Jeff Morriss suggested that I pose this question to you folks.
Here is what I wrote:
First:
I first log onto Windows machine
I log onto my Isp
I log into my proxy
Maybe do a few things online (eg. go to a few websites)
Then log into Wireshark
Next:
When launching WS, immediately the capture starts a DNS authentication trace
and an etherXXXXa* file with Windows & ISP usernames AND passwords is created.
Since I expect WS to be literal, I would expect that those actions that had
taken place in the past (logons & DNS authentication) would not be captured
since WS had not been started when I logged on. That means that this
information is being cached or worse somewhere. For my peace of mind, please
can you tell me about this security issue? Thank you.
......................
Here is what Jeff wrote:
Anyway, a brief answer: Wireshark on Windows relies on WinPCAP to do the
capturing. I'm pretty sure WinPCAP won't start capturing until you ask it to
do so. And I'm pretty sure that the OS's TCP/IP stack isn't going to cache
stuff to give to WinPCAP after the fact.
(BTW, the etherXXX file is just the temporary PCAP file that contains the
packets that were captured--and what Wireshark displays for you. The fact that
your password, etc., are in there just indicate that your password, etc., were
sent over the wire unencrypted.)
..............
What Jeff described is what I expected but I believe that I understand
now what I am seeing. WS does its own DNS. So, that explains the
first question.
The second issue, however, is still a big concern. The etherXXXXa
file always contains the complete (passwords included) authentication
data plus more. Again, this unsaved (by me) login information was
sent over the wire in the past (PPP PAP), yet it is being saved (by ?)
and put into this file in the present. How can I prevent this login
info from being saved? How can I encrypt this login info? This is a
security risk.
--
All that is necessary for evil to succeed is that good men do nothing.
~Edmund Burke
