Playing back wireless traffic

[Farmikol0t]

That is rather scary....

Agreed - it's full control over the account.

Have cookies got anything to do with it?

Don't know but it works even on a logged-out account (i.e. any cookies presented would be expired so they shouldn't work).

just what is getting exploited or circumvented?

View of any existing mail message and the capability to send new mail on web mail accounts.

Does this only affect e-mail?

As far as I can tell.

Given the number of security "wannabes" out there I find it very strange that something so fundamental has gone unnoticed for so long

Agreed.

[marsbarz]

not mitm, not SSL problem, and not cookie replay......

so what is it then....not not not, but what? you are saying that you can walk into any coffee shop (unencrypted) and gain the ability to send and receive out of any web mail account....this is definitely someting new, if it's real.

"Program" name please?

[nihil]

I still suspect cookies............. if they hold the password (and some do) that would explain it all?

The session would be expired, but the password would be the same?

[ngboot]

Farmik0lot said you could do it with many top mail providers. I am confused here, since most of these are professionals. If 'any' is included in this, that counts gmail. Do all of these mail servers use stale cookies?

[Net2Infinity]

Is it just me, or has he yet to explain how he is capturing the traffic. As in 2 wireless clients connected to the same unsecured AP and he is capturing the traffic from an unsecured wireless ap.

[ngboot]

Perhaps the coworker was showing off and bogusly captured his OWN information?

[d34dl0k1]

You can't replay SSL traffic without the private keys involved. End of story.

MITM attacks are possible over wireless. If the web applications digital certificate was signed by a known CA, then the MITM would have caused the browser to prompt the user to verify the cert. If they accepted, game over: the traffic is clear to the attacker. This is because the attacker would have replaced the public key with their own.

Ask your friend how many wireless interfaces they have in that laptop. Or, ask them what they did. You know what they say about assumptions.

[ngboot]

I cant really remember what they said about assumptions....

It was something on the line of "assume"

You make a/an "something" out of u and me.

[Aardpsymon]

an "ass" out of "u" and "me"

and I'm still with d34dl0k1 on this one. ANY half decent authentication system would drop replayed traffic AS replayed traffic, IE - out of date and not a current session. Its not as if the same thing wasn't possible on wired networks for years without switches.

[Farmikol0t]

I still suspect cookies............. if they hold the password (and some do) that would explain it all?
The session would be expired, but the password would be the same?

Not sure, an expired cookie wouldn't work for top webmail providers, so it appears to be something else.

Is it just me, or has he yet to explain how he is capturing the traffic. As in 2 wireless clients connected to the same unsecured AP and he is capturing the traffic from an unsecured wireless ap.

Capturing traffic with Kismet. There is no AP in the laptop, just a wireless card not acting as an AP. The machine that logs to the account is connecting to the legitimate AP.

Perhaps the coworker was showing off and bogusly captured his OWN information?

No, because I tried it myself independently.

You can't replay SSL traffic without the private keys involved. End of story.

Ask your friend how many wireless interfaces they have in that laptop. Or, ask them what they did. You know what they say about assumptions.

One wireless card, no AP. The authentication is SSL encrypted.

an "ass" out of "u" and "me"

and I'm still with d34dl0k1 on this one. ANY half decent authentication system would drop replayed traffic AS replayed traffic, IE - out of date and not a current session.

Major webmail providers presumably have a half decent authentication system.

If you could tell me what "Windows program" was used to analyze the traffic and log you into the authenticating system it would help a lot....If the password or hash is not presented in the clear, then for well-known web mail systems it would be a big deal (and I believe impossible) to authenticate if provided with the traffic only.

Have a nice day.

Thanks for telling me to have a nice day. The reason that I posted the question in the first place is because I don't understand what is going on.