Catch up on stories from the past week (and beyond) at the Slashdot story archive

 


Forgot your password?
Close
typodupeerror
×
Privacy Wireless Networking

A Network Sniffer On Steroids 129

Posted by kdawson from the data-seepage dept.
QuantumCrypto writes "Errata has developed a new network sniffer, dubbed 'Ferret,' that looks for traffic using 25 protocols, including those for the popular instant message clients as well as DHCP, SNMP, DNS and HTTP. This means the sniffer will capture requests for network addresses, network management tools, Web sites queries, Web traffic and more. 'You don't realize how much you're making public, so I wrote a tool that tells you,' said Robert Graham, Errata's chief executive. Errata has released the source code to this version 1.0, 'feature-poor and buggy' tool on its site. Anyone with a wireless card will be able to run it, Graham said."
This discussion has been archived. No new comments can be posted.

A Network Sniffer On Steroids More

A Network Sniffer On Steroids

Comments Filter:

  • Broadcom cards? (Score:3, Interesting)

    by ShaunC ( 203807 ) * on Tuesday March 06, 2007 @02:42PM (#18253758)
    Does anyone know if there are any special driver requirements, beyond "anyone with a wireless card?" The documentation is rather...sparse. I've got a Broadcom wireless card in my laptop and it's generally a pain to get things like aerodump going; it requires installing a debug driver, then rolling back the driver afterwards, and the network functionality itself is disabled during this period, at least with aerodump.

    I'm curious if ferret can sniff without the added hassle...
    • Anyone know how you would accomplish this without kicking the card into monitor mode?

  • Wireshark? (Score:5, Interesting)

    by Hackeron ( 704093 ) on Tuesday March 06, 2007 @02:46PM (#18253822) Journal
    How is this different to say wireshark or any other traffic analyzer?

    • Re: (Score:2)

      by TLouden ( 677335 )
      It was built on a Windows system and comes with an executable?

      I'm personally in favour of easier to use software (ie. something with a Make file or a .deb, etc.)

      • Re: (Score:3, Informative)

        by Arkaic ( 784460 )
        Umm. Wireshark/Ethereal have had Win32 versions for quite some time. From reading the article and the download page I see nothing which distinguishes this app from others which were done first, and better.

        • Re:Wireshark? (Score:5, Informative)

          by Hackeron ( 704093 ) on Tuesday March 06, 2007 @04:00PM (#18254738) Journal
          After reading their presentation and other material, here's how it's different to wireshark -- the packet analyzer part is just one of it's features:

          1) It can respond to various requests like DHCP requests (so it's like a lightweight collection of servers?)
          2) It has a port scanner to show running services (like nmap)
          3) It has kismet/netscambler functionality to break into wireless access points
          4) They go on and on about it not looking at data leakage but intential data like startup programs querying servers, etc -- After 6-7 pages of explaining this I still don't see the difference...

          At the end of the day, this looks like wireshark+nmap+kismet tied together made for the intent of tracking desired actions like buying new hardware in a firm

          So looks like move along, nothing to see her to me but I get the steroid bit now

        • Re: (Score:2, Interesting)

          by twistah ( 194990 )
          By your logic, Wireshark is no different than tcpdump. But obviously, they are different. Wireshark is great at dissecting packets, not just dumping them in hex format. Ferret is good for sniffing broadcast information, such as NetBIOS traffic and iTunes DAAP, which can assist you in getting a picture of the current network. That's all it does. Yes, they are all pcap based, but they serve different purposes.

          Just like you could use Wireshark to sniff for passwords (or, hell, even tcpdump + ngrep), but it's a
          • Wireshark is a packet analyser, tcpdump and ngrep are packet captures, ngrep (no relation to tcpdump) is just a hell of a lot easier to use. Tcpdump truncates everything to 68bytes by default and has all sorts of other silly defaults and just not trivial to use.

