1. Matthew Sullivan Information Assurance Student Group March 8, 2010

3.  Intercepts traffic  Alters traffic  Does lots of scary things  Has powerful (and easy to use) filtering language that allows for custom scripting  Can be “unified” or “bridged”

4. Victim ComputerThe Interwebz Ettercap Unified Victim ComputerThe Interwebz Ettercap Bridged Network Card 1 Network Card 2 Network Card 1

5.  Ettercap has a powerful password sniffer, and can find and display passwords in following protocols:  TELNET, FTP, POP, IMAP, rlogin, SSH1, ICQ, SMB, MySQL, HTTP, NNTP, X11, Napster, IRC, RIP, BGP, SOCKS 5, IMAP 4, VNC, LDAP, NFS, SNMP, Half-Life, Quake 3, MSN, YMSG  Darn, that’s a LOT of protocols I can steal passwords from!

6. (show demo)

7.  Ettercap can intercept DNS requests, check against its own configuration, and reply back with an illegitimate IP  Fake response occurs before the real response can reach the target, so the victim computer ignores it  Can be done easily in “unified” mode, no bridging required

8.  So what does this look like? Victim: where is www.iastate.edu? Ettercap: do I have a record for this? If so, reply with an illegitimate IP address Victim: I received an answer to my request for www.iastate.edu, so all is well Legit DNS Server: I know this record, replying with legit IP Victim: I just got another response for my request, but it’s already been fulfilled, so I’m ignoring this response Victim ComputerLegit DNS Server Ettercap

9.  This attack is perfect for situations where bridging isn’t possible (perhaps the attacker doesn’t have physical access that high up in the network)  Isn’t foolproof though SSL-protected websites will present certificate errors If the line is fast enough, the legitimate DNS server can reply before Ettercap has had time to process and submit its own res

10.  So by now you know that Ettercap can search packets and modify their contents But that’s not all! It can drop packets too  For example, a filter can be set up to watch for DHCP REQUEST Perhaps from all computers Perhaps just from 00:1d:24:11:f4:3C  If it matches what we are looking for, we just drop the packet, and they never will receive an IP address to get onto the network

11.  Ettercap can sniff and modify SSL packets by sending an unsigned certificate to the victim.

12.  In an online study conducted among 409 participants, the researchers found that the majority of respondents would ignore warnings about an expired Secure Sockets Layer (SSL) certificate. The more tech-savvy the user, the more likely they would be to ignore it, the study found.  50 percent of Firefox 2 users polled who could identify the term "expired security certificate," 71 percent said they would ignore the warning.  Of the 59 percent of Firefox 2 users who understood the significance of a "domain mismatch" warning, 19 percent said they would ignore the hazard.  The Carnegie Mellon team conducted a second study, with 100 participants and under lab conditions. The participants were shown an invalid certificate warning when they navigated to a bank Web site. 69 percent of technologically savvy Firefox 2 users ignored an expired certificate warning from their bank.  * Taken from http://news.cnet.com/8301-1009_3-10297264-83.htmlhttp://news.cnet.com/8301-1009_3-10297264-83.html

13.  Last year, the certificate for WebCT was not renewed before its expiration  ITS was immediately inundated with calls and requests for support; employees walked users through how to ignore the certificate error  The certificate remained invalid for two days  Such problems train the average user to simply ignore these types of warnings “I’ve seen this before, and they just told me to click ignore last time.”

14.  What’s the take-away? It’s easy to sniff SSL with an invalid certificate People ignore SSL warnings Most will continue onwards anyway  Remember: if you encounter an invalid certificate, be careful and use your head!

15.  “SSH Downgrade Attack”  Some SSH2 servers are backwards- compatible with SSH1  These servers report their version as ssh-1.99

16.  Using a custom Ettercap filter, we intercept the server’s response: replace("SSH-1.99", "SSH-1.51")  Now the SSH client believes the server only supports SSH1 and establishes an SSH1 connection

17.  Ettercap sees the entire handshake and steals the login credentials  With some more custom scripting, Ettercap can even decrypt and dump the SSH1 connection data

18. Did I hear a “no” answer out there? Alright, let’s bring out the big guns…

19.  You’ve been using my Wi-Fi access point called “IASTATE”  Jeff has been busy ‘deauthing’ the real IASTATE access point, which makes your computer wander over to my AP instead  Have you logged in to Gmail, CyMail, WebCT, or Facebook since being here?

20. (show demo)