Stephen_McCloskey's WebLog

Here are some articles about password sniffing and real-world systems.  Documented accounts of successful password sniff attacks do actually exist. 

(I’m not trying to pick on the OSS folks when it comes to poor password handling, but the two most recent incidents were connected with OSS systems.  In reality, OSS and non-OSS systems are equally vulnerable to password sniffing attacks.)    

Debian had a few of its servers compromised a few months back.  It looks like the attack started with a simple sniffed password. See this and this. 

The FSF Savannah project had the same attack successfully performed on them.  The article does not mention the password sniffing part, but does say that the attack was identical to the Debian attack.  Does anyone know if a sniffed password was also used in this attack? See this.

Here is a random CERT account of someone who collected passwords.  CERT claims some passwords where sniffed, but I have no idea how they would know that.

Finally, here is a random article about E-Bay.  There isn't any evidence that e-bay customers had their passwords sniffed, though.  

Although password sniffing is rare, it is still something that people should worry about.  Common sense dictates that we shouldn’t be storing or sending plaintext passwords. 

Although your chances of getting struck by lightening are pretty low, you should still get out of the water when a thunder-storm arrives. 

Why does the ASP.net administrative site send your plaintext password to you in email whenever you change it?  This strikes me as a bad idea.  For that matter, why doesn’t the ASP.net site use https on the page that allows you to change your password?  Your password is not very secure if the darn thing is floating around the internet and in random mail boxes - in plaintext.  Jeez!  Packets can be sniffed and most mail boxes can be read by an administrator (or whoever has access to the backup). 

Passwords are like an infectious disease.  You want to handle them carefully and avoid them whenever possible.  They are an essential part of modern applications, but many developers don’t respect how easily they can be compromised if mishandled.  Fear the evil password! Don’t ever write an app that tosses them around in plaintext!