            Wireshark supports all protocols listed by Ferret and more, there are plugins for password sniffing but dsniff or cain are just a lot lighter and more efficient when analyzing large amounts of live data like at an ISP. I had to analyze around 400GB o
          • Oh, I misunderstood what you meant on broadcast scanning - you could do the same with wireshark with a wireless set to monitor mode or by connecting your standard ethernet to a spanning port on a switch or to any port on a hub and sniff sniff :)

    • Re:Wireshark? (Score:5, Funny)

      by $RANDOMLUSER ( 804576 ) on Tuesday March 06, 2007 @03:01PM (#18254012)

      How is this different to say wireshark or any other traffic analyzer?
      Duh. It's on steroids.

    • Re: (Score:2, Interesting)

      by Red Flayer ( 890720 )
      FTA:

      The Errata sniffer, dubbed Ferret, packs more punch than other network sniffers already available, such as Ethereal and Kismet, because it looks at so many different protocols, Graham said. Some at Black Hat called it a "network sniffer on steroids."

      Reading. It's what's for knowledge.

      Oh, and Wireshark was Ethereal. They had to change the name due to trademark concerns.

      • Re: (Score:1)

        by Arkaic ( 784460 )

        Reading. It's what's for knowledge.
        Indeed.

        From the Ethereal feature page: 759 protocols can currently be dissected
        From the Wireshark web site: Hundreds of protocols are supported, with more being added all the time

        • Re: (Score:2, Informative)

          by basotl ( 808388 )
          Errata [com.com] Errata has developed another network sniffer that looks for traffic using 25 protocols

          Wire Shark [wireshark.org] Hundreds of protocols are supported, with more being added all the time.
          Wireshark's most powerful feature is its vast array of display filters (over 51000 as of version 0.99.5).

          Something isn't adding up for Errata having more.

          Normally people complain that Wireshark looks at too many protocols and presents a network vulnerability.

    • Re: (Score:2)

      by garcia ( 6573 )
      How is this different to say wireshark or any other traffic analyzer?

      This one is feature poor and buggy.


    • Dunno but i managed to write something better than this when i was 16.
      Its really sad to see crap stuff make it.

    • Re: (Score:2)

      by daveb ( 4522 )
      I don't believe wireshark/ethereal can get to 802.11 without paying for a plugin from cace, at least not promiscuously (which is all I care about)

      But apart from 802.11, wireshark seems to capture WAY more than this one. So the only real question is does it do a better job or does it do it a better way? Because if it is "better" (in whatever way) then adding protocols is just a dissection task.

      I suspect that it's not that hot really.

      • Re: (Score:2, Informative)

        by klem ( 642403 )
        Hum, as long as your wireless card is in monitor mode (http://en.wikipedia.org/wiki/Monitor_mode , this mode is controlled by the OS, so ethereal doesn't even know about it), ethereal can read and analyze with 802.11 packets just fine.
        Furthermore, it's not even limited to "regular" data packets (IP or ARP packets encapsulated into 802.11 ) . You can see things like 802.11 association/authentication/probes packets (it's funny how some people believe that preventing the AP from announcing its network name

        • Re: (Score:2)

          by Sancho ( 17056 ) *
          It may not add security, but it prevents Windows from trying to connect to it (as does using WEP, even though WEP is trivial to crack), so it can be useful.
          • Yeah, that's why I use MAC filtering. If someone's going to connect, well, I don't even have WPA and WEP is a kleenex, so they're going to get in. But they won't get in accidentally just driving by if I use SOMETHING. When I have cared about security (nothing much is on that network just now but a printer - what are they going to do, use up my paper?) I have used VPN and blocked all non-VPN traffic.

        • Re: (Score:2)

          by daveb ( 4522 )
          oooohh kay

          what you're saying SOUNDS right - so what's the point of this [cacetech.com] which is always at the top of the wireshark FAQ [wireshark.org]

          If wireshark can capture all of the layer 2 traffic then thats cool - and I might go back and try it again. the last time I tried I didn't get anything lower than layer3 and even then I didn't get anything apart from my own stuff (i.e. not promiscuous).

          Are you getting something different?

