Airline Cybersecurity

Personal post written to the class. I had posted this because I felt it needed sharing, so I am saving it here too. From February 16, 2012.
Here is the paper for which this was research.

Well, today I learned that an important thing for airline cybersecurity is that a cyber-threat tipline needs to be available.

I was looking at airport websites as research and discovered a SQL Injection into an upcoming flights database. Upon verifying and documenting the vunerability, I went looking for a contact that I should send my report to and the only thing I could find was a minor TSA contact email. I ended up on the phone with a low level police information desk person and sent the report to both him and the TSA email, hoping it finds its way to the people that need the report.

The police information desk was definately not the best person to be talking to and I had to back pedel and re-explain that I was a Cybersecurity student after he asked, in a very accusing tone, "Are you a hacker?" Does he regularly have black hats calling him to report vulnerabilities? It was an Airport Police (Information / Assistance) number available on the state aviation administration contact page. I tried.

I don't have much faith in the TSA email either as I got back an auto generated response that implied that most of their incoming email is about what can and can't be carried onto a plane.

Matthew

---

Update: The airport in question has replaced the page in question, so this vulnerability has been corrected.

Cyberspace and Cybersecurity: Archive Post C

As of the start of this blog, I am in my second course for my Masters of Science in Cybersecurity. This is an archived posting from the first course.

Topic – LAN Security Policy Function
Select one and only one security policy function related to LANs and provide more detail.
From March 30, 2012.

Drawing from Vacca's list of criticals functions of a good security policy, I will discuss the value and details of appointing "a security administrator who is conversant with users' demands and on a continual basis is prepared to accommodate the user community's needs" (2009, pg 152).

An easy to overlook, but vitally important phrase in there is a security administrator. The idea of a single point of failure may seem repulsive, and having a backup contingency in place is a good idea, but having a single point of security configuration minimizes the chances of multiple changes invalidating the security from each other. Having just one administrator guarantees that the entire security administrative team is always kept up to date on changes and incidents of note.

Familiarity with users' demands is absolutely vital for the administrator because a failure to address, not necessarily comply but at least address, users' demands will result in the user attempting to enact what they feel is needed themselves. If users do not have it explained to them why their demands cannot be met, then the actions they take will cause security or stability issues. For instance, when users demand to have access to streaming media even though policy denies it, if the administrator doesn't address that demand and explain that streaming media is banned due to stability concerns related to the enormous amount of bandwidth it uses, then the users avoid the block on Youtube with a proxy and strain the availability of the network due to bandwidth consumption.

The security administrator needs to be constantly prepared to accommodate the user community's needs, because those needs could be indicative of a network incident. If users begin reporting issues to the help desk, "with a complaint about his or her computer, the network, or an Internet connection, the user’s problem may turn out to be related to a bigger problem, such as a hacker, denial-of-service attack, or a virus" (Whitman & Mattord, 2010).

---

Whitman, M. E., Mattord, H. J. (2010). Management of Information Security. Retrieved from www.sis.pitt.edu/~jjoshi/IS2820/Spring06/chapter05.doc

Vacca, J. R. (2009). Computer and Information Security Handbook. Burlington, MA: Morgan Kaufmann.

Cyberspace and Cybersecurity: Archive Post B

As of the start of this blog, I am in my second course for my Masters of Science in Cybersecurity. This is an archived posting from the first course.

Topic – Network Tools
Select one network monitoring tool mentioned in the module (Nmap, Nessus, etc.) and provide a more information about it. It is permissible to also discuss a tool that was not mentioned in the module.
From March 30, 2012.

The network monitoring tool I recently found out about it the Microsoft Network Monitor. From the relevant MSDN page, "Microsoft Network Monitor is a tool for viewing the contents of network packets that are being sent and received over a live network connection or from a previously captured data file. It provides filtering options for complex analysis of network data" (2012) From my experience, it is basically a closed source version of Wireshark published by Microsoft. It has one extremely interesting feature, and that it has the ability to put wireless cards into promiscuous mode with the proprietary Windows drivers. This is a feature I have searched literally for months for and was unable to find. Most everything you can find about promiscuous wireless packet capture is using Linux, but with Microsoft Network Monitor you can perform it in Windows with the default drivers.

I was shocked to find an official, free tool from Microsoft that will put your wireless card into promiscuous mode, capture the traffic, and parse it for you. As Vacca points out, promiscuous mode is useful as a troubleshooting tool, but "it is also a mechanism that can be easily abused by anyone motivated to enable promiscuous mode" (2009, p. 102).

