerable to such intrusion include Telnet, File Transfer Protocol (FTP), Post Office Protocol version 3 (POP3), Internet Message Access Protocol (IMAP), Simple Mail Transfer Program (SMTP), Hypertext Transfer Protocol (HTTP), Remote Login (rlogin), and Simple Network Management Protocol (SNMP) (Orebaugh, et al., 2007). Once the intruder has access to the network, he can collect data and use it as he likes. Common examples of stolen data include credit card numbers and proprietary organizational secrets, but include anything the hacker desires. Although organizations may use a primarily switched network, they are not protected from sniffer attacks because many programs exist that allow packet sniffing in a switched network (Whitman, et al., 2008). Because intruders who use packet sniffers do not directly interface or connect to other systems on the network, they are considered to be a passive-type of attack (Orebaugh, et al., 2007). It is this passive nature that makes sniffers so difficult to detect (Orebaugh, et al., 2007). In addition to this, hackers use normally use rootkits to cover their tracks so that their intrusion will not be detected (Orebaugh, et al., 2007). A rootkit is a collection of Trojan programs hackers use to replace the legitimate programs on a system so that their intrusion will not be detected (Orebaugh, et al., 2007). Rootkits replace commands and utilities that the hacker inputs and clears log entries so that there will be no record of his entry (Orebaugh, et al., 2007). Though it is difficult, there are some ways to detect rootkits. Methods of detection include using an alternate, trusted operating system, analyzing normal behaviors, scanning signatures, and analyzing memory dumps ("Rootkit", Wikipedia, 2011). Removing rootkits can be very complicated and difficult and if the rootkit is in the central operating system, reinstalling the operating system may be the only option ("Rootkit", Wikipedia, 2011). The threat of eavesdropping by intruders is large and challenging. However, there are some defenses that can be taken to prevent hackers from using packet sniffers against an organization. Packet sniffing and man-in-the-middle attacks compromise the integrity and confidentiality of data while in transmission. Fortunately, there are several techniques that can be used by organizations and individuals to protect against these threats and reduce risk. Specifically, technology, policy, and education are typically used to cover all aspects of security. Encryption is the best form of protection against any kind of packet interception (Orebaugh, et al., 2007). The reason behind this is that even if the data is captured by the packet sniffer, the information is completely unreadable by the attacker (Orebaugh, et al., 2007). By using this technique, messages are encrypted once the data leaves the sender's computer. Both sender and receiver hold a key that decrypts the message being transferred. Most popular websites apply a level encryption by using the HTTP Secure (HTTPS) protocol. With this technology, the connection between the web server and the user's computer is encrypted; making the information intercepted by a third party useless. Currently, most popular websites such as Google, Facebook, Yahoo, and Twitter use the https technology. However, some sites (such as Amazon.com) use https only at the login page and fail to provide a secure connection afterwards. In order to assure complete security, it is important to apply the https protocol throughout the user's browsing experience. The main disadvantage of this feature is that it slightly slows down the user's connection.
Email can also be protected from packet sniffers by using encryption. Email extensions such as Pretty Good Protection (PGP) can be easily implemented using standard email platforms like Microsoft Outlook (Orebaugh, et al., 2007). Once sender and receiver start using the encryption techniques, intercepted email messages cannot be interpreted by an attacker (Orebaugh, et al., 2007).
Another way to protect against sniffers is by using One Time Passwords (OTP). With this method, a different password is sent every time the authentication is requested to the user (Orebaugh, et al., 2007). Similarly, to the case of encryption, if a third party intercepts someone's password, this information will be useless since these can only be used once (Orebaugh, et al., 2007). This technology can be extremely useful to ensure security; however, remembering new passwords for each login can be very challenging and frustrating for most users.
A new security technique called quantum encryption is also provides good protection against sniffing attacks. This technique consists of making each bit of data as small as a photon (McDougall, 2006). The data is then transferred across fiber-optic lines. If the information is picked up and intercepted by any kind of packet sniffer, the entire photon message is disrupted, ending up the entire transmission (McDougall, 2006). A technology like this would make it impossible to intercept information since the communication will be cut in the case of interception. However, it requires fiber-optic Internet connections, which many service providers do not own and its installation can be expensive.
Packet sniffing is a sophisticated subject that wears two hats. It can be used for either good or evil depending on the intentions of the person using the program. It can help with analyzing network problems and detect misuses in the network for good purposes. Meanwhile, it can also help hackers and other cyber-criminals steal data from insecure networks and commit crimes, as in the case of Dave & Buster's. The best way to protect data from being "sniffed" is to encrypt it. Necessary policies and training also help with the protection. As technology evolves, there will be more and more ways to commit cyber-crime. Extremely sensitive data like credit card information and health care data should be well protected, from the perspectives of both the business and personal. In order to protect this information, organizations and individuals must be aware of the threat of packet sniffers.