          • Re: (Score:1)

            by klem ( 642403 )
            Oops, i failed to mention that i had only tested it on Linux. Your page seems to refer to a windows product, which appears to be not necessary under linux.

            I'm not sure "promiscuous mode" has a meaning on WiFi network: the (almost) equivalent of this is in the WiFi world is the monitor mode. The monitor mode causes your card to capture all packet on the selected WiFi channel.
            Additionnally, when not in monitor mode, your network interface will act as an Ethernet interface (the network card driver wi

            • Re: (Score:2)

              by daveb ( 4522 )
              aahh that makes sense.

              Yeah - I meant monitor not promiscuous. You can see I haven't done a lot with 802.11

              thanks for that. Most of the decent network monitoring tools are linux, I should have tried that out first

              cheers
          • No seriously, I said that with a straight face!

            I watched a briefing on Vista wireless and compared to XP it's WAY different. The MSFT guy on the stage actually said the words monitor mode and mangle packets! Apparently the XP driver setup for wireless kludged wireless to look like a regular wired NIC. For Vista that's not the case - you can have filter drivers and all sorts of stuff going on with wireless. The SDK for drivers even supposedly comes with SOURCE for a wireless driver supporting Realtek wireles
    • Does anyone remember a Mac utility that came out a while back (by which I mean, maybe 5 or so years ago), that would put an Airport into promiscuous mode, and sniff for traffic, and then decode and display any images that it sniffed? It was a pretty amusing little program; I think I remember reading that it was thrown together at MacHack and won best of show, or some other honor.

      Basically you could run it, and it would give you an idea of what everyone on the wireless network was browsing, in the clear, at that moment, all sort of jumbled together.

      I've always wanted something like that, to use as a demonstration of how insecure most wireless APs (unencrypted ones) are, for nontechnical people, but I've never been able to find it, or any record of it. Sometimes I wonder if I just hallucinated the whole story.

      It would be a heck of a demo to just run something like that, particularly if you could target a particular connection, and then tell someone to load a web page, and be able to instantly display some or all of the page, or at least its images, in real time, to prove that you really were listening in on what they were doing. Most packet sniffers don't provide any direct, obvious, graphical output of stuff they sniff, and that's frankly just not dramatic enough to make an impression.

    • How is this different to say wireshark or any other traffic analyzer?
      Um, it's got electrolytes! It's what networks crave!

    • How is this different to say wireshark or any other traffic analyzer?
      It works on fiber-optics because it has frickin laser beams attached to its wire, that's how!
    • To me it sounds more like dsniff http://monkey.org/~dugsong/dsniff/ [monkey.org], capturing only passwords, usernames, that kind of stuff.

    • Re:Wireshark? (Score:5, Insightful)

      by s_p_oneil ( 795792 ) on Tuesday March 06, 2007 @04:38PM (#18255202) Homepage
      Over 99% of Internet users wouldn't have a clue how to use Wireshark. "What are all these SYN messages? Are they caused by a virus or spyware?"

      Actually, that's a gross exaggeration. Very few Internet users would even be able to figure out how to start a capture in Wireshark. The more timid ones wouldn't even make it to the "No capture interface selected!" error, and most of the rest would be lost when they ran into that.

      If Ferret successfully dumbs it down, then it could be quite useful to a lot of Internet users. In that case, I wouldn't say it was a sniffer on steroids though. More like a "for dummies" version.

    • Re: (Score:3, Interesting)

      by slickwillie ( 34689 )
      Well, for one thing Ethereal (Wireshark) used to have the best slogan on the Net:

      "Sniffing the glue that holds the Internet together."

  • From TFA (Score:3, Interesting)

    by Who235 ( 959706 ) <secretagentx9@ c i a . com> on Tuesday March 06, 2007 @02:50PM (#18253878)

    "If the government was taking this information from you, people would be up in arms."

    First of all, they probably are sniffing you whenever it's convenient (like at the airport).

    Second of all, people sadly don't seem to care all that much.

    This looks like a cool tool, and I share the hope of an earlier poster that it will work with Broadcom cards - since that's what I have.

