netwrk sniffers and localhost

[Aaron Konstam]

This may be an off the wall question but here goes. When you bring up
the cups web interface ans choose to administer your printers, you are
asked to login with a username and passwd. Usually it is the name root
and roots passwd that works.

Let us say some one has a network sniffer on another machine on your
LAN. Since the root passwd your type is going to localhost network it
should be handled by the loopback interface.

Is it? And if that is so can a sniffer on the LAN see the passwd
entered?
--
=======================================================================
Another good night not to sleep in a eucalyptus tree.
=======================================================================
Aaron Konstam telephone: [phone] e-mail: akonstam(a)sbcglobal.net

[Charles Curley]

On Mon, Oct 01, 2007 at 02:45:30PM -0500, Aaron Konstam wrote:
>  This may be an off the wall question but here goes. When you bring
> up
>  the cups web interface ans choose to administer your printers, you are
>  asked to login with a username and passwd. Usually it is the name root
>  and roots passwd that works.
>  
>  Let us say some one has a network sniffer on another machine on your
>  LAN. Since the root passwd your type is going to localhost network it
>  should be handled by the loopback interface.
>  
>  Is it? And if that is so can a sniffer on the LAN see the passwd
>  entered? 
What is the URL that gets you to the CUPS IF? Mine is
http://localhost:631/, do in my case, yes, it is localhost. If your
name resolution is set up correctly, that should point to the local
loopback device:

[root@dragon ~]# host localhost
localhost has address 127.0.0.1
localhost has IPv6 address ::1
[root@dragon ~]# ifconfig lo
lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:19437 errors:0 dropped:0 overruns:0 frame:0
          TX packets:19437 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:4729638 (4.5 MiB)  TX bytes:4729638 (4.5 MiB)

So, yes, it should go to the local loopback device (LLD).

The whole point of the LLD is that it never goes to the network. With
a properly written LLD, a packet should go to the IP level of the
TCP/IP stack. The LLD's IP code simply swaps the source and
destination addresses and ports, and hands the packet back to the
appropriate higher level protocol (ICMP, TCP, UDP, etc.). (I haven't
looked at the source for Linux's LLD, but that's basically what the
one I wrote did.)

So if the LLD is properly written, a sniffer on another machine should
never see any packets to or from a LLD.

As you probably know, the X protocol uses TCP/IP to communicate
between clients (programs) and servers (displays, keyboards,
etc.). Think of the security implications when X traffic doesn't
travel over the loopback device. A cracker who can scarf your X
packets could watch you compose mash notes to your secretary on
company time in real time. Not very secure! This is one of several
reasons the normal "xhost" authentication is deprecated in favor of
SSH. So, yeah, the TCP/IP security folks have already thought of this
question.

-- 

Charles Curley                  /"\    ASCII Ribbon Campaign
Looking for fine software       \ /    Respect for open standards
and/or writing?                  X     No HTML/RTF in email
http://www.charlescurley.com    / \    No M$ Word docs in email

Key fingerprint = CE5C 6645 A45A 64E4 94C0  809C FFF6 4C48 4ECD DFDB

[Karl Larsen]

