Antisniff

I have recently gotten myself into some trouble with my schools network security and the police had to get involved. I want to see if I can prevent my types of doings from happening again. Can anyone direct me to a product page for the latest version of Antisniff? I want to somewhat set things right and just go back to school. The school's tech said there is no way to prevent packet sniffing. I've heard otherwise. I also have a felony charge that is based on me changing mac addresses. Correct me if I'm wrong, but I've always heard MAC addresses couldn't be altered. I really want to set things right help would be much appreciated.

Well if your school is using hubs and not switches... then no, there is no way to avoid packet sniffing. Packet sniffing is totally independent to the rest of the network and works by altering how your network card works to capture all the traffic that passes by it, instead of doing what it normally does, and ignore anything not specifically directed to it's address.

MAC addresses can be changed, and quite easily. Research MAC address 'spoofing' to find out more.

Oh, and play nice at school...sheesh

Boys will be boys. A felony, that hurts. Most admins are overworked
and stressed. You must've got yours pretty PO'ed.

MAC's can be altered. Virtualized if you will. It's difficult to detect
sniffing. Some sniffers, ettercap for one, can detect ARP poisoning.
Beyond that, I don't know.

Just curious, how'd you get caught?

Hi brokencrow,

My guess is they scan the system for network cards in promiscuous mode that shouldn't be..................... a bit of a dead giveaway I would have thought?

I seem to recall a tool called NEPED............ it is an acronym for something... I think the PED bit is "promiscuous ethernet detection"?

The "changed MAC addresses" sounds like something to do with either the sniffing tool or the antisniffer:

Quote:

---

The proposed technique uses three phases to detect the sniffing hosts in an Ethernet network. In the first phase, the ARP caches of the sniffing hosts are corrupted. In the second phase, TCP SYN request connections packets are sent to each host in the network using fake IP and MAC source addresses.Finally, by analyzing the responses of the hosts, all hosts running sniffers are detected. Four anti-sniffers, PMD [18], PromiScan [17], L0pht AntiSniff [19] and SupCom anti-sniffer, are tested and the evaluation results show that SupCom AntiSniffer succeeded to detect more sniffing hosts than the other antisniffers.

---

Another possibility is if you connect an unauthorised device to the network. It will show up as an unrecognised MAC which someone might assume is an authorised device with a spoofed MAC?


@ mates

AntiSniff is by L0pht Heavy Industries. They packed in around 2000, so there isn't a current version. AFAIK the last supported OS was NT 4.0 SP3 although I expect it would work with later SPs and possibly NT 5.0 (Win2000).

Quote:

---

The school's tech said there is no way to prevent packet sniffing.

---

He probably means in your environment. You could lock the place down but it would be very much to the detriment of the educational process. It would be a physical security solution.

I am not aware of any applications that actually prevent sniffing.......... they just try to detect it, and it seems your school already has that in place.

Just a suggestion. If you have a felony hanging over your head, I would drop the idea of antisniff, or any other tools. Just go straight until they forget about you (graduation time), concentrate on your studies and hope this doesn't ruin your life. Sorry, but I have kids about your age and I will tell them the same.

LOL. OK man…
Let me give you some much needed advice. When I was in high school I did the exact same thing you did. LEAVE IT ALONE. By the time I got done I had 7 felonies on my head… the only reason I am not in prison right now is because I made a deal with the super intendment that I would fix the holes. And if I graduated valedictorian they would drop all charges…. BOY I STUDIED HARD.
DON'T DO ANYTHING MORE. you are being watched....

good luck

Hmmm,

Let's assume that mates is telling the truth?

Quote:

---

I also have a felony charge that is based on me changing mac addresses. Correct me if I'm wrong, but I've always heard MAC addresses couldn't be altered.

---

That suggests to me that he doesn't know how to do it?:)

Now, if you mess around with the MAC addresses on a network the chances are that you will screw it up. That would be classed as damage and probably is a felony in the USA. If he didn't do it, then they won't have any evidence, and I do not see how running a simple packet sniffer would have that effect, even if it were defective?

Come to think of it I haven't heard of any malware that would do such a thing either........... has anyone?

I think that mates might be looking at a defence along the lines of: "The school should have installed software to prevent me from doing this, that is contributory negligence"

Forget it son, I am no ADA but if I were I would immediately shoot you down by saying: "They did........they have an AUP and software to detect violations of it, which is how you got caught"

There must be some amendment to the Constitution along the lines of "the right to be stupid"........... well, they didn't violate your constitutional rights? :D

OK I am not a lawyer, much less a US one, but I would suggest a defence along these lines:

1. The student is authorised to access the School's network so there is no case of illegal entry (that is a felony I would imagine).
2. He ran unauthorised software which is contrary to the School's IT AUP, but that is not a felony, per se.
3. Can you prove that he actually changed mac addresses rather than spoofed them?
4. Can you prove material damage?
5. Simple packet sniffing software does not "change" anything.
6. Can you prove criminal intent? That would be why the case would not even get as far as a felony charge over here in the UK. It would be impossible, and the police would tell the School that it is an internal disciplinary matter and if there is any damage then it is a civil court matter.
7. How can you be sure that these "changed" MAC addresses are a result of what the student did rather than that of your anti-sniffer software, which almost certainly uses this technique?
8. Changing the NIC card to promiscuous mode is a valid setting and does not damage it.