    • Re: (Score:2)

      by frisket ( 149522 )
      I'm tired and I haven't written a Makefile that I had to deduce by hand and eye in many aeons. Has anyone written a Makefile suitable for Deb or Edgy they could share?

    • I have a friend who works at Best Buy/Geek Squad. A guy came in with a government contract and a laptop, needing repairs. He was making small talk and said his job was to wardrive around and break into people's home computers and search them for child porn.

      Take it with a grain of salt - the guy was just some dude with a busted laptop walking into a Best Buy. But he did have a government contract, and a lot of wireless sniffer software on his machine.

      • Re:They probably already are (Score:4, Interesting)

        by Lord Ender ( 156273 ) on Tuesday March 06, 2007 @10:08PM (#18258236) Homepage
        Right. He had advanced security software, a van with sophisticated antennas, and no IT department to fix failures of their own equipment. So he takes it to Best Buy, where the teenage "technicians" install unnecessary anti-virus software, which proceeds to wipe out ("clean") all his security software...

        Yeah, right. They don't make salt grains big enough.
        • But they do mine rock salt in Cheshire. The tunnels are a good ten foot or so in height and the salt is blasted out with high explosives. Now, that's the stuff you should be taking with stories like this.

        • Where did I say he had a van full of equipment?

          He had a laptop computer with basically the same kind of stuff you find on Remote Exploit, just in Win32 versions. And my buddy didn't say he had a virus problem, the machine was physically busted - most likely from a drop. He bought the laptop through Best Buy and they were returning it to the manufacturer for replacement.

          And I did say to take the story with a grain of salt - I'm not sure I believe it either.

          Although. Wouldn't it be funny if the guys

    • Re: (Score:2)

      by jd ( 1658 )
      If people cared about sniffers, they wouldn't be using unsecured protocols with wireless. They probably wouldn't use unsecured routers either. They're rather restricted on the Internet itself, as most websites don't provide SSL/TLS access or IPSec tunneling. It's quite pathetic, really. (For that matter, why are wireless routers so nausiatingly limited? There are a half-dozen very standard wireless routing protocols and over two hundred have been developed. But wireless routers often don't support any. If t

  • Brilliant (Score:2, Insightful)

    by Gothmolly ( 148874 )
    You mean that by analyzing my DNS and HTTP traffic, either in the clear or from a cracked WEP session, that you can infer, or worse, identify, certain definite pieces of information about my Internet usage habits?
    Boy, if I had a tool that could do that, I'd certainly astroturf it on Slashdot.
    • It's good to know that it's out there. Time to built an adequate defense system. If these guys have it, we can only imagine what the government is sniffing the networks with.

      • Re: (Score:2)

        by g-san ( 93038 )
        Your only adequate defense system would be to not send any traffic. That's like trying to have a conversation with someone with a third party present and come up with a defense so they cannot hear it. Speak spanish you say? Sorry, the internet only has one language, IP. And typically, unless you wrote the client and the server, you are probably using a well known standard protocol. That means I can look at traffic for an application I have never seen and still be able to glean a fair amount of info.

        I suppo
    • Yes, all good ol' hackers already know the tricks of the trade and there are rarely any new ones (different hardware/proto same old hooks). You have indeed identified the sensation effect of the news and therefore it is in a newsite like news.com.com. Information is blown out of proportion and it is then called news. For the layman perspective it is absolutely shocking that you can infer very much from looking at the network. For the insider it is something we use knowingly or unknowingly all of the time. L
    • Who still uses WEP? Any wireless router bought in the last few years will support WPA encryption instead. That said, it seems like a lot of vendors use WEP as the default encryption scheme. That's just irresponsible if you ask me.

      • Re: (Score:2)

        by cortana ( 588495 )
        I have to use WEP because my Nintendo DS cannot do WPA.

        • Re: (Score:2)

          by Sancho ( 17056 ) *

          I have to use WEP because my Nintendo DS cannot do WPA.
          I've never managed to get my DS to connect to my access point, whether it's WEP, open, or what.

