Don't Chat with Ncat Without SSL
I recently blogged about how to set up a lightweight chat server with Ncat, which is the Nmap version of netcat.
But after trying it out, I realized that my connection was probably not encrypted and thus, someone with access to monitor the network running a packet capture at the time my chat messages were sent could see the contents of the messages. Below is an example of running Ncat without encryption.
Here is the ncat chat server:
And here is the client:
And I ran Wireshark on the chat server to capture the conversation:
You can see that the packets were captured and the contents of the conversation are displayed on the bottom right side.
It may not be a super big deal considering someone snooping must be on the network, have access to mirror the port that the traffic is going through and have the packet capture running at the time of the conversation. But nevertheless, I prefer the traffic to be encrypted.
The solution is to enable SSL when starting the chat server. This way, all traffic between hosts will be encrypted, and someone snooping with Wireshark won't get more than a page of a jibberish. Here's an example with SSL enabled.
This is the chat server:
And this is the client side:
And this is the ouptut from the Wireshark packet capture:
As you can see, in the bottom right corner, there isn't any human readable content.
So if you're going to use Ncat as a chat server, its better to throw in the --ssl tag and keep your traffic encrypted.