Of course, that does assume that mates is telling the truth.;)

Could be a script kiddie who was fooling around with an ARP spoofing
tool. By and large any ARP spoofing's going to change your MAC addy,
yes? Must've done it one time too many from the sound of it. OTOH,
if he ran SMAC, good luck...

I think there's a tendency when one gets into 'security' tools to not
realize how powerful they are and what they're doing to others. Years
ago when I got my hands on nmap, I did a few things I'd hesitate to
do now. But we won't go there...

:)

That's very true.

There seems to be a fair degree of naivety amongst these guys as well, as cases crop up on a daily basis?

I think that these guys could do worse than snag a copy of Tsun Tsu's "Art of Warfare" and read it until they understand the principles; particularly:

"If I know nothing about myself and nothing about my enemy, I will surely lose.
If I know everything about myself and nothing about my enemy, my chances of winning are even.
If I know everything about myself and everything about my enemy, I shall surely prevail."

Why can't these guys realise that unless you know otherwise for certain, you must assume that any given network is secured or at least monitored?

Hell, you have local laws, contracts and possibly even Federal laws that require school systems to be protected and monitored? Also, the admins are custodians of the IT assets of an educational establishment.......... it is their duty to protect those assets.

I would be the first to admit that I am a bit of a skiddie myself, in that I like playing with new tools and applications:D However I must have over 20 personally owned machines to do this on, and I never mess about on any of my "production" machines.

I just hope that this guy did not try to run his stuff against the School's administrative network:eek:

Well I wanted to see if I could prevent this from occurring again because a big fear overcame the staff about compromised info. I had been doing it about 6 months and had no problems. I somehow got rolled up because the tech said there were some network failures and he looked into it and claimed it was my fault. There was also an outbreak of other children using sniffers and just running it in promiscuous, I did some ARP poisoning, and some other things. The felony is based on the destruction of government property and I didn't, not that I'm aware of change any MAC addresses only did some spoofing. But seriously aren't MAC addresses permanently stored on NICs? They never told me how i got rolled up and they never told me why I have 3 felonies because the police knew less about the network than I did. I don't want to complain because I'm getting informal probation, and I want to see if i can go back to school. I never intended any malicious activities i just didn't have an ellaborate network to play with at home.

Quote:

---

Well I wanted to see if I could prevent this from occurring again because a big fear overcame the staff about compromised info.

---

You can't without locking down the system to such an extent that it would be pretty useless for an educational establishment. The administrative network should be separate from the general school network and totally inaccessible to the students.

Quote:

---

There was also an outbreak of other children using sniffers and just running it in promiscuous

---

Well how else will you run a sniffer?

Quote:

---

the tech said there were some network failures and he looked into it and claimed it was my fault.

---

How? but you do mention "other children using sniffers".............. I wonder where they got that idea from?......... perhaps you ran off at the mouth?

You must realise that the crucifiction of ringleaders and instigators is a Western tradition that dates back over 2,000 years? :lildevil:

Quote:

---

The felony is based on the destruction of government property

---

I honestly don't see how you could have done that........... if you had destroyed data/corrupted files by screwing up, surely they would have said so? that doesn't have anything to do with MAC addys AFAIK?

Quote:

---

never told me why I have 3 felonies

---

Don't you have a lawyer....... what is "discovery"? Unless American law has totally degenerated, when you are arraigned they have to tell you where, when and how?

Quote:

---

I don't want to complain because I'm getting informal probation

---

Que? don't you have a thing called "due process" over there?:confused:

Quote:

---

But seriously aren't MAC addresses permanently stored on NICs?

---

Yes, one is assigned when the device is manufactured, but that doesn't mean it will be the one that is used on your network. Also, some of them have the facility to let you change the pre-assigned one on the EEPROM chip.

Quote:

---

I want to see if i can go back to school.

---

Yes, but a different one............... you have been identified as a troublemaking ringleader. They have to make an example of you?

Quote:

---

i just didn't have an ellaborate network to play with at home.

---

Never an excuse for messing with one that belongs to someone else and is shared with your classmates.

If I were you I would start looking for another school.

Quote:

---

Originally Posted by mates

Well I wanted to see if I could prevent this from occurring again because a big fear overcame the staff about compromised info.

---

That's not a bad sentiment. But your skillset probably isn't much of
a match for the IT dept's. You might try a different approach. Does
your school have a newspaper? Perhaps a letter of contrition might
be in order, one warning off other students from hacking activities.
That would go a long way towards discouraging other students from
following in your footsteps. Might win you some brownie points, too.

YOU have no idea what IT went thru, for perhaps six months. Just
because you had no problem in that time doesn't mean the school's
admins didn't. They probably spent quite a bit of time running down
the problem, which costs money. Hence the felony. And apparently
other kids caught on to what you were doing. So the spoofing was
rather widespread, undoubtedly causing network outages and raising
concerns about a data breach. And again, costing the school a pretty
penny, especially if they had to bring in an outside contractor.

