POP3 or POP3S — No contest

I recently tried a handy network traffic monitoring utility and was shocked by what it could do. The software is called Ettercap and it’s a real wizard at eavesdropping on a network (doesn’t that sound odd? :). What surprised me wasn’t so much that it could capture passwords for protocols like telnet, ftp, pop, ssh1, icq, mysql, http, irc, socks5, imap4, vnc, and many more. The big thing was that it could listen in on a switched network so deftly the victim wouldn’t notice a thing. (I did notice a slowdown while browsing an IMAP folder, but be honest, would it occur to you that somebody was sniffing your traffic? :) It can also listen to two computers talking to each other, which is great. At our site, for example, there’s a mail server and a separate server where students have shell accounts. If you listen in and catch the passwords between those computers, you get plenty of passwords. We use Kerberos there, so mail pass = ssh pass. Isn’t that lovely? :)

I tried it right after compiling it, on my boss, no less. The program is well written and there are binaries for Windows too. There are also plenty of plug-ins that extend what it can do. In short, I switched to POP3S and I pay more attention to what I log in through and how I log in to different services :). One technical observation: Windows supports hibernation, and if you put the computer to sleep with ICQ running, the client behaves as if it’s still connected after waking up and doesn’t send the UIN/password to the server. So go ahead and hibernate :)).