Subject: network eavesdropping

From: "mehlng" <[email-masked]>
Date: Fri, 19 Nov 2004 12:36:58 -0000

Hi,
I want to ask a fundumental question about web security.
Why is plain-text transfers from private computer to a website is
consider highly insecure?
As far as I understand, when you send the information to the website
you send it to several routers, which are not controlled by
individuals, that transfers your request to the destination website.
Now, as far as I understand it there's no one (except of real wire
tapping) to intercept connection between two computers with another
computer which is not connected exactly to the LAN this computers are
connected to.
Therefor there should be no way to eavesdrop to an internet transfer
without access to the two computer one want to eavesdrop then.

I'm obviously wrong somewhere in here so please point me to where I'm
wrong.

---

From: Arik Baratz <[email-masked]>
Date: Fri, 19 Nov 2004 23:05:39 +0200

> consider highly insecure?

Security is a relative term. It's all about WHO is a potential
attacker, HOW MUCH a potential attacker stands to gain from the attack
(converted to money) and HOW MUCH effort does it take to successfuly
attack you (converted to money).

Let's take an example.

Say you are a mobster. The FBI is after you. They know you use your
computer to commit serious crimes by submitting data to plain-text
web-sites, and naturally they want to eavesdrop on your computer. The
FBI don't gain money from the attack, but if you are a major mobster
and the attack successfuly nabs you the government will gain $50000
from taxes that you are no longer not-paying.

They can, for example, put a keyboard logger on your computer. They
need to break into your house and install it. Let's say that the
manpower needed to do that 'costs' $50/hour per person, for 3 hours -
that's $150. In that case, the attack is definitely worth it, and you
will be attacked.

They can alternatively go to your ISP and listen on the ISP's router.
Since the infrastructure is in place, they only need to send a single
agent, for 1 hour, and that would cost $50.

Or they may confiscate the destination web server and read the data
you submitted of its disk. $50.

You can plainly see that it pays to use encryption if you're a
mobster, because that increases the cost of the attacks so much that
only keyboard-logging remains viable.

So ask yourself: Is the information I'm submitting worth so much that
someone will be willing to go to the trouble of getting it? If the
answer is yes - then it is insecure. If the answer is no - then you
can send your cleartext information and nobody will care.

-- Arik

---

From: guy keren <[email-masked]>
Date: Sat, 20 Nov 2004 03:06:33 +0200 (IST)

> computer which is not connected exactly to the LAN this computers are

ah... you're too trusting...

plainly, people break into computers, including those which are capable of
sniffing traffic from routers, proxy servers and what-not.

and it doesn't have to be that people are speficially trying to find
something _you_ wrote. people could run programs that try to find any kind
of interesting information (such as passwords) - and use it for something.

the chances of this happening are... err.. i've no idea ;)

but that's the basic issue.

ofcourse, you should mostly consider what's the worse thing that can
happen to _you_ from something like this (e.g. someone finding one of
your passowrds and uses your account? well, if you pay flat-fees, you
don't personally care so much. someone sniffs your visa card information?
then don't pay on sites not using SSL, and your credict card info won't be
sniffable. it can still be taken via other means, but that's why you pay
the credit card company money to allow you to cancel any purchases you
claim you did not make.)

basically, if you assume that what you send on the internet is inherently
open to eavesdropping, and act accordingly, you have nothing to fear ;)

-- 
guy

"For world domination - press 1,
 or dial 0, and please hold, for the creator." -- nob o. dy

---

From: Tal Rotbart <[email-masked]>
Date: Sat, 20 Nov 2004 14:02:40 +0200

I personally worry more about the web-site I submitted info to being
compromised than a backbone router being tapped. Therefore I only
submit money-worth information over encrypted connections and only to
relatively trusted sites.

