Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

If my website is hosted on a network of hundreds, possibly thousands, of computers wouldn't an attacker have to gain control of just one of them in order to conduct a MITM attack on my website considering that I do not use any form of SSL encryption?

share|improve this question
add comment

3 Answers

up vote 0 down vote accepted

If you are somehow conducting administrative tasks via unencrypted methods everything is in plain text. I hope you could not or would not do that over the internet. (chances are you ssh into that server for these tasks) However hypothetically speaking if this was the case and someone somehow sniffed your traffic or somehow got between you and your web-server yes its totally possible. All your commands, passwords and html are right there in plain text ascii.

share|improve this answer
2  
Sniffing and MITM are different issues. The OP is concerned about MITM from a neighbor server. You have not explained how that can happen or shown that it might be possible. –  schroeder Apr 27 '12 at 22:46
add comment

Yes. You should assume that if an attacker compromises any one of the machines that is used to host your website, then the attacker can do serious damage: gather user passwords, spy on user transactions, etc.

The reason for this has to do with the way that the same-origin policy works. The browser does security based upon the domain name that is used to reach the web site. Suppose your site is http://www.example.com/, and suppose that in the DNS, www.example.com resolves to 1.2.3.4, 1.2.3.5, and 1.2.3.6. Then all three of the machines at those IP addresses are considered "part of the origin" by users browsers, and any one has the ability to exert full control over all content on www.example.com (much like a XSS flaw). For these reasons, you need to trust all of the machines that are used to host your website.

P.S. You don't say what resources you are interested in protecting (protecting the data on the server? or protecting users from being fooled?), or how exactly the hosting works with your website -- if you want better answers, it might help to provide that information.

share|improve this answer
add comment

The other computers would have to be in the path of your server and the visitor. It would be possible to ARP-spoof from a compromised server to force the traffic to flow through itself.

If this is something that you think could happen, then you could set up logging and alerts to determine if all traffic to and from your server goes to a new MAC address or one that is not the router that it is supposed to travel through.

If an upstream router/server that is already in the path is compromised, then you do have a problem that you might not be able to resolve as a hosted customer.

** EDIT ** One of the other ways to prevent a MITM attack from a neighbor server is to add static ARP table entries to make sure that only the hosting company's routers are the source of your traffic.

share|improve this answer
    
logging alerts using what? MAC addresses are at layer 2 this guy is talking about a host server on the internet. Mac address change at every hop of a router. –  dc5553 Apr 27 '12 at 21:23
    
I know - All the traffic to his server will be coming from the same MAC address(es), which would the the MACs of the routers of the hosting company. If someone arpspoofed the traffic through a neighbor server, then all the traffic will be redirected to a new MAC address. If you capture those changes, you can be alerted to a potential problem. Do you see it now? –  schroeder Apr 27 '12 at 22:42
    
hypothetically you want him to run a continuous arp table check to see if it changed? Don't see it happening sorry. –  dc5553 Apr 27 '12 at 22:47
    
It's a 1-2 line bash script run once per minute, a normal feature of HIDS, and can be done by kernel patches (anticap) ... –  schroeder Apr 27 '12 at 22:54
    
As an alternative, he could add static entries to his ARP tables, which would protect him from most of the issues he's worried about. –  schroeder Apr 27 '12 at 22:55
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.