Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Suposing an attacker that has gained access to the router. Is there a way, for the victim, to notice that is being attacked?

I think one of my friends is a victim of this kind of attack. How can I be sure that this is the attack that is being performed over him?

More details: Someone is changing constantly his passwords of facebook etc.

share|improve this question
    
If somebody is changing his passwords on facebook it means he likely has a trojan. –  Ramhound Oct 11 '12 at 16:45

4 Answers 4

up vote 3 down vote accepted

There are multiple 'tells' your friend might pick up on if he is a victim of a mitm vector.

Is your friends connection slower then usual? Is the facebook page exactly like the one he sees at work, school, etc?(compare source) Ettercap has a few modes designed to detect a mitm attack that your friend can make use of.

None of the above methods are fool proof, but together they build a picture of possible side effects. Your friend can bypass a dns_spoof by navigating to facebook by its ip (66.220.149.88) and us a vpn tunnel (tor is free but slow)

Having said all this, it is unlikely that your friend is a victim to a mitm attack. It is extremely probable their machine is infected with keyloggers. Have your friend run a virus scan, clean them out and then check all facebook security settings.

Also, if your friend uses yahoo have them switch to gmail.

share|improve this answer
    
and turn on two factor auth on gmail... also the best way to clean is fresh installs, ultimately a MITM can be invisible with the right tools. –  ewanm89 Sep 30 '12 at 23:45

Yes, you can detect a man-in-the-middle attack on https in the browser by checking the https connection fingerprint is correct.

For example if you wish to check https://www.facebook.com is not MiTM attacked in Internet Explorer 11 (uses two different windows, because the View Certificates dialog is modal):

  1. Open https://www.grc.com/fingerprints.htm in IE11 on the desktop
  2. Open a new IE window (ctrl-N on desktop) and go to https://www.facebook.com
  3. Click on the lock next to the address, click on the View Certificates button, and a modal dialog pops up.
  4. On the General Tab, check that the "Issued to" is *.facebook.com
  5. On the Details Tab, scroll to the bottom, click on the fingerprint, and check that the numbers and letters of the fingerprint match those displayed on https://www.grc.com/fingerprints.htm for *.facebook.com (when comparing fingerprints ignore uppercase/lowercase differences, and ignore spaces/colons).

If you wish to check any other browser, follow the instructions much further down the page under the heading "How to display this page's (or any page's) SSL certificate fingerprint:" on https://www.grc.com/fingerprints.htm . If you wish to check any other domain, under the "Custom Site Fingerprinting" heading near the top of the page you can request the official Certificate Name and Fingerprint for any domain.

This is a fairly robust way to detect man-in-the-middle proxy attacks (for proxies on the machine or the network). It won't detect any viruses etc that have infected the browser (so called man-in-the-browser attacks).

share|improve this answer
    
Hello. Have you used tools such as Xarp, AntiNetCut, Cute ARP, ARPAntiSpoofer, or ARPON. Do they work?, Which one is better?, thanks –  skan Oct 14 at 13:11

A common technique is arp spoofing. So watch for changes of the arp table (there are tools like arpwatch). Also, watch for multiple responses to your arp requests.

share|improve this answer
1  
Arp is certainly one technique that may help detect network mitm. Perhaps you can develop on this to include more information and make a better answer? –  adric Oct 12 '12 at 14:33

In general, no. There is no reliable way to detect that you are the victim of a man-in-the-middle attack.

There are some things you can do to detect imperfect attacks -- primary amongst them is to try to use SSL (https) whereever possible, and to check the browser address bar to confirm that SSL is in use (e.g., there is a green or blue glow behind the address). If you are using SSL, and if you avoid clicking through certificate warnings, you should be relatively safe from a man-in-the-middle attack. But there is little you can do to detect a man-in-the-middle attack when you are using http.

That said, I'm skeptical that your friend is being hacked by a man-in-the-middle attack. It's more likely that his password or account has been compromised. I suggest the following measures to recover:

  • Scan his computer for malware/spyware using Malware Bytes or some other good malware scanner. Remove all detected malware/spyware.

  • Change his password and his administrator password on his computer.

  • Turn on anti-virus (e.g., Microsoft Security Essentials, Avast, etc.).

  • Turn on Windows Update. Run Windows Update to update the OS. Update his browser, if it is not running the latest browser.

  • If he uses Firefox, ask him to install HTTPS Everywhere.

  • Configure Facebook to use SSL (HTTPS) for all connections.

  • Now, have him change his email password (e.g., his Gmail password) and his Facebook password. Also, have him remove/uninstall all Facebook apps. Malicious Facebook apps are a common way for people that people get attacked. Make sure the new password is long and strong.

  • If the problem goes away, you are good!

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.