Big Brother Awards
quintessenz search  /  subscribe  /  upload  /  contact  
/q/depesche *
RSS-Feed Depeschen RSS
Hosted by NESSUS
<<   ^   >>
Date: 2002-08-20

WLANs: Spass mit tcpdump

Eine der ganz einfachen Geschichten, die das drahtlose neue Leben schrieb. Das ist schon lustig: ein öffentlich zugängliches Netzwerk, das für jede Aktivität Geld verlangen will, aber tcpdump zulässt. [post/scrypt: Wir meditieren selbst noch über die Tragweite dieser Aussage]
-.-. --.- -.-. --.- -.-. --.- -.-. --.- -.-. --.- -.-. --.-

By Lincoln D. Stein New Architect September 2002

A few days ago, I was waiting at Delta gate D13 at LaGuardia airport when I noticed something odd. The connect light on my wireless (IEEE 802.11b or "Wi-Fi") card lit up, indicating that it had found an access point somewhere to bind to.


Looking around, I spied the doorway of the nearby American Airlines Admiral's Club. As innocently as I could, I walked toward the door, keeping my eye on the signal power. As I moved closer, the signal increased. Popping up a Web browser confirmed my suspicion. Instead of seeing my usual home page, I was taken to a login page for a wireless Internet service that operates out of Starbucks, several hotel chains, and, yes, the American Airlines Admiral's Club. Bingo.

I thought I would take advantage of this windfall by reading my email and surfing the Net. Unfortunately, the service wasn't free, and the subscription fee was too rich for my blood.


I popped up my favorite network sniffing tool, the tcpdump application that's found on all Unix systems. A few seconds later, I was listening in on all of the wireless traffic in the Admiral's Club network.


I detected three users on the network. One was actively reading his email using POP. I intercepted his incoming and outgoing messages, and because POP sends passwords in the clear, I also captured his login username and password. The second user wasn't using the Web actively, but his laptop was checking his office every five minutes for new mail. I soon had his login information as well.

The third user was browsing the Web. I could see the address and content of each of the Web pages he accessed, along with all of his cookies and the contents of the online forms he submitted. Occasionally, he connected to a secure site using SSL, and then all I saw was encrypted gibberish. Well, at least someone was doing their job.

Because the second computer user wasn't actively working on the network, I borrowed his connection for a while. I noted the IP address of his laptop and assigned it to my own machine. Seconds later, I had full Internet access. Having stolen a legitimate owner's IP address, the registration server now thought that I was a paying customer. I spent the next few minutes surfing the Internet freely. If the user noticed anything, he would only have thought that his Internet connection went down for a short period of time.


Ubiquitous public mobile networking is the manifest destiny of the Internet, and nothing will stand in its way. To work, the public mobile Internet has to be open, letting people join and drop out at will. This means that public wireless communication will be vulnerable to sniffing, so there's no longer any excuse for failing to use end-to-end encryption for email, Web, and login protocols.

Encryption must become easier, more transparent, and ubiquitous. If it doesn't, the innocent-looking fellow with the laptop at American Airlines gate D13 is sure to find you, too.

Lincoln is an M.D. and Ph.D. who designs information systems for the human genome project at Cold Spring Harbor Laboratory in New York, NY. You can contact him at

- -.-. --.- -.-. --.- -.-. --.- -.-. --.- -.-. --.- -.-. --.-
edited by Harkank
published on: 2002-08-20
comments to
subscribe Newsletter
- -.-. --.- -.-. --.- -.-. --.- -.-. --.- -.-. --.- -.-. --.-
<<   ^   >>
Druck mich


Eintritt zur Gala
sichern ...

25. Oktober 2023
Big Brother Awards Austria
q/Talk 1.Juli: The Danger of Software Users Don't Control
Dr.h.c. Richard Stallman live in Wien, dem Begründer der GPL und des Free-Software-Movements
bits4free 14.Juli 2011: OpenStreetMap Erfinder Steve Coast live in Wien
Wie OpenStreetMaps die Welt abbildet und was ein erfolgreiches Crowdsourcing Projekt ausmacht.