-Tal

On Sat, 20 Nov 2004 03:06:33 +0200 (IST), guy keren <[email-masked]> wrote:
> Yahoo! Groups Links

-- 
/************************************************

  Tal 'redbeard' Rotbart
  Software Wizard

  eMail:  redbeard of gmail dot com
  Tel:    +972-2-671-6178
  Mobile: +972-52-896-5025

  Snail mail:
          Klozner 7/2
          Jerusalem 93388
          ISRAEL

************************************************/

---

From: "mehlng" <[email-masked]>
Date: Sat, 20 Nov 2004 18:06:06 -0000

You are absolutely correct, I'll clearify my question. If the FBI
after you, you'd better go hit the bluefish.
People say that telling your isracard on phone to the local pizza buzz
you know is pretty secure, even though phone tapping can be done with
a breeze. The reason is that phone tapping is PLILI illegal (costs the
attacker 5 years in jail, approx. 500,000NIS) and requires you to
actually physically touch the wire of the pizza store which is pretty
hard, therefor there isn't much chance people will take your credit
card number this way.
Never the less people feeling that sending your credit card via the
net to the very same pizza, is highly dangerous, thus I wonder why -
AFAIK you can't eavesdrop to any main router without actaully
wire-tapping.
--- In [email-masked], Arik Baratz <arik.baratz@g...> wrote:
> On Fri, 19 Nov 2004 12:36:58 -0000, mehlng <mehlng@y...> wrote:
> 
> > Hi,

---

From: guy keren <[email-masked]>
Date: Sat, 20 Nov 2004 21:11:25 +0200 (IST)

> AFAIK you can't eavesdrop to any main router without actaully

why? a router is a computer. if you break into it, you can have it all.

the router is located on a LAN that might have some of the data flowing
into it as well.

those things can be done remotely too.

by the way, with some types of wiring, people could wire-tap without
physically accessing the wires - wires radiate their informaiton to the
air around them for some distance (few meters, sometimes more). that's
true both for datacomm and for telecom.

i suggest that instead of asking things here, get some info about
phreaking and the like on the internet, and read. you'll learn more then
by asking a single question.

-- 
guy

---

From: Arik Baratz <[email-masked]>
Date: Sun, 21 Nov 2004 11:42:47 +0200

> of interesting information (such as passwords) - and use it for something.

It works with the same model:

Attacker: Your random password-sniffer who exploited a router.
Stands to gain from the attack: Your CC# (for the attacker it's worth say $1000)
Cost of the attack: If the attacker would have been working a decent
job, and paid $100 for it, it would cost maybe $400 to perform the
attack

Hence the attack is worthwhile.

> the credit card company money to allow you to cancel any purchases you

That's an entirely different question. The original question was 'Is
the information I send over the net in plaintext secure, and why
not?', but this is the answer to 'Should I send information over the
net in cleartext?'

It's a good answer, though.

There's another answer: Encryption is power at the hands of the
people. This power can be used for good or for bad. Governing bodies
have tried in the past and are still trying to take this power away
from us people, to the point of doing bad things to people who promote
encryption. If you use encryption, you are sending a message to those
governing bodies: I want my privacy, and I want to control the
information I am using. I am not a criminal and I am using encryption.

> open to eavesdropping, and act accordingly, you have nothing to fear ;)

Just because you're paranod doesn't mean they are not after you.

-- Arik

---

From: omer mussaev <[email-masked]>
Date: Sun, 21 Nov 2004 04:57:44 -0800 (PST)

> AFAIK you can't eavesdrop to any main router without

In theory it is possible to trick routers by spoofing
BGP records, thus making the routers themselves
deliver the information to you...

=====
--
o.m.

__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com

---

From: Ofir Carny <[email-masked]>
Date: Mon, 22 Nov 2004 15:35:16 +0200

When making adversary cost/performance calculations, don't consider
the case of a single CC gained, by hacking into a router, literally
GBits of information can be gleaned from various sources, probably
including thousands of CC#s passwords and other valuable information,
this almost always makes it worthwhile to a criminal to do.

Plus routers usually have multitude of peole with access (sys admins,
cleaning personnel, sometimes even random students), routers are not
placed by a centra authority, so your data can pass through
universities, private companies, ISPs, etc. Plus there's the whole
issue of organized sniffing (carnivoure, etc.)

---

From: Tal Rotbart <[email-masked]>
Date: Thu, 25 Nov 2004 01:27:35 +0200

While it could be gainful, while there are other criminal activities
that have a better gain/effort ratio the router-hacking scenario is
unlikely. Such scenarios include the phishing schemes, which seems to
be very popular with organized crime as of late.

