Slashdot Mirror
A Network Sniffer On Steroids
QuantumCrypto writes "Errata has developed a new network sniffer, dubbed 'Ferret,' that looks for traffic using 25 protocols, including those for the popular instant message clients as well as DHCP, SNMP, DNS and HTTP. This means the sniffer will capture requests for network addresses, network management tools, Web sites queries, Web traffic and more. 'You don't realize how much you're making public, so I wrote a tool that tells you,' said Robert Graham, Errata's chief executive. Errata has released the source code to this version 1.0, 'feature-poor and buggy' tool on its site. Anyone with a wireless card will be able to run it, Graham said."
Does anyone know if there are any special driver requirements, beyond "anyone with a wireless card?" The documentation is rather...sparse. I've got a Broadcom wireless card in my laptop and it's generally a pain to get things like aerodump going; it requires installing a debug driver, then rolling back the driver afterwards, and the network functionality itself is disabled during this period, at least with aerodump.
I'm curious if ferret can sniff without the added hassle...
Thanks to the War on Drugs, it's easier to buy meth than it is to buy cold medicine!
How is this different to say wireshark or any other traffic analyzer?
First of all, they probably are sniffing you whenever it's convenient (like at the airport).
Second of all, people sadly don't seem to care all that much.
This looks like a cool tool, and I share the hope of an earlier poster that it will work with Broadcom cards - since that's what I have.
You mean that by analyzing my DNS and HTTP traffic, either in the clear or from a cracked WEP session, that you can infer, or worse, identify, certain definite pieces of information about my Internet usage habits?
Boy, if I had a tool that could do that, I'd certainly astroturf it on Slashdot.
I want to delete my account but Slashdot doesn't allow it.
I needed a steroid sniffer that works on my network.
Can I operate it in reverse or something?
I see dead people...
If the only distinguishing factor is it's ability to decode more protocols, why doesn't someone just come up with a sniffer/analyzer that has the ability to plug in software protocol analyzers? You provide a user interface and a framework, you call each analyzer with the data you've collected (you could optimize by having a "fast interest checker" for each protocol) and display the results. I would think that this would be pretty quick and easy given the number of FOSS tools that are already out there. IE do we really need yet another app with another ui and buggy behaviour?
My neighbor likes clown pron.
Libertarian Leaning Political Discussion Forum.
Ethereal just works.
I've seen this before. It starts off with steroids, but pretty soon the network sniffer moves on to crack cocaine. A short while later, he takes a job as a fluffer in midget porn movies to feed his habit.
So, he reimplemented dsniff? How quaint...
Does anyone remember a Mac utility that came out a while back (by which I mean, maybe 5 or so years ago), that would put an Airport into promiscuous mode, and sniff for traffic, and then decode and display any images that it sniffed? It was a pretty amusing little program; I think I remember reading that it was thrown together at MacHack and won best of show, or some other honor.
Basically you could run it, and it would give you an idea of what everyone on the wireless network was browsing, in the clear, at that moment, all sort of jumbled together.
I've always wanted something like that, to use as a demonstration of how insecure most wireless APs (unencrypted ones) are, for nontechnical people, but I've never been able to find it, or any record of it. Sometimes I wonder if I just hallucinated the whole story.
It would be a heck of a demo to just run something like that, particularly if you could target a particular connection, and then tell someone to load a web page, and be able to instantly display some or all of the page, or at least its images, in real time, to prove that you really were listening in on what they were doing. Most packet sniffers don't provide any direct, obvious, graphical output of stuff they sniff, and that's frankly just not dramatic enough to make an impression.
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
The Errata sniffer, dubbed Ferret, packs more punch than other network sniffers already available, such as Ethereal and Kismet, because it looks at so many different protocols, Graham said. Some at Black Hat called it a "network sniffer on steroids."
Oh Wowsers! DHCP, SNMP, DNS and HTTP! That's so many! It's a shame Ethereal can only look at these!
It's doping the internet?
Actually, that would explain a lot...
