CGM Systems Home

Resources Home

The danger of packet sniffers

by Christopher G. Mendla

Your passwords are not nearly as secure as you might think. Whenever you use a network, including the internet, all of the information is sent in the form of packets. In a majority of cases, these packets are unencrypted. A file or webpage can be made up of a large number of packets.

There are specialized tools that will allow a user to 'sniff' the packets on a network. A few years back this required specialized, expensive equipment and a fair amount of skill. Today, almost anyone can download an open source software app and begin using it. (Open source software is usually available at no cost). There is no need for any specialized hardware since a desktop or laptop will have all the connectivity and processing power you need.

The reason sniffers work is that, in a network, the machine you are on will see all of the packets on the network. In normal operations, your machine will ignore irrelevant packets. The sniffer simply captures all of the packets and records them.

How you could be compromised.

Suppose you are the owner of a small company. You will have a number of passwords and user id's for things such as email, web hosting, domain names financial sites, etc. If one of your employees is less than honest, they can install a sniffer and begin capturing packets. As you access your email, a record will be made of the user id and password. The culprit can then take the files home and analyze them at will. In a short time, they will have most of your critical ID and Password combinations. In addition, they can re-assemble documents and email messages sent over the network.

Another way you can be compromised is to use a public network such as an internet cafe or free access at an airport or train terminal. Anyone on the network could be running a sniffer and you would never know it.

How to protect yourself:

1. Whenever possible use a secure connection. For example, if you are using mail2web.com to retrieve your pop3 email, there is an option for a secure login. If you use that option, your password will be encrypted and therefore much more difficult to crack
2. Don't use the same id and password everywhere. If you do, then the first time they are able to find the id and password, they will have access to almost everything you do. If you use different ids and passwords, the task becomes more difficult for them.
3. Scan employee machines - You should have a policy prohibiting employee installation of any software. If you know the names of the various popular sniffing programs, you can check employee machines for installations.
4. Change your passwords on a regular basis - This can take effort but it will reduce the impact of compromised id/password combinations. You might want to change your email passwords right before you go on the road and then change them again when you return.
5. Use discretion when traveling - If you are sitting in an airport terminal and internet cafe resist the urge to visit sensitive sites unless absolutely necessary. Simply logging into your brokerage account may allow someone on the same network to grab your password or data. If you send an unencrypted word document with sensitive information it is easy pickings for anyone who wants to grab it.

Why are sniffers 'allowed'?

They exist simply because they are an essential tool in diagnosing network problems. A network administrator can see all of the traffic, protocols, and bottlenecks on the network. If a particular piece of equipment is malfunctioning, a sniffer will allow you to pinpoint it quickly. The problem is not with the sniffers themselves, but with the misuse of the tool.

Last modified:  11/10/06