---

MSDN. (2012) Network Monitor and Parsers. Retrieved from http://msdn.microsoft.com/en-us/openspecifications/cc816059

Vacca, J. R. (2009). Computer and Information Security Handbook. Burlington, MA: Morgan Kaufmann.

Cyberspace and Cybersecurity: Archive Post A

As of the start of this blog, I am in my second course for my Masters of Science in Cybersecurity. This is an archived posting from the first course.

Topic - Operating Systems and Access Control
Discuss one aspect of access control (e.g., file access rights, privileges, ACL, etc.) in ensuring operating system security.
From March 23, 2012.

The According to Vacca, access control lists (ACL) provide access to certain resources and can be used for both physical access and electronic. "Implementing ACLs prevents end users from being able to access sensitive company information and helps them perform the jobs better by not giving them access to information that can act as a distraction" (Vacca, 2009, p257)

The Microsoft Windows operating systems use ACLs to protect securable objects such as files, directories, and registry keys. The ACLs are lists of access control entries, ACEs, which identify a trustee "and specifies the access rights allowed, denied, or audited for that trustee" (Microsoft, 2012) It actually uses two separate lists per object, discretionary access control list (DACL) and system access control list (SACL). The first is for controlling who accesses an object and the second is to log attempts to access the object. (Microsoft, 2012)

Whenever access to a securable object is attempted, the process accessing it is compared against the ACEs in the DACL. If there is no DACL associated with the object, everyone is granted access. When their is a DACL with no entries, everyone is denied access. Otherwise, the process is granted access if and only if there is no ACE denying it access and there is an ACE granting it.

The ACEs of the SACL for the object "specifies the types of access attempts by a specified trustee that cause the system to generate a record in the security event log. An ACE in a SACL can generate audit records when an access attempt fails, when it succeeds, or both" (Microsoft, 2012).

---

Microsoft. (2012) Access Control Lists. Retrieved from http://msdn.microsoft.com/en-us/library/windows/desktop/aa374872%28v=vs.85%29.aspx

Vacca, J. R. (2009). Computer and Information Security Handbook. Burlington, MA: Morgan Kaufman

Cyberspace and Cybersecurity: Archive Post 9

As of the start of this blog, I am in my second course for my Masters of Science in Cybersecurity. This is an archived posting from the first course.

Topic - Virtual Machine Security
Discuss one significant issue associated with virtual machine technology and identify appropriate countermeasures.
From March 23, 2012.

Virtual Machines are useful for security researchers because they enable malware analysis through multiple ways: easy reverting to a known (ideally known good) state via snapshots, ability to run malicious code (usually) without putting a physical system at risk, and easy kernel debugging. Unfortunately, malware authors have identified the existence of these advantages and have begun performing virtualization detection and executing alternative code paths when virtualized or even :escape the context of the virtual machine and attack the host system or at least glean information from it" (Vacca, 2009, pg 699).

Liston and Skoudis claim that the leading method of detecting VMware detection is by looking for the communications channel used to communicate between the guest and host operating systems. Since this is, they claim, the "most widely deployed means of detecting virtual machines" they have researched into thwarting it. (Liston & Skoudis, 2006) Their research had yielded, as of the writing in 2006, "essentially a high speed search-and-replace tool that is designed to find the fixed “VMXh” magic value used to access the VMware communication channel and change it to a user-specified alternate value" (Liston & Skoudis, 2006). Unfortunately, since VMware disk images are huge and a given DWORD is small, there are false positives such that modifying them is disastrous to successful execution. At the time of writing, "the best [they]’ve been able to do is to coax a VM into booting ... but with severely limited functionality (i.e. no keyboard, no mouse)" (Liston & Skoudis, 2006).

Overall, VM detection is easy and thwarting it reliably is hard. According to Vacca, some administrators have instead begun setting up flags on real systems to convince malware that the machine is a VM to prevent the ones that hide their behavior in VMs from attacking. (Vacca, 2009, pg 699)

---

Liston, T., Skoudis, E. (2006) On the Cutting Edge: Thwarting Virtual Machine Detection. Retrieved from http://handlers.sans.org/tliston/ThwartingVMDetection_Liston_Skoudis.pdf

Vacca, J. R. (2009). Computer and Information Security Handbook. Burlington, MA: Morgan Kaufman

Think like a Hacker

As of the start of this blog, I am in my second course for my Masters of Science in Cybersecurity. This is an archived posting from the first course.

