Re: Security

Jason Williams (streak@ccwf.cc.utexas.edu)
Wed, 26 Nov 1997 09:04:46 -0600 (CST)


On Wed, 26 Nov 1997, Robert Hsiung wrote:
> >Well..if you want to get technical..that's always possible.
>
> That's what I was afraid of. :-)

Well you can only be so secure...CU is fairly secure..much better than
programs like Freevue which have no caller ID functions to let you know
who's calling. Anything you go onto a network like the Internet, you pose
the risk of people spying on your packets. Like? no, not really. But
TCP/IP and UDP/IP have been exploited in the past.

> >The typical
> >user isn't gonna have the keys to the routers
>
> The physical keys to the rooms that the routers are in? Or some kind of
> software password-type key?

Both I suppose..though I guess if they own the router, they probably can
login remotely to it. CU-SeeMe doesn't use PGP-encrypted data, so a
packet sniffer would do it assuming you could determine which packets are
from/to CU-SeeMe.

> I'm wondering about a one-to-one connection, not a connection through a
> reflector. Someone worried about security wouldn't go through a reflector,
> I don't think! :-)

Someone who knew a bit more about the internet would realize the packets
are all going through pretty much the same routers regardless of the final
destination..be it another individual's IP, or the IP of a reflector.

> >There's always packet sniffers..but I imagine the percentage of people
> >that use packet sniffers actively is much less than 1% of the internet
> >population.
>
> A packet sniffer is software that lets you somehow intercept data on the
> Internet? Sorry, but I really don't know anything about this...

>From what I gather, a packet sniffer lets you watch every packet entering
and leaving your computer. If you're logged into the router, the means
you view all incoming and outgoing traffic thru the router. If you're an
end user running it on a SLIP/PPP machine, it means you just see what
packets arrive to you and you send out. Intercepting data is useless
unless you're on a machine that's receiving the data.

> But wouldn't the packets say what type of data they are? Otherwise, how
> would the computer that they're intended for know what to do with them?

Presumably..yes..but the person wanting to eaves drop would have to:
1) Have access to a packet sniffer on the router between you and your
destination.
2) Have a program written that filters out all packets not from your IP
3) Have a program that allows through only CU-SeeMe packets (CU's data is
all done on UDP...not TCP so this would be even trickier I would think)
4) Have a program that takes the sifted data and assembled into
video/audio packets in REAL TIME. It wouldn't be hard to assemble the
data later and run some sort of decoder on it to view it perhaps. But the
hacker would be more interested in real-time data
5) Have a program that actually displays the data acquired. (video
routines/etc)

I'm not saying it can't be done...just that it's very unlikely. The only
other way to do it is to disrupt service and attempt sending spoofed UDP
packets..though I imagine that would fail for the same reason CU fails to
work with proxy servers.

> CU already does display real time video/audio based on packets, right? So
> it would "just" be a matter of feeding it sniffed packets?

feeding it sniffed packets in real time..perhaps. Most routers I know of
aren't Macs or Win95 machines. More than likely, you'd have to rewrite a
lot of what CU does.

> Well, if any experts want to chime in, this is something I need to find out
> about. Not because I want to go sniffing, but because we're thinking about
> using CUSM in situations in which confidentiality would be important.

I, personally feel it's no big problem. It's more a problem with the
internet in general than anything else. There's no point to point route
for every IP on the net, so using routers imposes some very limited risks.
All of this also assumes the hacker has both IP addresses as well as the
time you're sending/receiving. If nothing else, simply using a dynamic IP
address bypasses that problem. CU is as secure as possible I believe. A
chain is only as strong as its weakest link. Here, the link is the
network it's used on.

If security is a big issue, perhaps you can bypass the Internet altogther
and use CU by directly dialing the other person. But then the person at
the phone company can always tap into your line. :)

--
streak@ccwf.cc.utexas.edu    * Jason Williams -- Austin, Tx.  |     |
streak@mail.utexas.edu       * University of Texas at Austin  | ___ |
streak@cs.utexas.edu         * BS Computer Science             \_|_/
*************** http://ccwf.cc.utexas.edu/~streak/ **************|