Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 2 down vote favorite

As part of my daily routine, I was SSH'ing to one of the corporate servers. However this time I was presented with following message 

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that the RSA host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
XX:XX..............
Please contact your system administrator.
Add correct host key in /Users/<user>/.ssh/known_hosts to get rid of this message.
Offending key in /Users/<user>/.ssh/known_hosts:43
RSA host key for <SERVER> has changed and you have requested strict checking.
Host key verification failed.

Please explain as to MiTM attacks are possible in this scenario.

share|improve this question
1  
You sure the key hasn't been changed without you being notified by your sysadmin? the probability of an MitM attack is quite low! Most of the time when I have this message is when I changed the RSA key on my server or reinstalled it. – Cyril N. May 12 '12 at 9:48
There is high probability that the key is changed. However I'm interested in knowing about MiTM in these scenes. – Novice User May 12 '12 at 10:12
What do you want to know exactly? what the attacker can do or how the attacker can establish a MitM ? – Cyril N. May 12 '12 at 10:30
2  
Wikipedia has an article on man in the middle attacks – Hendrik Brummermann♦ May 12 '12 at 12:05
2  
I hope Those Links help you to uderstand MITM attacks OWASP Man in the Middle Attacks, MITM Attacks Explained, Windows Security MITM Attacks, BlackHat MITM Attacks PDF – Bnhack May 12 '12 at 16:18
show 1 more comment

2 Answers

up vote 7 down vote accepted

If an attacker gets control over one of the routers between you and the machine you are connecting to, they can redirect your IP packets to some other machine, which would then claim to be the real target. It might forward both your authentication and the following traffic.

Obviously, that machine would learn your password if you use one, see what you are doing on the remote machine, and could alter all data sent in any directions. Everything a man in the middle attack allows to do (which is different from passively observing the traffic).

share|improve this answer
up vote 1 down vote

MITM attacks happen to be LAN attacks. When the traffic flows on wire, it uses physical addresses for communications. When you initiate a connection, any connection, let us say SSH connection, then in that case first your machine checks if it knows MAC address of server IP, if knows, starts to send data packets, else, it tries to get the mac address. When you connect for the first time to any ssh server its key is stored on your box. Now coming to MITM, it is manipulation of ARP (poisoning of arp). Means an attacker adds fixious entries in your machine saying IP of server is his mac, now when u connect to your ssh server, your machine opens connection to attacker box and as the fingerprint of server key is different and does not match the previous, you get warning. This does not mean, that this attack cannot be done over different networks, it can be, An attacker just needs to be in the data flow between the client and server.

Being in data flow, an attacker can do anything, get your password in clear test, what u felt encrypted, replay the ssh to server to compromise the server etc etc

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.