MITM Attacks over SSL [duplicate]

Question

Possible Duplicate:
How might the U.K. Government's proposed internet surveillance equipment “bypass” encryption?

If I have a server (call it server 1) set up to receive POST data from another server (server 2) over SSL, and then server 1 does stuff with the POST data, what is there to stop a MITM intercepting the entire SSL payload and then sending it off to server 1 at a later time?

I realise that the MITM won't be able to see or modify the data, but couldn't they keep on sending it to server 1 and cause it to do something that we don't really want?

Answer 1

SSL does not guarantee that MiTM will not occur. A proxy server can intercept SSL. There are corporate solutions to intercept SSL for logging purposes.

You are talking about a replay attack. Possibly, but redundant packets with the same data should be dropped. If you do not have the unencrypted body to manipulate a replay attack would be only as useful as just any DoS attack.

Some Links

• http://crypto.stanford.edu/ssl-mitm/
• http://mitmproxy.org/
• http://stason.org/TULARC/security/ssl-talk/4-1-Does-SSL-protect-users-from-replay-attack-by-eavesdropp.html

Related Questions - http://stackoverflow.com/questions/2769992/replay-attacks-for-https-requests -http://serverfault.com/questions/32473/does-https-include-protection-from-a-replay-attack