1

I'm connected to the internet via a mikrotik server network.

Recently, I read about that scaring application named Cain & Abel and all the capabilities it offered for malicious users.

I don't know if anyone on my network is using or even aware of such application but my questions are:

1- How to protect myself from this program?

2- How to know if someone using such application against me?

3- Is Tor Bundle capable of protecting me from Cain & Abel?

4- If I filled my e-mail password via SSL page, Can Cain & Abel collect it?

5- Is it safe to use SKYPE or Yahoo Messenger voice chat if some one using Cain & Abel on my network?

2 Answers 2

0

Cain and Abel is essentially a auditing and attack suite, that when installed within your network, is capable of gathering password and other security specific information.

It is a utility, so you (or a malicious user who has already broken into your network) have to install it and ask it to audit whatever it is you want. its more about attacking your internal network. see a list of capabilities here: http://en.wikipedia.org/wiki/Cain_and_Abel_%28software%29

there is no real defense per se, other than preventing people from getting the kind of access necessary to install it on your network in the first place.

it does have some wifi penetration utilities so someone can use it to break into your wifi. your best bet there is to use WPA2 in AES only mode (no TKIP) with a long strong password, and perhaps even a mac filter (weak protection by itself).

you would only know that its being used if you saw the process running or intercepted suspicious traffic, perhaps with an IDPS.

no tor would have no affect on C&A because its not an internet-bourne thing. be more afraid of your neighbor than a hacker in another country.

no it would probably not affect SSL connections.

yes, skype is probably 'safe' to use, but your conversations may be recorded.

the utility does have a network sniffer built in, so it can capture any kind of traffic that it wittnesses, but that in itself may not be a huge risk for you.

just keep it off your local network, and your wifi, and you have nothing to worry about, unless someone is already inside your net.

3
  • Concerning your answer regarding Tor bundle isn't the ability of Tor to add several layers of encryption to your traffic will prevent Cain & Abel user from getting any benefit from sniffed packet since it will be encrypted therefore if I send or received data via Tor it will be safe?
    – user269742
    Nov 7, 2013 at 11:12
  • TOR does encrypt some traffic, but only traffic going to other networks, so it would have some effect in protecting skype and other web communication, but most of what C&A is designed for is profiling your local network so the attacker can gain even greater access, and local connections wouldn't go through tor. Nov 7, 2013 at 13:15
  • Note, as I said in the post the best protection is preventing it from getting a toehold in your network, but many of the audits/attacks its capable of have the potential for mitigation, if you study up on them. for instance you can disable password caching to prevent several attacks that reveal stored passwords. Nov 7, 2013 at 13:43
0

there is no real defence because Winpcap Packet Driver to control the wireless network card. Access points and ah-hoc networks are enumerated using 802.11 OIDs from Windows DDK at intervals of five seconds and WLANs parameters (MAC address, SSID, Vendor, WEP Encryption, Channels.... ) are displayed in the scanner list.

1
  • 1
    Hi Magan, it is unclear how your answer exactly addresses the question- perhaps you could edit it to match the questions enumerated point format?
    – bertieb
    Jul 8, 2015 at 12:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .