Sniffing: How It Threatens Security

Sniffing data from the network leads to loss of privacy of several kinds of information that
should be private for a computer network to be secure. These kinds of information include the
following:
n Passwords
n Financial account numbers
n Private data
n Low-level protocol information
The following subsections are intended to provide examples of these kinds.
Sniffing Passwords
Perhaps the most common loss of computer privacy is the loss of passwords. Typical users type
a password at least once a day. Data is often thought of as secure because access to it requires a
password. Users usually are very careful about guarding their password by not sharing it with
anyone and not writing it down anywhere.
Passwords are used not only to authenticate users for access to the files they keep in their
private accounts but other passwords are often employed within multilevel secure database
systems. When the user types any of these passwords, the system does not echo them to the
computer screen to ensure that no one will see them. After jealously guarding these passwords
and having the computer system reinforce the notion that they are private, a setup that sends
each character in a password across the network is extremely easy for any Ethernet sniffer to
see. End users do not realize just how easily these passwords can be found by someone using a
simple and common piece of software.
Sniffing Financial Account Numbers
Most users are uneasy about sending financial account numbers, such as credit card numbers
and checking account numbers, over the Internet. This apprehension may be partly because of
the carelessness most retailers display when tearing up or returning carbons of credit card
receipts. The privacy of each user’s credit card numbers is important. Although the Internet is
by no means bulletproof, the most likely location for the loss of privacy to occur is at the
endpoints of the transmission. Presumably, businesses making electronic transactions are as
fastidious about security as those that make paper transactions, so the highest risk probably
comes from the same local network in which the users are typing passwords.
However, much larger potential losses exist for businesses that conduct electronic funds
transfer or electronic document interchange over a computer network. These transactions
involve the transmission of account numbers that a sniffer could pick up; the thief could then
transfer funds into his or her own account or order goods paid for by a corporate account.
Most credit card fraud of this kind involves only a few thousand dollars per incident.
Sniffing Private Data
Loss of privacy is also common in e-mail transactions. Many e-mail messages have been
publicized without the permission of the sender or receiver. Remember the Iran-Contra affair
in which President Reagan’s secretary of defense, Caspar Weinberger, was convicted. A crucial
piece of evidence was backup tapes of PROFS e-mail on a National Security Agency computer.
The e-mail was not intercepted in transit, but in a typical networked system, it could have
been. It is not at all uncommon for e-mail to contain confidential business information or
personal information. Even routine memos can be embarrassing when they fall into the wrong
hands.