They have a much higher gain/effort ratio than a router-hack.

Tal

  Tal 'redbeard' Rotbart
  Software Wizard

  Snail mail:
          Klozner 7/2
          Jerusalem 93388
          ISRAEL

---

From: Tzafrir Cohen <[email-masked]>
Date: Thu, 25 Nov 2004 10:33:57 +0200

> They have a much higher gain/effort ratio than a router-hack.

Because people normally don't use unencrypted traffic for "important"
stuff. And also because those attacks target end-users and thus get more
attention than attacks targeted at the infrastructure.

OTOH, it is still easy enough. It is still dangerous enough to assume
that all the ones in the middle are honest.

-- 
Tzafrir Cohen                       +---------------------------+
http://www.technion.ac.il/~tzafrir/ |vim is a mutt's best friend|
mailto:[email-masked]       +---------------------------+

---

From: "Tzahi Fadida" <[email-masked]>
Date: Wed, 1 Dec 2004 17:08:46 +0200

I think that many people don't know that encryption of the HD is pretty
worthless since
if you are a criminal and goes to court then you will be requested to
decrypt the information
or be in a state of contempt of court and stay in jail until you open it.
You'd better destroy the data in that case.
One solution that comes to mind is putting all your data on some kind of
temporary storage
not on location that expires without putting a password.
Somewhere with no relation with the US gov.
Another thing people don't understand is that screens can be sniffed using
radiation readers
(gov hadware of course) and they can sniff you thru your window or see the
screen reflection.
or just put a fiber optic on your window and countless measures.

Pretty much, all of the above is probably worthless attempts if they know
where you live because
they can spy on you in many ways, most are primitive and sufficient. 
Better they won't locate you.

Regards,
	tzahi.

> -----Original Message-----
> From: Arik Baratz [mailto:[email-masked]] 
> Sent: Friday, November 19, 2004 11:06 PM
> To: [email-masked]
> Subject: Re: [hackers-il] network eavesdropping
> 
> 
> 
> Security is a relative term. It's all about WHO is a 
> potential attacker, HOW MUCH a potential attacker stands to 
> gain from the attack (converted to money) and HOW MUCH effort 
> does it take to successfuly attack you (converted to money).
> 
> Let's take an example.
> 
> Say you are a mobster. The FBI is after you. They know you 
> use your computer to commit serious crimes by submitting data 
> to plain-text web-sites, and naturally they want to eavesdrop 
> on your computer. The FBI don't gain money from the attack, 
> but if you are a major mobster and the attack successfuly 
> nabs you the government will gain $50000 from taxes that you 
> are no longer not-paying.
> 
> They can, for example, put a keyboard logger on your 
> computer. They need to break into your house and install it. 
> Let's say that the manpower needed to do that 'costs' 
> $50/hour per person, for 3 hours - that's $150. In that case, 
> the attack is definitely worth it, and you will be attacked.
> 
> They can alternatively go to your ISP and listen on the ISP's 
> router. Since the infrastructure is in place, they only need 
> to send a single agent, for 1 hour, and that would cost $50.
> 
> Or they may confiscate the destination web server and read 
> the data you submitted of its disk. $50.
> 
> You can plainly see that it pays to use encryption if you're 
> a mobster, because that increases the cost of the attacks so 
> much that only keyboard-logging remains viable.
> 
> So ask yourself: Is the information I'm submitting worth so 
> much that someone will be willing to go to the trouble of 
> getting it? If the answer is yes - then it is insecure. If 
> the answer is no - then you can send your cleartext 
> information and nobody will care.
> 
> -- Arik
> 
> 
> ------------------------ Yahoo! Groups Sponsor 
> --------------------~--> 
> $9.95 domain names from Yahoo!. Register anything. 
> http://us.click.yahoo.com/J8kdrA/y20IAA/yQLSAA/saFolB/TM
> --------------------------------------------------------------
> ------~-> 
> 
>  
> Yahoo! Groups Links
> 
> 
> 
>  
> 
> 
> 
>

---

From: Arik Baratz <[email-masked]>
Date: Wed, 1 Dec 2004 17:35:10 +0200

Hi Tzahi

> Somewhere with no relation with the US gov.

