Is there a method to detect an active man-in-the-middle?

Question

Suposing an attacker that has gained access to the router. Is there a way, for the victim, to notice that is being attacked?

I think one of my friends is a victim of this kind of attack. How can I be sure that this is the attack that is being performed over him?

More details: Someone is changing constantly his passwords of facebook etc.

Answer 1

There are multiple 'tells' your friend might pick up on if he is a victim of a mitm vector.

Is your friends connection slower then usual? Is the facebook page exactly like the one he sees at work, school, etc?(compare source) Ettercap has a few modes designed to detect a mitm attack that your friend can make use of.

None of the above methods are fool proof, but together they build a picture of possible side effects. Your friend can bypass a dns_spoof by navigating to facebook by its ip (66.220.149.88) and us a vpn tunnel (tor is free but slow)

Having said all this, it is unlikely that your friend is a victim to a mitm attack. It is extremely probable their machine is infected with keyloggers. Have your friend run a virus scan, clean them out and then check all facebook security settings.

Also, if your friend uses yahoo have them switch to gmail.

Answer 2

In general, no. There is no reliable way to detect that you are the victim of a man-in-the-middle attack.

There are some things you can do to detect imperfect attacks -- primary amongst them is to try to use SSL (https) whereever possible, and to check the browser address bar to confirm that SSL is in use (e.g., there is a green or blue glow behind the address). If you are using SSL, and if you avoid clicking through certificate warnings, you should be relatively safe from a man-in-the-middle attack. But there is little you can do to detect a man-in-the-middle attack when you are using http.

That said, I'm skeptical that your friend is being hacked by a man-in-the-middle attack. It's more likely that his password or account has been compromised. I suggest the following measures to recover:

• Scan his computer for malware/spyware using Malware Bytes or some other good malware scanner. Remove all detected malware/spyware.

• Change his password and his administrator password on his computer.

• Turn on anti-virus (e.g., Microsoft Security Essentials, Avast, etc.).

• Turn on Windows Update. Run Windows Update to update the OS. Update his browser, if it is not running the latest browser.

• If he uses Firefox, ask him to install HTTPS Everywhere.

• Configure Facebook to use SSL (HTTPS) for all connections.

• Now, have him change his email password (e.g., his Gmail password) and his Facebook password. Also, have him remove/uninstall all Facebook apps. Malicious Facebook apps are a common way for people that people get attacked. Make sure the new password is long and strong.

• If the problem goes away, you are good!

Answer 3

A common technique is arp spoofing. So watch for changes of the arp table (there are tools like arpwatch). Also, watch for multiple responses to your arp requests.