Network Concerns Over a MITM Attack

Question

If my website is hosted on a network of hundreds, possibly thousands, of computers wouldn't an attacker have to gain control of just one of them in order to conduct a MITM attack on my website considering that I do not use any form of SSL encryption?

Answer 1

If you are somehow conducting administrative tasks via unencrypted methods everything is in plain text. I hope you could not or would not do that over the internet. (chances are you ssh into that server for these tasks) However hypothetically speaking if this was the case and someone somehow sniffed your traffic or somehow got between you and your web-server yes its totally possible. All your commands, passwords and html are right there in plain text ascii.

Answer 2

Yes. You should assume that if an attacker compromises any one of the machines that is used to host your website, then the attacker can do serious damage: gather user passwords, spy on user transactions, etc.

The reason for this has to do with the way that the same-origin policy works. The browser does security based upon the domain name that is used to reach the web site. Suppose your site is http://www.example.com/, and suppose that in the DNS, www.example.com resolves to 1.2.3.4, 1.2.3.5, and 1.2.3.6. Then all three of the machines at those IP addresses are considered "part of the origin" by users browsers, and any one has the ability to exert full control over all content on www.example.com (much like a XSS flaw). For these reasons, you need to trust all of the machines that are used to host your website.

P.S. You don't say what resources you are interested in protecting (protecting the data on the server? or protecting users from being fooled?), or how exactly the hosting works with your website -- if you want better answers, it might help to provide that information.

Answer 3

The other computers would have to be in the path of your server and the visitor. It would be possible to ARP-spoof from a compromised server to force the traffic to flow through itself.

If this is something that you think could happen, then you could set up logging and alerts to determine if all traffic to and from your server goes to a new MAC address or one that is not the router that it is supposed to travel through.

If an upstream router/server that is already in the path is compromised, then you do have a problem that you might not be able to resolve as a hosted customer.

** EDIT ** One of the other ways to prevent a MITM attack from a neighbor server is to add static ARP table entries to make sure that only the hosting company's routers are the source of your traffic.