Were you charged under USC 18 (federal court)? I believe the threshold
for computer crime is only $5000 in damages, and that's not limited to
physical damage. Hourlies and other fees probably figured into it. Yow,
Mom & Dad must be PO'ed.

Live and learn...

Nihil- "Que? don't you have a thing called "due process" over there?"

In some more progressive areas for non violent crimes they will offer a diversion program. Mates isn't very clear on what is going on here so it is hard to say. Programs like this are very common with juveniles, they give you a choice to go to court and take your chances or follow certain rules (usually some educational and community service activities) then after a certain time period the violations disappear from your record. It sounds like he may have gotten lucky. Sometimes as everyone on this list knows, the prosecutors like to really stick it to the evil hackers to make the general public feel safe. They are almost as dangerous to society as the pot smokers that we like to send to prison for longer than child molesters... sorry I got off track there...

Hiring a contractor to secure a system that you should have secured yourself is not "damage" repair.

To attempt to claim it as such is malicious prosecution, conspiracy to pervert the course of justice, and plain old fraud ;)

If you don't know what kids are like you just haven't got a career in Highschool IT admin IMO :D

Due process hasn't been the same here in the States since that fateful day in 2001.

As for the contractor comment, there's no telling, except everything here gets contracted anymore. We even contract soldiers from an outfit called Blackwater to fight in Iraq.

Hi brokencrow,

My comment on the contractors is based on my observations of several cases of this type over the last couple of years.

You see really fanciful figures and know they wouldn't withstand even the most cursory audit. The majority of the "damage" is getting people to sort out systems that should have been sorted already. Nothing to do with the supposed perp's activities.

Its not just the last couple of years. Look at the damages that were claimed against Mitnick. Certainly it has grown more common in the last few years with the claims made under the DMCA by the RIAA and MPAA.

Most IT dept's I've seen are very shorthanded. I worked in one where there were two of us onsite, with some offsite support, for 400 desktops/laptops and some 30-odd servers. That was a tough job because you knew you weren't doing it 'right', you were just doing the best you could. And that's not just IT, it's a lot of industries. When I worked in healthcare, nurses routinely had a patient load of 20+ per shift. Do the math: less than 3 minutes per hour per patient.

I don't doubt that the systems should have been 'sorted out' already. It's a numbers game. No one budgets enough and there's too many promises. Adam Curtis critiqued it well in his 2007 series, The Trap. Obviously the kid screwed up here. Quantifying the damages is tough. As an admin, working shortstaffed (and I guarantee they're shortstaffed), it's got to be very aggravating going thru the whole process of sorting out any resultant network issues. It was going on for 6 months to one degree or another, which is going to be disruptive. Lots of intangibles, so pretty much all it takes under USC (federal law) for a felony computer crime to have occurred is $5000 worth of damage. How do you show that?

With a piece of paper, same way the Dutch bought Manhattan. :confused:

Yes, and as well as short staffed I would guess their hardware/infrastructure budget is pretty limited, so they wouldn't be able to handle much in the way of performance hits.

You made this observation:

Quote:

---

I think there's a tendency when one gets into 'security' tools to not realize how powerful they are and what they're doing to others.

---

That is very true, and it occurred to me that most of these systems administrators' tools are generally only intended to be run as a single instance on any given network.

When you get a number of kids running the same tool over the same network it would doubtless produce a pretty big performance hit? A bit like running 5 AVs or firewalls at the same time?:D

It would be intermittent, and I bet it drove the admin crazy.:shocked:

Quote:

---

so pretty much all it takes under USC (federal law) for a felony computer crime to have occurred is $5000 worth of damage. How do you show that?

---

From what the guy says he was busted by the police, not the Feds?....... they would have just busted his bawlz and got on with their next case.

That brings up the issue of "damage" and "cost". If you trash a server or workstation such that it has to be restored/rebuilt then that is "damage" and anything else is a "cost".

Over here, you would be allowed anything it took to restore your system to the condition it was in before the incident, plus any expenses to maintain your service levels whilst the problem was being resolved.

I see the problem in the US as being that you have rushed into legislation in areas that the legislators did not understand; and the problem with legislation is it kind of "sets things in stone"? Don't worry, we have the same problem with our legislators:D

Looking at it from an equity/tort angle (civil law) I would take this view:

1. The kid broke the school rules: that is an internal disciplinary matter
2. The school incurred additional costs related to the incident
3. The parents are responsible for those costs

In the UK this incident would not involve the police, they would not be interested as it is neither a misdemeanour nor a felony over here.

For that you would require unauthorised access or criminal damage, and you can't have criminal damage without proving criminal intent.

Of course, if you ran a sniffer on the administrative network then that would be unauthorised data access, which is a whole different ballgame.

When running ettercap, which uses arp poisoning (most the time it will also use the IP/mac of it's gateway to do the arp poinsoning) which then causes all traffic to go to you and not the default gateway(router) hence causing a network outage for that subnet/network