Charles Curley wrote:
>  On Mon, Oct 01, 2007 at 02:45:30PM -0500, Aaron Konstam wrote:
>    
> > This may be an off the wall question but here goes. When you bring up
> > the cups web interface ans choose to administer your printers, you are
> > asked to login with a username and passwd. Usually it is the name root
> > and roots passwd that works.
> >
> > Let us say some one has a network sniffer on another machine on your
> > LAN. Since the root passwd your type is going to localhost network it
> > should be handled by the loopback interface.
> >
> > Is it? And if that is so can a sniffer on the LAN see the passwd
> > entered?
> >     
>
>  What is the URL that gets you to the CUPS IF? Mine is
>  http://localhost:631/, do in my case, yes, it is localhost. If your
>  name resolution is set up correctly, that should point to the local
>  loopback device:
>
>  [root@dragon ~]# host localhost
>  localhost has address 127.0.0.1
>  localhost has IPv6 address ::1
>  [root@dragon ~]# ifconfig lo
>  lo        Link encap:Local Loopback  
>            inet addr:127.0.0.1  Mask:255.0.0.0
>            UP LOOPBACK RUNNING  MTU:16436  Metric:1
>            RX packets:19437 errors:0 dropped:0 overruns:0 frame:0
>            TX packets:19437 errors:0 dropped:0 overruns:0 carrier:0
>            collisions:0 txqueuelen:0 
>            RX bytes:4729638 (4.5 MiB)  TX bytes:4729638 (4.5 MiB)
>
>  So, yes, it should go to the local loopback device (LLD).
>
>  The whole point of the LLD is that it never goes to the network. With
>  a properly written LLD, a packet should go to the IP level of the
>  TCP/IP stack. The LLD's IP code simply swaps the source and
>  destination addresses and ports, and hands the packet back to the
>  appropriate higher level protocol (ICMP, TCP, UDP, etc.). (I haven't
>  looked at the source for Linux's LLD, but that's basically what the
>  one I wrote did.)
>
>  So if the LLD is properly written, a sniffer on another machine should
>  never see any packets to or from a LLD.
>
>  As you probably know, the X protocol uses TCP/IP to communicate
>  between clients (programs) and servers (displays, keyboards,
>  etc.). Think of the security implications when X traffic doesn't
>  travel over the loopback device. A cracker who can scarf your X
>  packets could watch you compose mash notes to your secretary on
>  company time in real time. Not very secure! This is one of several
>  reasons the normal "xhost" authentication is deprecated in favor of
>  SSH. So, yeah, the TCP/IP security folks have already thought of this
>  question.
>
>     
    A few weeks ago I got caught sleeping. I figured the hardware 
firewall will keep all hackers away but I was very wrong. A guy bent on 
doing something minor established a ssh connection to my computer and 
then guessed my user name and password. It was very simple. I have since 
changed the password. He just went to my browser and there connected to 
web pages that take hours to come up. I think the guy, and know the web 
pages, are in Germany.

    If he wants to try again it will not work.



-- 

	Karl F. Larsen, AKA K5DI
	Linux User
	#450462   http://counter.li.org.

[Aaron Konstam]

