Okay, just one more post before I go to bed. Last Saturday I presented some non-research at my college’s annual research conference. I spoke about a project that I’ve been working on in the Internet Security Research Lab at Brigham Young University. (Am I just link-happy or what?) My work started with the idea that web login forms (like the one on BYU’s homepage) that are sent over an insecure connection can be altered using a man-in-the-middle attack, and instruct a browser to send a username and password directly to the attacker. I used ARP-spoofing to gain control over another machine’s network traffice, then I used a program that I wrote to watch for the user to request a certain web page, sent them back an altered form, and then waited for the user to send back their username and password.
It was a really fun project to work on. Hooray for C! I still have one question though. Why do machines process ARP replies that that didn’t request? It doesn’t seem like it would be difficult to keep track of requests, and only process matching replies. Anyway, I’m still looking into that, so hopefully I’ll find the answer and make another post. But I forgot what this post was supposed to be about. My PowerPoint slides and the accompanying script that is almost accurate as to what I said in my talk, and when I clicked the remote for the slide to change. My talk was also judged. My judge remarked that black on blue does not good contrast make (yes, I agree), but on a positive note, he was impressed with the manner in which I presented while the photographer was running around me snapping pictures.
Alright. I’m going to bed now.