Search This Blog

Monday, April 28, 2008

Smart Sniffing on Windows Mobile

Peace be upon you


What does "Smart Sniffing" means?

  1. WinPCap for Windows CE.
  2. Windows mobile device to start your development and tests.
  3. Hotmail account.






I forgot to put some links :)
writing secure code
Secure Socket Layer
MSDN Writing Secure Code
WinPcap for Windows CE


Thanks for your time.

Ahmed Essam


Fady Anwar said...

the idea is interesting but it could be more interesting if packet sniffing was used to sniff the wireless network traffic instead the of the same device
simply because if all what you wanted is to access a password protected account and u had access to the device you could simply just install a keylogger instead of the hassle of using packet sniffing
plus the damage will be more dangerous, imagine a guy stepping into a company with a unprotected wifi network and sniffs everything and log it on his pocket pc and leaves
and by the way, you don't need to sniff specific packets, you can just sniff them all and filter them later, ethereal can do that for you

Seth said...

You could just download Airscanner's sniffer have this power in about two minutes :) Included are filtering options that allow you to focus on the 'important' stuff...

Ahmed Essam Naiem (Neo_4583) said...

Peace be upon you

Look the Key logger is consumed idea, plus the target is different, the target here is to summarize the information and have what is useful to the intruder, some times key logger doesn't give accurate information also the Pocket PC as all about styles and user may not use the keyboard, because most of the sites do many things to help the user like having shortcuts for the written words, plus there is always "Auto Complete" running on the Pocket PC, so the Key logger is totally unsuitable for this case.

Seth: Airscanner is like packet sniffer but on your device which is useless in most of the cases, it is only useful in certain cases 'for self usage', what I am talking about is deep more than that, it is like having similar application on victim device and have just summary of what is going on, summary which enable you to hack into device user accounts on web or enterprise application that is related to business secrets.

I hope that you got my point

Ahmed Essam

Fady Anwar said...

seems like u didn't fully understand my comment, please read it again, i wasn't saying that keylogging is better

Ahmed Essam Naiem (Neo_4583) said...

I read what you have wrote fady, anyone can pick packets from the air so what is the big deal, even with simple encryption it may take hours to crack the password using "AirCrack" and stuff like that, it will only work if you have 100% free of encryption Wi-Fi spots, which is not everywhere, in some cases you will never be able to get the what in the air.

Also in some cases you will not be able to reach to some spots, u can only get what you can see, what I am talking about here is something on the device that gives you information about the user who is using now, which means u can have at the moment control on the things which he uses, + the target is not sniffing everything going on the air, you just want specific piece of information from that use not tons of NEED to analysis data.

thanks for your comments.

Seth: "I am sorry I miss understand the AirScanner Sniffer"

Fady Anwar said...

analyzing the sniffed data isn't hard as u think
most modern packet sniffers now have filters that are more than efficient, one of them is the one seth mentioned

if you mean deceiving a user to install a software that contains your packet sniffer i.e a trojan, then in the end you will need the foul to run the trojan
so if you manage to find that foul, mostly you will have better and easier ways to obtain his passwords than installing a full blown packet sniffer on his device

in the end, i think using a packet sniffer to sniff the network traffic of a single device that it's installed on is obsolete, simply because if you can install a packet sniffer on the victim's device, then you can install anything else, one of my suggestions was a key logger or any software that captures the user input and store it

Ahmed Essam Naiem (Neo_4583) said...

Most of guys install "UNSIGNED" application which means you can put what ever you want on it, most of users do n't even know what does Signed application means, so the Fools who will run the Trojan are every where, most of spy where doesn't installed on the user saying "Hi Mr.User we are hacking your mobile, please accept me to do my job, OH by the way I will work what ever it takes, have a nice day"

things never goes that way, you can simple go to any forum, download any application, attach your stuff to it, and put it pack with new name, "Application XYZ free and cracked" once it is installed you can do what every you want to do, Most of mobile malware do so,

What I meant here, which no one gets until now, you need to have some kind of key to get into simple place, this trick will help you to do so, this is for the evil side,
for the good side, what I meant is to take care and keep track with your clients, for example, manage your web application to handle user logins in safe way, make your own session ID generator stuff like that,

I never meant to hack someone and theft him until he get broke, all I mean that most of mobile application that I have seen doesn't apply many security issues fixes, good cracker can reach to many things that you would not ever imagine,

Packet Sniffing is Ok and great, but it will never gives you what it is needed to have someone with the richness that this trick provides.

I hope that you get my point, what you are talking about is different style of hacking, at the end this depends on the hacker :D and how they would use all of this stuff

also I forgot to mention that there is so many ways to secure the wireless network, + it is some time hard to break the keys of the wireless packets.

may be if you are lucky, you manage to hack it.

Thanks for your time

Ahmed Essam

Fady Anwar said...

wither you are going to put the "Hi Mr. User ..." message or not, in the end u will need a fool to run it

bottom line is i think this technique is obsolete, use any sort of user input capture instead, it won't just give u the session ids and cookies it will give u the password in plain text, which is the "important" stuff ;)

Ahmed Essam Naiem (Neo_4583) said...

Peace be upon you

Hi Guys, I have downloaded and tried the Airscanner Sniffer, as I expected it doesn't scan anything going in the air, as far as I know there is hardware capabilities that must be in the Wireless chip, which is not exist in normal laptop built-in Wi-Fi modules, so the idea of Airscanner is not valid anymore, there is solutions but I am not sure if it is working for mobile or not, may be there is versions for something like AirPCap.

Thanks for you contributions :)

Ahmed Essam

Mehmet said...

hello brother ahmed,

how are you? i hope that you are doing fine and everything is going well.

My name is Mehmet and I tried to e-mail you about a problem I have and it is rather confidential.

Is it possible if I could somehow get your e-mail so I could e-mail you?

I will be coming back to you tomorrow if it possible.

My kindest regards brother.