I'm willing to bet that most people with a wireless network card dont even know what the term "sniffer" means, much less be able to run one.
"Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
Incredible... they support 25 protocols!!!
And to think I used to use Wireshark/libpcap which is open source, available on almost every platform, is not buggy, and supports hundreds of protocols. It even has a graphical user interface.
But I think these guys are really on to something...
using System.Awesome;
Proxim 8482-FC ORiNOCO Wireless 11a/b/g PCI Card, $82.27Do you think they're RoHS-compliant, too?
"Windows users".
Wireshark does waaaaay more than 25 protocols.
I think there is a world market for maybe five personal web logs.
What makes this sniffer stand out is not the fact that it can parse different protocol formats -- it's that it collects relevant data in a meaningful summary.
For example, any sniffer can filter and then parse HTTP traffic, but an analyzer like this one tells you relevant bits like someone's web account names.
If I were you, I'd be buying lotto tickets. I have a box going somewhere of WiFi cards that I've ripped out of systems because I couldn't get them working on Linux. It's not full, but there are a bunch in there, plus a bunch in systems that just don't work and I've not bothered to pull, plus a lot more that I've tried to get working and returned. They tend to be a combination of Marvell and Texas Instrument ACX chipsets, neither of which I've ever gotten to work successfully (and by "work," I mean natively, without Windows-driver hacks, and will work with WPA-PSK AES, and without installing anything alpha-quality or destabilizing). The TI ones are particularly awful, because they're the kind that require firmware blobs to be loaded at startup, so they'll pretty much never be supported in the hardcore FOSS distros (although I heard a rumor that Mepis may support them).
I have only ever gotten lucky with one wireless card on a Linux machine, and that was a DWL-650 and Ubuntu Dapper, a combination which (naturally) you can't buy anymore, because the DWL-650 has been replaced by the DWL-650+, which has a completely different (ACX!) chipset.
My plan is to dump the crate out every few years and see if the situation has changed, but after buying and returning pretty much every card at all of the local stores which even seemed to be distantly or possibly related to anything that might have out-of-the-box Linux drivers, I decided to can the whole endeavor.
It's easier, IMO, (and cheaper, if you look at the prices for "real" Linux-compatible WiFi cards from Orinoco/Cisco/etc. -- notwithstanding the fact that they need to be ordered a week in advance of when you need them) to buy routers that will work in bridge mode (aka "game adapters", or a WRT54GL with DD-WRT if you can find one), and can just be attached to any type of box via Ethernet, than to actually mess around with getting a card working natively on anything except Windows and MacOS. (And it's not like Windows is necessarily any picnic, either, particularly when you start talking about WPA. MacOS only avoids it by only having a handful of cards.)
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
The whole proprietary cracking market is loaded and full of crap. Instead of teaching people about the actual workings of computer networks (as often real crackers do, most often illegally) it's better to make a cracker out of yourself than depend on these jerks.
Anyways, any intellectual who has any interest in cracking had better read a few of the old philes or at least RFCs to know what's going on. This stuff is about as functional as Microsoft Windows (which isn't) and is only suitable for the obsessively compulsive washing masses.
You should be out in the garage getting your clown suit on.
The Kruger Dunning explains most post on
in order to run ferret on vista, you need to run cmd.exe as administrator b4 running ferret from the cmd line.
Orinoco? My dear fellow, I'll give you Orinoco
Now don't get me started on marmalade sandwiches...
Stick Men
According to this banner ad I saw on another site, my IP address is visible!
For all intensive purposes, "whom" is no longer a word. That begs the question, "who cares"?
They include the source code, and say that it "should" compile in linux. However, it uses many Windows-specific variable types. This code will not be cross compatible without a major overhaul.
This program is not ethereal on steroids. It's more like ethereal and kismet got drunk, had sex, and had a retarded baby, which they named ferret.