Topic – Think like a Hacker
Select an e-business. Thinking like a hacker, describe a hypothetical scenario on how you go about breaking into their system and acquire assets.
Next, describe how the attack could have been prevented.
From March 16, 2012.

I enjoy music, especially when I can get it cheap, like from iTunes or the Amazon Cloud.

First, I will select a busy area with free wi-fi, like a Starbucks at lunch time. (Starbucks, 2011) Next, use a tool like Arpspoof to establish a man-in-the-middle session with each user attached to the network by pretending to be the network gateway. (Arpspoof) I monitor traffic for email addresses, especially email addresses used as logins and the associated password. Any email addresses I get will be sent phishing emails with attached document exploits to install keyloggers that call back to a server I have set up. Any email, password pairs will be used to attempt to log into various services. I will use a script to test the pair against numerous social networking sites like Facebook, MySpace, Linkedin and others. Successful access will be used to spread my keyloggers. I will continue this pattern until I net an email, password pair that successfully log into either iTunes or the Amazon Cloud. Once successful, I will use the access to download all the purchased music on the account. If there is an outstanding balance on the account, I will buy digital goods with it and download that too. All direct access to the victim business will be performed through a proxy, probably one of the machines I am keylogging.

This type of attacker would be considered a "Script kiddy" as it requires little to no direct technical knowledge and can just use tools downloaded off the internet. (Vacca, 2009, p 296). It can easily be protected against by not utilizing unsecured wireless networks, especially public ones and by not reusing passwords. It can be protected against, somewhat, by the victim company by not using email addresses as the user name, which both Amazon and iTunes do. Anything further the company could do to protect against this will interfere with the ease of use of the site, which makes users less likely to choose their service.

---

Arpspoof retrieved from http://arpspoof.sourceforge.net/

Starbucks. (2011) Wi-Fi(United States) Retrieved from http://www.starbucks.com/coffeehouse/wireless-internet

Vacca, J. R. (2009). Computer and Information Security Handbook. Burlington, MA: Morgan Kaufmann.

Think like an Industrial Spy

As of the start of this blog, I am in my second course for my Masters of Science in Cybersecurity. This is an archived posting from the first course.

Topic – Think like an Industrial Spy
Select a company. Thinking like a industrial spy, describe a hypothetical scenario on how you go about attacking their system and acquiring intellectual property.
Next, describe how the attack could have been prevented.
From March 15, 2012.

Wanting to steal intellectual property, I would search for a high gain, low effort target. Small businesses which do R&D seem like good targets to meet this criteria, since their business model relies on developing intellectual property yet they do not have the employees or likely the budget to perform extensive cybersecurity. To select my target, I read about the Small Business Innovation Research, SBIA, Program which provides grants from the Small Business Administration to companies that meet the following criteria: American-owned and independently operated, For-profit, Principal researcher employed by business, Company size limited to 500 employees. Their criteria for giving grants lines up perfectly with my criteria for targets, and their list of recipients is public record. (SBA)

I able to find a list of FY2011 recipients of the SBIR awards from the Environmental Protection Agency with a breakdown of recipients by environmental category of research. I decided to select a company whose category of research was Homeland Security and so I selected Operational Technologies Corporation of San Antonio, Texas. (EPA, 2012)

To collect intellectual property, I need access to their network. The first step after choosing the company is some minor reconnaissance that is checking over their website. There is a Contact Us page with direct email addresses and names for three employees as well as an information email. The direct person contacts will be the best for a well crafted phish, but the info email has the benefit of having a very small chance of being opened outside of the company network. (OTCorp, 2008)

To gain my actual access I will use Metasploit to craft malicious doc and pdf files containing Poison Ivy RAT payloads. (Vacca, 2009, p 55) Once the documents are opened on a vulnerable computer, the remote administration tool is dropped and executed and it calls back to the server I set up. Once that connection is established, I can browse the internal network at my leisure using the full control of the target system that the Poison Ivy gives me. (Codius, 2007)

This attack could have been prevented by intensive scanning of emailed documents and also by using hard to target workstations. The exploits I would be using are targeting Microsoft Office and Adobe Reader on Windows. If alternative software like FoxIt Reader and Openoffice were used then the exploits would fail to land. Likewise, Linux or Mac workstations would prevent the attack too.

---

Codius. (2007) Poison Ivy Remote Administration Tool Retrieved from http://www.poisonivy-rat.com/index.php?link=dev

EPA. (2012) Small Business Innovative Research:FY11 Awards: Full List Retrieved from http://cfpub.epa.gov/ncer_abstracts/index.cfm/fuseaction/outlinks.sbir/fullList/Yes/showYear/current

OTCorp. (2008) Contact Us Retrieved from http://www.otcorp.com/home/index.php?option=com_content&task=view&id=19&Itemid=34

SBA. Small Business Innovation Research Program Retrieved from http://www.sba.gov/content/small-business-innovation-research-program-sbir-0

Vacca, J. R. (2009). Computer and Information Security Handbook. Burlington, MA: Morgan Kaufmann.

Cyberspace and Cybersecurity: Archive Post 6

As of the start of this blog, I am in my second course for my Masters of Science in Cybersecurity. This is an archived posting from the first course.

Topic - Effective Security Awareness and Training Program
Discuss an important factor which would ensure an effective security awareness and training program.
From March 2, 2012

An important factor in ensuring an effective security awareness and training program is fostering an environment where users feel they have a stake in the security situation of the company. If lost productivity is the only risk then the average office worker will not see any danger to checking their webmail and file swapping on P2P sites while on work computers. These high risk activities pose significant security dangers, but that danger may be overlooked by everyone except for the system administrators. Vacca, on page 13, suggests that "perhaps the most direct way to gain employee support is to let employees know that the money needed to respond to attacks and fix problems initiated by users is money that is then not available for raises and promotions" (Vacca, 2009) A further suggestion is that presenting the computer security policies and advice in such a way that reminds employees that the advice and habits can be used to secure their home systems and information.

Mark Wilson and Joan Hash at the National Institute of Standards and Technology also remind that "an organization’s IT security awareness and training program can quickly become obsolete if sufficient attention is not paid to technology advancements" (Wilson and Hash) If the users see that the IT policies and training are becoming, or even just seeming, obsolete then they will put less effort in sticking to the advice and policies. The appearance of being lackadaisy about keeping up with technology suggests to the trainees that they don't need to take the training seriously either.

---

Vacca, J. R. (2009). Computer and Information Security Handbook. Burlington, MA: Morgan Kaufmann.

Wilson, M. and Hash, J. INFORMATION TECHNOLOGY SECURITY AWARENESS, TRAINING, EDUCATION, AND CERTIFICATION Retrieved from http://www.itl.nist.gov/lab/bulletns/bltnoct03.htm

Cyberspace and Cybersecurity: Archive Post 5

As of the start of this blog, I am in my second course for my Masters of Science in Cybersecurity. This is an archived posting from the first course.

Topic - Encryption Algorithm
Describe one encryption algorithm.
From March 2, 2012.

Rivest Cipher 4

RC4 is a light weight encryption algorithm that can easily be implemented in all programming languages. It is a symmetric encryption, which means that the encryption and decryption functions are the same and utilize the same key. As a stream cipher, RC4 can be used to encrypt any length of plaintext without having to pad out to a block size and cipher text is created by bitwise adding the keystream and plaintext modulo two, commonly known as XOR. "It is a variable key-size stream cipher with byte-oriented operations. The algorithm is based on the use of a random permutation. Analysis shows that the period of the cipher is overwhelmingly likely to be greater than 10100" (What is RC4)

RC4 was used as the first wireless networking encryption in the Wireless Equivalent Privacy standard by IEEE 802.11. (Vacca, 2009, pg 172) Despite the algorithm itself being fairly secure, the implementation used in WEP uses a fixed shared key, derived from the access point password, and an Initialization Vector (IV) to generate the keystream. Since all packets use the same shared key, the only difference seeding the keystream comes from the IV, which is only 24 bits. Borisov et al at Berkeley studied the security provided by WEP and summarized the weakness caused by the small IV well. " Such a small space of initialization vectors guarantees the reuse of the same key stream. A busy access point, which constantly sends 1500 byte packets at 11Mbps, will exhaust the space of IVs after 1500*8/(11*10^6)*2^24 = ~18000 seconds, or 5 hours" (Borisov et al)

---

Borisov, N., Goldberg, I., & Wagner, D. Security of the WEP algorithm. Retrieved from http://www.isaac.cs.berkeley.edu/isaac/wep-faq.html

Vacca, J. R. (2009). Computer and Information Security Handbook. Burlington, MA: Morgan Kaufmann.

What is RC4? Retrieved from https://www.rsa.com/rsalabs/node.asp?id=2250

Cyberspace and Cybersecurity: Archive Post 4

As of the start of this blog, I am in my second course for my Masters of Science in Cybersecurity. This is an archived posting from the first course.

Topic - Access Control Models
For each access control model (RBAC, DAC and MAC), describe the environment in which that model would work best. Provide examples.
From February 24, 2012.

Discretionary access control is useful in a shared user environment like a Unix system to provide file permissions. “In DAC, generally the resource owner (a user) controls who has access to a resource. (IBM, 2012)” This allows each user to share files they wish to, but still keep private others.

Role based access control works well for situations where a system is shared amongst various groups, but individual users do not need personal privacy. A timekeeping and point of sale system at a restaurant is a good example of this, like the one used at the Big Boy I worked at in high school. Access to clock in and out was provided to all employs but the rest of the system was denied to the kitchen staff. Servers, hosts, and managers all had access to order submission; while only managers had access to remove orders and pull daily statistics.

Mandatory access control limits security definitions to a policy administrator. Security takes precedence over usability because the access-control model “attempt to prevent transfer of information that is not allowed by the rules” (Goodrich & Tamassia, 2011) Trade secrets or national security information are good targets for this type of access control because more harm can come from unauthorized access than from inconveniences in sharing between authorized parties.

---

Goodrich, M. T., & Tamassia R., (2011) Introduction to Computer Security. Boston, MA: Pearson

IBM (2012). Access control: MAC and DAC. Retrieved from http://publib.boulder.ibm.com/infocenter/lnxinfo/v3r0m0/index.jsp?topic=%2Fliaai%2Fselinux%2Fliaaiselinuxmacdac.htm

Cyberspace and Cybersecurity: Archive Post 3

As of the start of this blog, I am in my second course for my Masters of Science in Cybersecurity. This is an archived posting from the first course.

Topic - Network Security Best Practices
Discuss the best practices for securing wired and/or wireless networks.
From February 24, 2012.

The best practice in securing a wired network is to properly identify and authenticate users, and the way to do so properly is through multi factor authentication. The traditional factor used for authenticating users in most networks is through the use of a password or passcode, this is an instance of something that the user knows. Other factors that can be used is something that the user is, that is a biometric feature like retinal image or fingerprint, or something that the user has, like a magnetic card or even a physical key. "Authentication methods that depend on more than one factor are more difficult to compromise than single-factor methods. Accordingly, properly designed and implemented multi factor authentication methods are more reliable and stronger fraud deterrents" (Wihenly, 2005, pg 3).

At present, a common and cost-effective method of implementing two factor authentication remotely is through a combination of password and a "hardware token-generated random PIN" (Vacca, 2009, pg 139) which demonstrates possession of the token generating hardware.

The hardware token PINs are used alongside the username and password combination to log into a secure system or VPN, with the user submitting the PIN that is shown on their token at the time of login. The appropriate PIN for the username is generated by the server and compared to the submission to confirm that the user possesses the required token. (RSA, 2010)

This method of two factor authentication is only effective as long as the seed information to each token is kept secret. If an attacker is able to steal the seed information, they can generate the appropriate PIN the same way that the server does. An example of this was demonstrated when the spoils of an intrusion against RSA was used to compromise Lockheed Martin. (Drew & Markoff, 2011)

---

Wihenly, (2005). Authentication in an Internet Banking Environment. Retrieved from http://www.ffiec.gov/pdf/authentication_guidance.pdf

Vacca, J. R. (2009). Computer and information security handbook. Burlington, MA: Morgan Kaufmann.

RSA. (2010). RSA SecureID Two-factor Authentication. Retrieved from https://www.rsa.com/products/securid/sb/10695_SIDTFA_SB_0210.pdf

Drew, C. & Markoff, J. (2011) Data Breach at Security Firm Linked to Attack on Lockheed. Retrieved from https://www.nytimes.com/2011/05/28/business/28hack.html?_r=1

Cyberspace and Cybersecurity: Archive Post 2

As of the start of this blog, I am in my second course for my Masters of Science in Cybersecurity. This is an archived posting from the first course.

