Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I was humming along with my usual routine of listening to old Defcon videos trying to understand some of the basics of what's going on in the IT Security world, when I came across one explaining man in the middle attacks.

So I got to thinking. Well, what could you really do with that? Then I thought of an odd man in the middle attack that I'm wondering, if it would work.

So we all know routers direct packets along on their way to wherever they're going. This is fine and dandy. Yet what if you set up something a little more evil. When a packet comes your way (destination of which is one of a pre-compiled list of sites), what if I pretend to be that destination? What if you say "Yes I'm paypal.com! Lets make a secure connection!". Then you make a secure connection with that thingy. After doing this, you could make a secure connection with PayPal, and do everything the user is doing, yet you grab all the information you want (i.e. how many smiley faces they are sending to their brother Steve).

The only problem I can think of running across is, if the packet decides to take a different path. I'm not sure about this, but you might be able to tell the other system that you're changing your blah blah blah, so it should connect to your real blah blah blah.

Is there anything out there to prevent this? I can't think of anything, and the idea of people being able to do this is slightly scary...

share|improve this question
1  
More generally: How does SSL work? (the answer to your question is in there, but mixed with a lot of other considerations) –  Gilles Apr 7 '13 at 18:29
    
Best prevention is awareness and testing, SET is a good tool, MITM is a good tool and well informed policies. But most ssl encrypted traffic can't easily be properly captured. But how do you ensure your in the most catagory, regular testing with tools as previously mentioned by myself and Rory MITM –  chrisc Apr 8 '13 at 12:04
add comment

3 Answers

up vote 12 down vote accepted

A router misbehaving and trying to act as a fake server with regards to the client, and a fake client with regards to the true server, forwarding data in both directions, is the exact definition of a man-in-the-middle attack. Apart from routers (which act at the IP level), classic practical methods for MitM include:

(This list is in no way exhaustive.)

To defeat these attacks, we use server authentication which, in the case of SSL Web sites (like https://www.paypal.com) uses X.509 certificates. When the client (a Web browser) connects to the Paypal server, it explicitly requires a "secure connection" (because the URL begins by https://, not http://) and will reject the server unless the server uses a certificate which:

  1. is issued by one of the root CA that the browser trusts a priori (the Verisign/Entrust/Thawte/whatever that were included by the browser vendor), and:
  2. contains the expected server name in it (www.paypal.com, as specified in the URL).

On mismatch, the browser will warn the user in a spectacular way. The MitM will be successful only if one of the CA goofs up (i.e. the CA issues a certificate containing www.paypal.com to somebody who is not at all the owner of the paypal.com domain), or the user goofs up (by using a URL which says www.paypal.com.evilhacker.com, or by not paying heed to the scary warning displayed by his browser), or the user machine is already compromised (e.g. through some malware which installed a rogue root CA).

Generally speaking, SSL has been designed so that security is maintained independently of the transport mechanisms. SSL security does not rely on routers behaving "honestly". SSL assumes that routers are all hostile.

share|improve this answer
    
Yet you can't spoof the certificate? –  Griffin Nowak Apr 7 '13 at 18:31
    
I thought you could here stackoverflow.com/questions/9353340/… –  Griffin Nowak Apr 7 '13 at 18:32
    
Certificates are signed. To make a fake certificate, you have to break a CA, or get your own rogue CA to be trusted. Otherwise, you can sign whatever you want, but existing clients will not accept the certificate as "valid". –  Tom Leek Apr 7 '13 at 18:34
5  
It uses mathematics. Mathematics are great. –  Tom Leek Apr 7 '13 at 18:52
1  
@KyleM of course if you do, all bets are off... –  Shadur Apr 8 '13 at 8:47
show 10 more comments

Preventing this kind of issue depends on the type of protocol that's used. Assuming that we're talking about web access (HTTP) here then the main defence against this kind of attack is a well configured SSL setup combined with some user awareness.

If you try to intercept access to an SSL encrypted website then you need to present a certificate to the user where you pretend to be the site you're spoofing (in your example paypal.com).

However the users browser will only accept certificates which have been signed by certain "trusted root" certificates (this is usually defined at base by the browser or operating system vendor).

So as an attacker you can either try to use an untrusted certificate (one you generate yourself claiming to be www.paypal.com) in which case the user will get a warning that the certificate cannot be trusted, or you could try to present the user www.paypal.com unencrypted and hope that they don't notice. that said protections like SSL pinning and HSTS could make this type of attack more difficult or indeed impossible..

Either way if you have a MITM type setup you have a fair degree of attacks that you can carry out. For Internet connections, potentially the hardest piece would be getting to the point of being a man-in-the-middle.

share|improve this answer
add comment

This is what SSL certificates are for. Your browser has a list of trusted certificates and certificate providers, and when a site says I'm PayPal.com your browser knows the certificate is wrong.

A man in the middle attack may spoof certificates or persuade you to accept an incorrect certificate, and a successful one could indeed do what you say, and steal your money. It happens a lot.

Not as scary as you think though. Usual guidance applies: keep your system up to date, use antivirus, avoid dodgy behaviour online, etc

share|improve this answer
    
So if my pre-compiled list has spoofed certificates then it would work? –  Griffin Nowak Apr 7 '13 at 18:35
    
Read this article about DigiNotar-ibtimes.com/… –  Rory Alsop Apr 7 '13 at 18:41
    
@Griffin Spoofing signed certificates is distinctly nontrivial. –  Shadur Apr 8 '13 at 8:48
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.