Re: Sniffing packets between Outlook and Exchange

From: Jeff King (peff-pentestat_private)
Date: Tue Dec 11 2001 - 16:06:27 PST

  • Next message: kamat_private: "Re: Sniffing packets between Outlook and Exchange"

    On Tue, 11 Dec 2001, Harrington, Chris wrote:
    
    > In an environment with Outlook 2000 acting as an Exchange client (no POP),
    > is it possible to sniff the email traffic between the them?? If so, are
    > there any resources on preventing this?
    
    I looked into this several years ago. IIRC, Outlook->Exchange traffic is
    tunneled through an SMB named pipe. It gets user authentication at the
    SMB level.  It may also get encryption services there; I don't know.
    
    You might try running a sniffer against your box as you submit or read a
    message then grep the results for the partial contents of the message.
    You can't prove that it's unsniffable by failing, but you can certainly
    prove that it's sniffable by succeeding. :)
    
    -Jeff
    
    
    ----------------------------------------------------------------------------
    This list is provided by the SecurityFocus Security Intelligence Alert (SIA)
    Service. For more information on SecurityFocus' SIA service which
    automatically alerts you to the latest security vulnerabilities please see:
    https://alerts.securityfocus.com/
    



    This archive was generated by hypermail 2b30 : Wed Dec 12 2001 - 11:51:15 PST