Penetration Testing: RE: pcanywhere passwd capture

["Andrew van der Stock" <ajv () e-secure com au>]

If they are using "no encryption", you should be able to sniff it. If they
are using a less than perfect configuration, which allows you pull down the
encryption level, and you have a tool like hunt to help inject a correctly
formatted response packet, and you're quicker than the respondant, and the
TCP iss sequences are predictable, you should be able to similarly encourage
"no encryption", but I doubt it's worth the effort.

pcAnywhere prior to release 8 has a lot of issues. pcAnywhere 8 and 9 can
still be killed off if you don't patch them properly. pcAnywhere 10 is
pretty new and I have not had a chance to really play with it yet, but the
options for secure operation are really good from the doco I've read.

Andrew

-----Original Message-----
From: cdowns () securityfocus com [mailto:cdowns () securityfocus com]On
Behalf Of cdowns
Sent: Thursday, 21 June 2001 00:57
To: pen-test () securityfocus com
Subject: pcanywhere passwd capture


is it possible to capture pcanywhere encryped passswd's during a MITM
attack ? ive been trying several ways this morning with no success so im
assuming im doing something wrong.

thanks
-D