Write your own Choose Your Own Adventure. http://www.freegameengines.org/gamebook-engine/
Good for linux- with monitor mode
:) - http://madwifi.org
* Atheros-based cards. Strangely, I don't hear these mentioned very often, but they have excellent support, complete with monitor mode, creating multiple interfaces from one card, etc. Oh and airpwn supports it
* Intel Pro Wireless (2100 / 2200 / 2950) - Works well, has monitor mode, wep in hardware, drivers actually developed by intel - http://ipw2200.sf.net and in the kernel at this point
* Orinoco / Hermes / Lucent cards - in the kernel
* Cards based on the Prism chipset based (http://prism54.org) BE WARNED though, some of the newer ones require "softmac" firmware which is currently not working all that well
I have used a card from all of these manufacturers and if I were getting a new laptop, I would probably go with Atheros and if not that, then Intel.
Even for slashdot, that's pretty bad, eh?
I read TFA, but nowhere did it mention anything about encryption. I am assuming that since I use WPA2, I don't need to worry about anyone sniffing my wireless traffic. I think it is irresponsible for this article to not include anything about encryption - spread fear about wireless usage, but don't provide a solution.
I have a friend who works at Best Buy/Geek Squad. A guy came in with a government contract and a laptop, needing repairs. He was making small talk and said his job was to wardrive around and break into people's home computers and search them for child porn.
Take it with a grain of salt - the guy was just some dude with a busted laptop walking into a Best Buy. But he did have a government contract, and a lot of wireless sniffer software on his machine.
Weaselmancer
rediculous.
It was probably a variant of EtherPEG.. I don't use a mac, but driftnet runs great in linux. Works on ethernet too, although most networks are switched these days.
But they do mine rock salt in Cheshire. The tunnels are a good ten foot or so in height and the salt is blasted out with high explosives. Now, that's the stuff you should be taking with stories like this.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
And for that note, they'd better be! It would be even scarrier if said company was actually using powerpoint as an effective means of communication to all their 1337 brethren using windows. Then again, the source is for visual studio... Something about this rubs me the wrong way, anyone else?
Completely off topic, but I just realized while thinking of holes in office... is today patch tuesday? Or is that next tuesday?
Oh, yeah, and their program doesn't work with linksys wireless G cards, nor does it understand the '/?' switch from the command line.
If I mod you up, it doesn't necessarily mean I agree with what you've said, sorry.
There is a very similar OSS research project called Ferret by a prof at UMD. I used to be IT support for an institution he is a member of. (Institute for Systems Research)
http://www.enre.umd.edu/faculty/cukier.htm
http://ferret.sourceforge.net/
No seriously, I said that with a straight face!
I watched a briefing on Vista wireless and compared to XP it's WAY different. The MSFT guy on the stage actually said the words monitor mode and mangle packets! Apparently the XP driver setup for wireless kludged wireless to look like a regular wired NIC. For Vista that's not the case - you can have filter drivers and all sorts of stuff going on with wireless. The SDK for drivers even supposedly comes with SOURCE for a wireless driver supporting Realtek wireless cards. The presenter also showed the results of a one minute sniff of the conference network doen on his laptop - APs, clients, encryption supported, speeds supported, blah lah - all done in Vista using off the shelf drivers. Tehre are supposed to be something like 150 hooks in all of the Vista wireless drivers to allow for this sort of thing in order for the driver to be certified plus you can apparently roll your own. There's still some abstraction from the hardware of course so there could still be limitations but the alternative is a hell like there is with Linux right now. I'm fortunate to have like 5 cards that work under Linux but NONE of them are what I'd call "new". If Vista is really doing what this rep claimed then Vista is going to be MUCH better for capturing wireless than XP was. Products like AirPCAP and goofy expensive custom widgets to get monitor mode on XP can take a flying leap - maybe.
Anyway, this was a BlackHat presentation done in Vegas this past year - they had a whole series on Vista. The video might be up on the BlackHat site, if it is take a look. Vista is still new enough that much of this probably hasn't been explored yet btu stay tuned - this looks like ONE benefit to Vista....
Build it, Drive it, Improve it! Hybridz.org
HA