On Mon, 2007-10-01 at 14:28 -0600, Karl Larsen wrote:
>  Charles Curley wrote:
>  > On Mon, Oct 01, 2007 at 02:45:30PM -0500, Aaron Konstam wrote:
>  >   
>  >> This may be an off the wall question but here goes. When you bring up
>  >> the cups web interface ans choose to administer your printers, you are
>  >> asked to login with a username and passwd. Usually it is the name root
>  >> and roots passwd that works.
>  >>
>  >> Let us say some one has a network sniffer on another machine on your
>  >> LAN. Since the root passwd your type is going to localhost network it
>  >> should be handled by the loopback interface.
>  >>
>  >> Is it? And if that is so can a sniffer on the LAN see the passwd
>  >> entered?
>  >>     
>  >
>  > What is the URL that gets you to the CUPS IF? Mine is
>  > http://localhost:631/, do in my case, yes, it is localhost. If your
>  > name resolution is set up correctly, that should point to the local
>  > loopback device:
>  >
>  > [root@dragon ~]# host localhost
>  > localhost has address 127.0.0.1
>  > localhost has IPv6 address ::1
>  > [root@dragon ~]# ifconfig lo
>  > lo        Link encap:Local Loopback  
>  >           inet addr:127.0.0.1  Mask:255.0.0.0
>  >           UP LOOPBACK RUNNING  MTU:16436  Metric:1
>  >           RX packets:19437 errors:0 dropped:0 overruns:0 frame:0
>  >           TX packets:19437 errors:0 dropped:0 overruns:0 carrier:0
>  >           collisions:0 txqueuelen:0 
>  >           RX bytes:4729638 (4.5 MiB)  TX bytes:4729638 (4.5 MiB)
>  >
>  > So, yes, it should go to the local loopback device (LLD).
>  >
>  > The whole point of the LLD is that it never goes to the network. With
>  > a properly written LLD, a packet should go to the IP level of the
>  > TCP/IP stack. The LLD's IP code simply swaps the source and
>  > destination addresses and ports, and hands the packet back to the
>  > appropriate higher level protocol (ICMP, TCP, UDP, etc.). (I haven't
>  > looked at the source for Linux's LLD, but that's basically what the
>  > one I wrote did.)
>  >
>  > So if the LLD is properly written, a sniffer on another machine should
>  > never see any packets to or from a LLD.
>  >
>  > As you probably know, the X protocol uses TCP/IP to communicate
>  > between clients (programs) and servers (displays, keyboards,
>  > etc.). Think of the security implications when X traffic doesn't
>  > travel over the loopback device. A cracker who can scarf your X
>  > packets could watch you compose mash notes to your secretary on
>  > company time in real time. Not very secure! This is one of several
>  > reasons the normal "xhost" authentication is deprecated in favor of
>  > SSH. So, yeah, the TCP/IP security folks have already thought of this
>  > question.
>  >
>  >   
>      A few weeks ago I got caught sleeping. I figured the hardware 
>  firewall will keep all hackers away but I was very wrong. A guy bent on 
>  doing something minor established a ssh connection to my computer and 
>  then guessed my user name and password. It was very simple. I have since 
>  changed the password. He just went to my browser and there connected to 
>  web pages that take hours to come up. I think the guy, and know the web 
>  pages, are in Germany.
>  
>      If he wants to try again it will not work.
>   
You need a better passwd. I have tried the latest cracking programs on mine for 
3 days and it was never cracked.
--
=======================================================================
SEMPER UBI SUB UBI!!!!
=======================================================================
Aaron Konstam telephone: [phone] e-mail: akonstam(a)sbcglobal.net

[Karl Larsen]

Aaron Konstam wrote:
>  On Mon, 2007-10-01 at 14:28 -0600, Karl Larsen wrote:
>    
> > Charles Curley wrote:
> >     
> >> On Mon, Oct 01, 2007 at 02:45:30PM -0500, Aaron Konstam wrote:
> >>   
> >>       
> >>
> >     A few weeks ago I got caught sleeping. I figured the hardware 
> > firewall will keep all hackers away but I was very wrong. A guy bent on 
> > doing something minor established a ssh connection to my computer and 
> > then guessed my user name and password. It was very simple. I have since 
> > changed the password. He just went to my browser and there connected to 
> > web pages that take hours to come up. I think the guy, and know the web 
> > pages, are in Germany.
> >
> >     If he wants to try again it will not work.
> >
> >     
>
>  You need a better passwd. I have tried the latest cracking programs on mine for 
>  3 days and it was never cracked.
>     
    Well my old password was my last name :-)
I suspect it took less than 30 seconds to get that. But now it is caps 
and lower case and numbers and 9 characters long. It will be a lot harder.


>  --
>  =======================================================================
>  SEMPER UBI SUB UBI!!!!
>  =======================================================================
>  Aaron Konstam telephone: [phone] e-mail: akonstam(a)sbcglobal.net
>
>     

-- 

	Karl F. Larsen, AKA K5DI
	Linux User
	#450462   http://counter.li.org.

[Ian Chapman]

Karl Larsen wrote:

>     Well my old password was my last name :-)
>  I suspect it took less than 30 seconds to get that. But now it is caps 
>  and lower case and numbers and 9 characters long. It will be a lot harder. 
Karl, you probably don't want to go publishing any details of your 
passwords on public mailing lists.

-- 
Ian Chapman.

