Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 5 down vote favorite
1

I am on a shared LAN where everyone should have equal access and, hopefully, not be able to bother anyone else's activity.

The person who has a desktop has the router in their room so they can plug in directly; everyone else is using the WiFi. Let's just say I don't trust the intentions of the person with the desktop.

Everyone in the house - desktop user included - doesn't know how to use basic tools like tcpdump, nmap, and netstat, so this is what I usually use to look for malicious activity.

The problem is, I only have a superficial knowledge of networking and am unsure if other packet inspection could be going on. The routing tables always look normal, but I did notice he installed dragon IDS. The website for this product claimed it is able to monitor LAN packets and send emails for certain events.

I know that an IDS has uses for the box it is on regarding security, but can it be used maliciously?

share|improve this question
2  
1  
Are you a/the sys/network admin and have control & authority over the network? If not, there's little that you can really do. – Joe Internet May 30 '11 at 6:05
1  
sure, i have control of the router to the extent that i am the only one that knows the admin pass. I can see that there is no routing table manipulation or undesired port forwarding, but am not sure if the physical access of the ethernet ports would make for something i am completely unaware of. I can trust the network up to the point that the desktop is plugged into the router we all use, and i do not desire to monitor HIS traffic or put RAT just so i can find out. – bboyreason May 30 '11 at 6:13
In the old days of CheaperNet, we used to send packets containing various known exploits for network stacks to nonexistant MAC addresses, so these are filtered out by network hardware -- unless you enable promiscuous mode. – Simon Richter May 30 '11 at 16:16
1  
Precisely, and to kick them off the network in one step (I should have added, this was at a LAN party). On a more serious note, pinging a device with a wrong MAC address is still a pretty reliable test for promiscuous mode. – Simon Richter May 31 '11 at 10:13
show 1 more comment

3 Answers

up vote 6 down vote accepted

Even if you can trust everyone in your own network, there's also the internet which could be at least equally as scary because we don't really know who's all observing on the outside (so it's better to just assume that observation is occurring).

One of the very best ways you can go about protecting yourself is to use a really good VPN such as OpenVPN:

  OpenVPN (free and open source)
  http://www.openvpn.net/index.php/open-source.html

You'll need to have a computer running somewhere that can act as your OpenVPN server, and then whenever you connect with the OpenVPN client your data can be encrypted so that observers can't see what you're doing -- they'll only be able to see that there's a stream of [seemingly] random gibberish which they will undoubtedly (and correctly) assume is encrypted data.

share|improve this answer
1  
can this vpn server be running on a LAN that isnt necessarily trusted? Like are the packets encrypted from the server to the router to the WAN? – bboyreason May 30 '11 at 6:04
2  
Yes, but ideally you should be running the VPN server on a computer that you are in complete control of. As for the client, you should be running it on a computer that you're also in complete control of. Everything else in between won't matter then. – Randolf Richardson May 30 '11 at 6:07
up vote 3 down vote

If the router lets you each see all the network packets (which would be the case on your wireless side anyway) it would be very easy to sniff all packets.

You have control of the router though, so realistic scenario is as follows:

If this guy is malicious he could easily intercept (or alert on) anything you do using an unencrypted link, this could include sniffing passwords etc. So always use encrypted comms.

Httpseverywhere plugin for FireFox works well to help enforce this.

If you haven't been doing this it could be worth changing all your online passwords!

If you want to migrate this to security.stackexchange.com you can get a much wider range if answers from security professionals.

share|improve this answer
thanks for the tip on security.stackexchange, i should have guessed there was one. I used httpseverywhere for firefox before, but it only enforced https on very few sites. It didnt seem to work on sites I thought it would, like sites that had https alternatives. Maybe I just set it up wrong, it was a while ago. – bboyreason May 30 '11 at 11:31
@bboy - there are still a lot of sites that it doesn't know but it keeps on being developed and is an excellent first step. – Rory Alsop May 31 '11 at 7:33
up vote 1 down vote

Another way to get your pricacy (at least on http protocol) is using https (for example, you can configure your email, such as gmail or hotmail to work on https protocol). It uses another TCP port and all your https trafic is encripted, a MITM(man-in-the-midle) attack such as sniffing the router will read the content of your email messages.

share|improve this answer
yeah but isnt only the login encrypted on gmail? And MITM can work around SSL from what I have tested (i was able to see my own user/password in cleartext from a major bank website using SSL). The only way I know to prevent this is to check the routing tables first. Plus, for this situation, MITM is not going to be used unless it is part of some commercially available software that this person could purchase at Bestbuy or something like that. – bboyreason May 30 '11 at 11:56
1  
@bboyreason: Gmail introduced SSL for the entire webmail session in July 2008 and made it the default in January 2010. (Gmail IMAP and Message Submission have always had enforced SSL.) MITM does not work with SSL if the user (i.e. you) has any common sense to actually read the error messages instead of blindly clicking "Okay, ignore SSL error". – grawity May 30 '11 at 13:14
1  
@grawity: with sslstrip you dont get error/cert invalid msgs, at least when i used it against os x firefox 3. – bboyreason May 30 '11 at 14:28
2  
@bboyreason: with sslstrip you get an HTTP connection; it 'strips' the HTTPS. So as long as you make sure you're using HTTPS it should be fine. – André Paramés May 30 '11 at 14:49

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.