          I don't have a Windows machine, so the USB dongle won't help, either. Kinda sucks for games where unlockable content exists, but you have to connect to the Wifi to get it.

    • According to this banner ad I saw on another site, my IP address is visible!

  • Darn (Score:5, Funny)

    by Kohath ( 38547 ) on Tuesday March 06, 2007 @02:57PM (#18253956)
    I needed a steroid sniffer that works on my network.

    Can I operate it in reverse or something?

  • my god (Score:5, Funny)

    by mastershake_phd ( 1050150 ) on Tuesday March 06, 2007 @03:30PM (#18254348) Homepage
    My neighbor likes clown pron.
    • I'll go you one better: my girlfriend likes clown pron. She has two tapes thus far. Her best friend likes *midget* pron. They've been searching for midget clown pron.

      I spend a lot of time rebuilding bikes out in the garage, or anywhere out of hearing range.

      • Dude... (Score:5, Funny)

        by geekoid ( 135745 ) <{moc.oohay} {ta} {dnaltropnidad}> on Tuesday March 06, 2007 @05:03PM (#18255496) Homepage Journal
        You should be out in the garage getting your clown suit on.

        • Re: (Score:3, Funny)

          by Knara ( 9377 )
          And chopping off his own shins.
        • I'm a coulrophobe, is the problem with that otherwise-great plan.

          Plus, every time ya want to break out the sillystring, it turns out the aerosol's all leaked out, and it's just a big letdown.

          • Re:Dude... (Score:4, Funny)

            by BertieBaggio ( 944287 ) * <bob@noSPAM.manics.eu> on Tuesday March 06, 2007 @06:29PM (#18256558) Homepage

            Plus, every time ya want to break out the sillystring, it turns out the aerosol's all leaked out, and it's just a big letdown.

            Yeah, I hear they have pills you can take for that.

            • Close, close: aerosols contain nitrous oxide, while viagra affects nitric oxide. But I still think you should get points for it.

              • Quite correct; sildenafil causes NO to be released into the corpora cavernosa, triggering the release of GC (guanylate cyclase) which leads to vasodilation. Then you have an increased local bloodflow... and where you go from there is nobody else's business.

                I never thought my relatively basic education in anatomy and pharmacology would be used in posts to /. though.

              • Re: (Score:2)

                by Hatta ( 162192 )
                Aerosols don't contain nitrous oxide. They usually contain some sort of hydrocarbon, sometimes halogenated. Nitrous oxide is the propellant in whipped cream, and that's about it. Nitrous oxide is relatively safe, hydrocarbons especially the halogenated ones will fuck up your liver and nervous system. I hope you haven't been huffing silly string.

  • I've seen this before (Score:5, Funny)

    by ciaran.mchale ( 1018214 ) on Tuesday March 06, 2007 @03:49PM (#18254612) Homepage
    A Network Sniffer On Steroids.

    I've seen this before. It starts off with steroids, but pretty soon the network sniffer moves on to crack cocaine. A short while later, he takes a job as a fluffer in midget porn movies to feed his habit.

  • The Errata sniffer, dubbed Ferret, packs more punch than other network sniffers already available, such as Ethereal and Kismet, because it looks at so many different protocols, Graham said. Some at Black Hat called it a "network sniffer on steroids."

    Oh Wowsers! DHCP, SNMP, DNS and HTTP! That's so many! It's a shame Ethereal can only look at these [ethereal.com]!

  • I doubt it. (Score:3, Funny)

    by Kenja ( 541830 ) on Tuesday March 06, 2007 @04:05PM (#18254814)
    I'm willing to bet that most people with a wireless network card dont even know what the term "sniffer" means, much less be able to run one.

  • Wow! 25 protocols? (Score:5, Funny)

    by A Guy From Ottawa ( 599281 ) on Tuesday March 06, 2007 @04:11PM (#18254872)
    Incredible... they support 25 protocols!!!

    And to think I used to use Wireshark/libpcap which is open source, available on almost every platform, is not buggy, and supports hundreds of protocols. It even has a graphical user interface.

    But I think these guys are really on to something...
  • "Windows users".

  • Wireshark, anyone? (Score:4, Informative)

    by drix ( 4602 ) on Tuesday March 06, 2007 @04:21PM (#18254998) Homepage
    Wireshark [wireshark.org] does waaaaay [wireshark.org] more than 25 protocols.

  • Wireshark does NOT do this (Score:3, Informative)

    by Anonymous Coward on Tuesday March 06, 2007 @04:37PM (#18255194)
    What makes this sniffer stand out is not the fact that it can parse different protocol formats -- it's that it collects relevant data in a meaningful summary.

    For example, any sniffer can filter and then parse HTTP traffic, but an analyzer like this one tells you relevant bits like someone's web account names.

  • Ferret on Vista (Score:2, Informative)

    by kantmakm ( 947685 )
    in order to run ferret on vista, you need to run cmd.exe as administrator b4 running ferret from the cmd line.

  • Not on steroids, not for linux. (Score:5, Funny)

    by WK2 ( 1072560 ) on Tuesday March 06, 2007 @05:33PM (#18255854) Homepage
    They include the source code, and say that it "should" compile in linux. However, it uses many Windows-specific variable types. This code will not be cross compatible without a major overhaul.

    This program is not ethereal on steroids. It's more like ethereal and kismet got drunk, had sex, and had a retarded baby, which they named ferret.

  • EVERYTHING about this article is wrong. (Score:5, Interesting)

    by jurgen ( 14843 ) on Tuesday March 06, 2007 @05:51PM (#18256052)
    This is a great example of the worst of slashdot (which isn't saying much)... just about everything in this article as it appears on the main page is wrong, word for word.
    • Category: YRO... why? What does this have to do with "rights"?

    • Title: "Sniffer on Steroids". Nothing steroidal about it... according to the authors of the software it is a buggy piece of shit whipped up quickly to demonstrate a very /specific/ type of traffic analysis for a talk.

    • "Looks for traffic using 25 protocols". Uh no, it doesn't use the protocols, it analyzes them.

    • List of protocols and applications... misses the point entirely as nothing explicitly as any other sniffer can also "capture" all those protocols. The point is that this program looks for and explicitly points to information within those protocol that you probably didn't realize was "seeping" out with those protocols. Mind you, you could still find all that same information with ANY OTHER SNIFFER... there is nothing technologically new about this sniffer. Rather, the authors have made a list of things that "seep" out with various applications and protocols that most people haven't thought of, and have written a simple ordinary sniffer that explicitly includes this list.

    • "Anyone with a wireless card will be able to run it"... uhm, yeah, anyone with a WINDOWS machine and the right kind of wireless card. Doh.

    Even for slashdot, that's pretty bad, eh?

    :j

    • "Looks for traffic using 25 protocols". Uh no, it doesn't use the protocols, it analyzes them.

      Yeah, and if I can read books in two languages, I'm not using the languages, I'm analyzing them, right?

  • I read TFA, but nowhere did it mention anything about encryption. I am assuming that since I use WPA2, I don't need to worry about anyone sniffing my wireless traffic. I think it is irresponsible for this article to not include anything about encryption - spread fear about wireless usage, but don't provide a solution.
  • Awfully nice of a computer security company that, just being a year old, to include PowerPoint slides of their hacking tool on their website! Yeah, right, I guess I'll just download them and assume they're not infected.

    And for that note, they'd better be! It would be even scarrier if said company was actually using powerpoint as an effective means of communication to all their 1337 brethren using windows. Then again, the source is for visual studio... Something about this rubs me the wrong way, anyone

  • There is a very similar OSS research project called Ferret by a prof at UMD. I used to be IT support for an institution he is a member of. (Institute for Systems Research)

    http://www.enre.umd.edu/faculty/cukier.htm [umd.edu]

    http://ferret.sourceforge.net/ [sourceforge.net]

Slashdot Top Deals

Single tasking: Just Say No.

Close