... or use the steganographic filesystem, in http://stegfs.sourceforge.net/

"Plausible Deniability"

> (gov hadware of course) and they can sniff you thru your window or see the

Just for CRTs

> or just put a fiber optic on your window and countless measures.

For every screen

> Better they won't locate you.

Depends on how much of your life is virtual. If you follow some very
basic rules (although people will look at you funny if they know) you
can avoid most of the problems of captured hardware, sniffed keys,
captured screen, etc.

-- Arik

---

From: "Nadav Har'El" <[email-masked]>
Date: Wed, 1 Dec 2004 17:44:18 +0200

> You'd better destroy the data in that case.

This is the same issue as those new "code" machines in cars. Criminals find
it hard(?) to break them, but it's trivial when they can just point a gun
at you and tell you "Hey, you know the code - punch it in! now!", which
makes them armed robbers.

The government threatening you until you give them your keys is exactly
like armed robbery, in this context.

Virtually no kind of passive security (locks, walls, etc., and their
electronic equivalents like encryption) can do anything against an *armed
robbery*, which means the attacker finds the person who has legitimate
access (keys to the lock, encryption keys, PIN codes, iris picture, or
whatever) and threaten them with a gun to open the security measures for
him, or perform the required theft (or whatever) for him.

Anyway, if you fully destroy your data - in a way that even you yourself
don't access to it any more, then you're screwed too. If you leave yourself
even one small way to get your data back, then, well, the armed robber can
force you to reveal it...

> Better they won't locate you.

Right. If the bad guys know where you are, nothing is simpler than just
shooting you and you're dead. All other scenarios are much less worying
to me, so I don't see why someone should.

-- 
Nadav Har'El                        |    Wednesday, Dec 1 2004, 18 Kislev 5765
[email-masked]             |-----------------------------------------
Phone +972-523-790466, ICQ 13349191 |The path of least resistance is what
http://nadav.harel.org.il           |makes rivers and politicians crooked.

---

From: Arik Baratz <[email-masked]>
Date: Thu, 2 Dec 2004 12:13:47 +0200

> makes them armed robbers.

There's a Visonic keyboard called CL-8. It's a widely used keypad for
simple entry control, flash rom, 50 possible codes, etc. They have a
feature they call 'ambush digit' (yes, it's an Israeli company). For
all codes you key in, you can append this digit. The code will work as
expected, but an extra relay will be switched, hopefully wired to a
silent alarm. This way if you are at gunpoint, you can punch in the
ambush digit, and the attacker will never know.

In the context of cars, an alarm system I once had had a feature where
if the car door was opened when the ignition was on, it would stall
the engine after 5 minutes. This way if you're car-jacked you can
leave the engine running, the car-jacker will be s*** out of luck when
he discovers 5 minutes later that the car stalled and doesn't start
again. You're not around to get the bullet by that time.

> like armed robbery, in this context.

Apart from having plausible deniability using the steganographic
filesystem, you can design your system to accept two password. One
would be rather easy, and 'decrypt' innocent data, and the other will
be harder and give access to your real data.

> force you to reveal it...

The armed robber doesn't have to know how many copies you have. You
can plausibly have only two copies and still keep a third one. Unless
they can decrypt your mind. In that case the extra copy should be
hidden with a trusted accomplice in a way that you have no access to,
and encrypted by both you and your accomplice.

> to me, so I don't see why someone should.

Well, if it's your data they're after and not you, they won't kill
you. In fact they will take great pains not to kill you.

-- Arik

---

From: omer mussaev <[email-masked]>
Date: Thu, 2 Dec 2004 08:21:30 -0800 (PST)

> like armed robbery, in this context.

This reminds me of old story by JWZ: 
http://www.jwz.org/gruntle/rbarip.html

> [email-masked]            

=====
--
o.m.

__________________________________ 
Do you Yahoo!? 
Take Yahoo! Mail with you! Get it on your mobile phone. 
http://mobile.yahoo.com/maildemo