[Chris Mohler]

On 10/1/07, Karl Larsen <k5di(a)zianet.com&gt; wrote:

>      A few weeks ago I got caught sleeping. I figured the hardware
>  firewall will keep all hackers away but I was very wrong. A guy bent on
>  doing something minor established a ssh connection to my computer and
>  then guessed my user name and password. It was very simple. I have since
>  changed the password. He just went to my browser and there connected to
>  web pages that take hours to come up. I think the guy, and know the web
>  pages, are in Germany.
>
>      If he wants to try again it will not work. 
The bot that hacked you may have installed a rootkit.  Here is a
pretty comprehensive guide to installing rkhunter on f7:
http://optics.csufresno.edu/~kriehn/fedora/fedora_files/f7/howto/rkhunter...

I have not installed rkhunter on F7 - I can't vouch for the accuracy
of the guide.

Chris

[Karl Larsen]

Chris Mohler wrote:
>  On 10/1/07, Karl Larsen <k5di(a)zianet.com&gt; wrote:
>
>    
> >     A few weeks ago I got caught sleeping. I figured the hardware
> > firewall will keep all hackers away but I was very wrong. A guy bent on
> > doing something minor established a ssh connection to my computer and
> > then guessed my user name and password. It was very simple. I have since
> > changed the password. He just went to my browser and there connected to
> > web pages that take hours to come up. I think the guy, and know the web
> > pages, are in Germany.
> >
> >     If he wants to try again it will not work.
> >     
>
>  The bot that hacked you may have installed a rootkit.  Here is a
>  pretty comprehensive guide to installing rkhunter on f7:
>  http://optics.csufresno.edu/~kriehn/fedora/fedora_files/f7/howto/rkhunter...
>
>  I have not installed rkhunter on F7 - I can't vouch for the accuracy
>  of the guide.
>
>  Chris
>
>     
I looked and it is a special case of selinux now being run from Fresno 
State. I think there may be something added to Thunderbird. Sometimes 
not often when I read something on the web a full screen panel comes on 
with no curser and all you can do is turn off the computer.

This is an irritant. I would like to find it and stop the problem.



-- 

	Karl F. Larsen, AKA K5DI
	Linux User
	#450462   http://counter.li.org.

[Chris Mohler]

On 10/2/07, Karl Larsen <k5di(a)zianet.com&gt; wrote:
>  Chris Mohler wrote:
>  > On 10/1/07, Karl Larsen <k5di(a)zianet.com&gt; wrote:
>  >
>  >
>  >>     A few weeks ago I got caught sleeping. I figured the hardware
>  >> firewall will keep all hackers away but I was very wrong. A guy bent on
>  >> doing something minor established a ssh connection to my computer and
>  >> then guessed my user name and password. It was very simple. I have since
>  >> changed the password. He just went to my browser and there connected to
>  >> web pages that take hours to come up. I think the guy, and know the web
>  >> pages, are in Germany.
>  >>
>  >>     If he wants to try again it will not work.
>  >>
>  >
>  > The bot that hacked you may have installed a rootkit.  Here is a
>  > pretty comprehensive guide to installing rkhunter on f7:
>  > http://optics.csufresno.edu/~kriehn/fedora/fedora_files/f7/howto/rkhunter...
>  >
>  > I have not installed rkhunter on F7 - I can't vouch for the accuracy
>  > of the guide.
>  >
>  > Chris
>  >
>  >
>  I looked and it is a special case of selinux now being run from Fresno
>  State. I think there may be something added to Thunderbird. Sometimes
>  not often when I read something on the web a full screen panel comes on
>  with no curser and all you can do is turn off the computer.
>
>  This is an irritant. I would like to find it and stop the problem. 
I'm not sure what you mean - rkunter is a command-line tool to check
for rootkits.  Per the guide, you have to disable selinux to install
it, but you should then re-enable selinux post-installation.  It has
nothing to do with Thunderbird.

Chris