Topic – Cyber Security Issues related to Outsourcing IT Services
Discuss the cyber security issues associated with outsourcing IT services and how can they be addressed.
From January 27, 2012

When outsourcing IT services, a company is placing either access to their network, their Intellectual Property, or both into the hands of another company. That other entity's primary objective becomes to hold onto that contract. All other priorities are viewed from the perspective of that objective, be it service quality, data protection, or any other facet of business. The secondary objective is protecting the company's image with regards to how it will affect the establishment of future contracts. Thus, the defense of the outsourcing companies IP or network will be funded only as far as it takes to defend their own image. Thus, companies that are being outsourced to create a weak spot in the security posture of the outsourcing entity. An example of this can be seen in the example of a low sophistication attacker Anonymous stealing .mil email addresses and passwords not from DOD but instead from a company they outsourced to, Booz Allen Hamilton. (CBSNews)

The reasons that companies who do not have an intrinsic interest in protecting information do not do a good job protecting it is summed up quite well back Vacca on page 5: “For most organizations, the cost of creating a strong security posture is seen as a necessary evil, similar to purchasing insurance. Organizations don't want to spend the money on it, but the risks of not making the purchase outweigh the costs.” When the data at risk isn't their own, the risks fail to outweigh the cost, so long as enough is spent to support the image of a strong security posture. After all, at the end of the day they win if they still have the contract, but the original company only wins if their network or data is still safe.

---

Vacca, J. R. (2009). Computer and information security handbook. Burlington, MA: Morgan Kaufmann.

CBSNews (July 11, 2011). Anonymous at it again: Defense contractor hacked Retrieved from: http://www.cbsnews.com/stories/2011/07/11/scitech/main20078614.shtml

Cyberspace and Cybersecurity: Archive Post 1

As of the start of this blog, I am in my second course for my Masters of Science in Cybersecurity. This is an archived posting from the first course.
In this reposting I have noticed citation errors, which have been left intact.

Topic – Vulnerabilities of Hardware and Software Components: Pick one specific hardware or software component and thoroughly discuss its cyber security vulnerabilities. From January 27, 2012

A hybrid hardware software component of particular interest to cyber security is the network stack, the operating system's implementation of the OSI model. The layered nature of the OSI model allows abstraction such that each layer can operate without concern for how or what is occurring at lower levels. This setup is highly convenient for developers because they can interface with logical constructs of sockets, ports, and sessions transparently. The vulnerability that this poses is that each level is entirely at the mercy of each lower level. TCP and UDP socket communication at the session level rides on the IP packets at the transport level for both IPv4 and IPv6 type packets. Thanks to layered networking implementing the OSI model in the network stack, the socket communication gets to its destination with no knowledge of what path it took to get there. (Ruh)

Within a single LAN, both IPv4 and IPv6 addresses are cached in a system with the associated MAC address so that the network stack can properly wrap the transport layer payload in a data link layer header. The associated transport protocol has its method for resolving a protocol address to MAC address which is used to populate the cache. IPv4 uses Address Resolution Protocol, hereafter referred to as ARP, (RFC826) and IPv6 uses Neighbor Discovery (RFC4861); both of which boil down to a host that needs to resolve an address will ask all the systems in the LAN what system uses the address. The appropriate host then responds back, essentially saying 'I have that address.' The first system records the protocol address and associated MAC address in their cache and transmits the packets it was waiting to send. Until the cache entry expires, the system will save time and send future packets destined for that same protocol address directly to the MAC from the cache. For simplicity only IPv4 will be discussed from this point on. The basic principles all apply to IPv6 though. The whole exchange is based on an assumption of trust in the network as most network stacks will record any ARP responses directly into the cache, even if the current entry was still valid.

This method of address resolution and caching creates the vulnerability that if a rogue host, 'Eve', sends an ARP response claiming to have an IP address that belongs to another host, 'Alice', to a third host, 'Bob', then Bob will update his cache. As long as the cache entry is valid, Bob will send all traffic intended for Alice to Eve. If Eve is performing IP forwarding, then she will send the traffic on to Alice. Since this all occurs at the data-link and transport layers, Alice and Bob's applications using sockets will function properly without ever knowing that Eve was receiving the traffic too. If Eve also is sending spoofed ARP responses to Alice, then all traffic will be passing through Eve, allowing that system to view, save, or even change the packets, completely transparently to the applications being run by Alice or Bob. (King)

---

King, Tom (Aug 4, 2002). Packet Sniffing In a Switched Environment Retrieved 27 January 2012 from: https://www.sans.org/reading_room/whitepapers/networkdevs/packet-sniffing-switched-environment_244

Ruh, Larry (2009). Open Systems Interconnection Reference Model Retrieved 27 January 2012 from: http://polaris.umuc.edu/de/csi/OSI_model_2009/OSI_Model_2009.html

RFC4861 (September 2007). Neighbor Discovery for IP version 6 (IPv6) Retrieved 27 January 2012 from: https://tools.ietf.org/html/rfc4861

RFC826 (November 1982). An Ethernet Address Resolution Protocol Retrieved 27 January 2012 from: https://tools.ietf.org/html/rfc826