It's true, and I do not question your skillz! But I think that you give too much credit to the average Joe down the block. Most (I'd say more than 90%) people have no inclination or know how to perform the exploits your speaking of.
Yeah, I know it's hard to believe... because your constantly in contact with and surrounded by IT knowledgeable people. I'm sure if you were to ask Paul how many people he knows 'First Hand' that can pown a box, he'd be hard pressed. (Outside of our SCRCLE and Dave's group.) That's because he, like me, are not surrounded by IT types. In fact even with the many IT types I know, I would still like to see a demonstration (cold) of "owning" boxes. I'm a see to believe type of guy. By cold, I mean owning a box that has not been tinkered with by the person doing the owning. And I don't mean logging into MyNetwork and seeing someone else's files. Even I've done that at the local KOA wifi spot. Amazing how many people have file sharing turned on and go on public wifi. My son will tell you, like I taught him. Don't believe everything you hear. I find that IT types, just like Truckers and Marines, have ways of taking small stories and making even Mount Everest pale in comparison. Ten years as a Marine and 30 years trucking, I'm surprised I believe anyone at all ;-) --Manny On Thu, Sep 11, 2008 at 9:22 PM, Dante Lanznaster <[email protected]> wrote: > Manny, > > If someone gets into your network and starts sniffing, you will NEVER > notice. One just needs to be in reach of your AP to start deploying > man-in-the-middle attacks, or what's even worse, doing client-side attacks. > I seriously doubt that you have a good IDS deployed at home. > > Most devices support WPA nowadays, some don't work well with AES. > Practically everything supports WPA with TKIP, if it doesn't, then update > firmware or if it's a PC change the card. PCI cards are super cheap, > compared to the peace of mind. XP had to have an update to support WPA, but > that was ages ago, and if one happens to have a XP machine without that > update, well, I just need a copy of the latest metasploit to totally own the > box without the owner even noticing it. > > Besides, one doesn't even have to wait until the future to say a WPA network > is unsecure. You just need to use "blueskies" or some other stupid > dictionary based passphrase as your PSK. Crackable in half hour. > > -Dante > > On Thu, Sep 11, 2008 at 4:19 PM, Manny <[email protected]> wrote: >> >> I'd be more worried about giving my credit card to a totally unknown >> person (waiter), who than takes this card and disappears with it for 5 >> mins (making copies, writing super secret 3 digit code on back down), >> multiply this by 10 to 20 times a week, than using wep on my >> household wireless Internet. >> >> Don't get me wrong, if I was accountable for someone else's wireless >> Internet I'd be pushing the wpa also. >> >> Unfortunately I have a mix of devices that need wireless access, >> Linux boxes, PSP's, WII, wireless bridges, Nintendo gadgets, and I >> like them all to work. >> >> I've even had problems getting my wife's Vista laptop to work with >> wpa. My daughters desktop connects through a wireless usb dongle, to >> old to have wpa. >> >> If I ever catch anyone sniffing or on my network I'll likely lock it >> down. But I find that having wep lets people know that this is indeed >> not an open wireless access point and they should move on to any of >> the other dozens of routers still in "default" configuration. >> >> All my banking and email goes through https connections "only", as an >> added security measure. >> >> Someday we'll look back at WPA and we'll be reminiscing at how >> insecure WPA was back in the day! >> >> >> On Wed, Sep 10, 2008 at 10:51 PM, Dante Lanznaster <[email protected]> >> wrote: >> > do you believe in sharing your whatever passwords too ? ever heard of >> > MITM ? >> > >> > On Wed, Sep 10, 2008 at 9:49 PM, Manny <[email protected]> wrote: >> >> >> >> I believe in sharing my 20mbs download goodness! >> >> >> >> --- from verizon >> >> Thank you for your recent order to change your FiOS Internet speed. >> >> Your order details: >> >> >> >> New FiOS Internet Speed: 20M_5M >> >> Order Number: 0C6xxxxxx >> >> Order Effective Date: 09-03-2008 >> >> >> >> --Manny >> >> >> >> On Wed, Sep 10, 2008 at 7:14 PM, Dante Lanznaster <[email protected]> >> >> wrote: >> >> > Why don't you stop using WEP first? :p >> >> > >> >> > >> >> > >> >> > On Wed, Sep 10, 2008 at 4:05 PM, Manny <[email protected]> wrote: >> >> >> >> >> >> So this means that when some hacker is probing my ports he or she >> >> >> will >> >> >> get a cool looking map of my vulnerabilities. >> >> >> >> >> >> ... that doesn't sound good! >> >> >> >> >> >> --Manny >> >> >> >> >> >> On Wed, Sep 10, 2008 at 8:44 AM, Chris Louden >> >> >> <[email protected]> >> >> >> wrote: >> >> >> > On Wed, Sep 10, 2008 at 2:09 AM, Chris Penn <[email protected]> >> >> >> > wrote: >> >> >> >> The New Nmap is out with the ability to draw maps of the scanned >> >> >> >> network. >> >> >> >> http://nmap.org/book/zenmap-topology.html >> >> >> >> >> >> >> >> List of changes >> >> >> >> http://nmap.org/changelog.html: >> >> >> >> >> >> >> >> o [Zenmap] Added a new Scan Topology system. The idea is that if >> >> >> >> we >> >> >> > >> >> >> > >> >> >> > I started playing with Radialnet at the last SRCLE meeting based >> >> >> > on >> >> >> > an >> >> >> > article in Linux Pro Magazine. So far i have not been able to >> >> >> > generate >> >> >> > anything as pretty as the example file but it is quite handy. Now >> >> >> > I >> >> >> > just need some way of making it an interactive network diagram. >> >> >> > _______________________________________________ >> >> >> > LinuxUsers mailing list >> >> >> > [email protected] >> >> >> > http://socallinux.org/cgi-bin/mailman/listinfo/linuxusers >> >> >> > >> >> >> _______________________________________________ >> >> >> LinuxUsers mailing list >> >> >> [email protected] >> >> >> http://socallinux.org/cgi-bin/mailman/listinfo/linuxusers >> >> > >> >> > >> >> > _______________________________________________ >> >> > LinuxUsers mailing list >> >> > [email protected] >> >> > http://socallinux.org/cgi-bin/mailman/listinfo/linuxusers >> >> > >> >> > >> >> _______________________________________________ >> >> LinuxUsers mailing list >> >> [email protected] >> >> http://socallinux.org/cgi-bin/mailman/listinfo/linuxusers >> > >> > >> > _______________________________________________ >> > LinuxUsers mailing list >> > [email protected] >> > http://socallinux.org/cgi-bin/mailman/listinfo/linuxusers >> > >> > >> _______________________________________________ >> LinuxUsers mailing list >> [email protected] >> http://socallinux.org/cgi-bin/mailman/listinfo/linuxusers > > > _______________________________________________ > LinuxUsers mailing list > [email protected] > http://socallinux.org/cgi-bin/mailman/listinfo/linuxusers > >
