A man-in-the-middle attack (MiTM) is an attack against a communication protocol where the attacker relays and modifies messages in transit. The parties believe they are talking to each other directly, but in fact both are talking to the attacker.

learn more… | top users | synonyms (1)

0
votes
4answers
42 views

is it easier to eavesdrop on ethernet connection rather than wifi?

I heard someone say that ethernet connection is vulerable if someone can connect to your LAN, and that the traffic isn't encrypted in the way it might be if you're using WPA wifi encryption. Is this ...
2
votes
0answers
27 views

If I install a certificate for the purposes of logging into a Wifi connection, is it still safe?

There are some wifi networks (large universities for example) which use HTTPS to get to a login page, and in order to verify that they have not been spoofed, provide the certificate ahead of time ...
2
votes
4answers
59 views

What are some ways to spot email spoof attacks?

I use Gmail and I started getting malicious-sounding emails from people I know intimately. The people I spoke to said they did not send those emails. In order for the attacker to carry this off, are ...
3
votes
2answers
32 views

Security of nested ssh

First of all, by nested ssh, I mean the following way of using ssh: ssh usera@Bob 'ssh usera@C' suppose A wants to login on server C, but for some reason C is not directly available to A (e.g. C's ...
1
vote
1answer
41 views

Influence of SSL Intercept on SSLVPN

We're considering implementing an SSL Intercept proxy in my organization. It will perform a SSL MITM to be able to inspect traffic. It will be a solution of a commercial vendor. It is clear that we ...
3
votes
2answers
126 views

How can I tell if my ethernet connection is being sniffed? [duplicate]

I read in another post that wired traffic is not protected: The only real additional threat that a malicious network administrator would pose, is that they have access to the wired side of the ...
0
votes
0answers
18 views

Can Bluetooth be man in the middle'd at the L2CAP layer?

Bluetooth HID devices can be man in the middle'd with two bluetooth dongles and this code http://ossmann.com/shmoo-2010/ Is this technique limited to just HID profile bluetooth devices or could this ...
0
votes
2answers
68 views

Faking IP address without being aware of returning response

I read different articles on the subject (Spoofing IP address), someone said: Spoofing an IP is usually better suited to "fire-an-forget" scenarios like DDoS. due to TCP two-way communication ...
0
votes
1answer
58 views

Why am I sometimes spontaneously presented with an SSL certificate from my U-Verse Residential Gateway?

Sometimes, we will experience a brief "hiccup" in our AT&T UVerse internet service. When this happens, and a user happens to be surfing the web at the same time, we will suddenly be presented with ...
0
votes
2answers
37 views

Sniffing TLS / SSL through HSTS?

Imagine the following: Client C wants to communicate with server S. The evil attacker A is the Man-In-The-Middle. C sends a request to S, A intercepts it. A creates a self-signed certificate with ...
0
votes
3answers
65 views

Is it possible for an attacker to redirect a packet sent by a client, modify it then sent to original server

Theoretical question: Is it possible, or will it ever be possible, for an attacker to sniff/intercept it and redirect a packet, sent from a client through wireless, modify it and then sent to the ...
0
votes
0answers
22 views

Problem creating evil twin using airbase-ng [migrated]

I am trying to create an evil twin access point using airbase-ng.I am creating a hotspot using my mobile and connecting anther mobile to this hotspot.Now I am trying to create an evil twin access ...
0
votes
0answers
56 views

Does HTTPS protocol leak HTTP body length?

It seems that in a MITM attack, hackers may know the whole HTTPS packet size sent through the network (i.e. size of HTTP headers + HTTP body + overhead). Besides that, does the HTTPS protocol also ...
0
votes
2answers
53 views

Protect SSL connections from MITM for users with modified clients

I'm working on a web app that uses SSL. I'm afraid that some people might access the app via a network that uses a proxy to intersect and inspect the SSL traffic [MITM]. Some people might access the ...
4
votes
1answer
103 views

Man in the Middle Attack against NTP

So, lately I've been really into penetration testing and learning the nitty-gritty of tech. I'm dong courses on computer architecture, cryptography, surveillance law, and computer networks. I never ...
1
vote
2answers
485 views

Can a wifi provider decrypt HTTPS usind MITM without users noticing? [duplicate]

As a router, can I send forged certificates, and intercept requests to CA and return responses that they are valid. So I could MITM all https traffic, and spy on my users?
1
vote
2answers
48 views

ARP poison detection [duplicate]

I tried ARP poison on my local test system with ettercap. It was successfully, so I decided to run a test on most secure systems, like Facebook and Google, but I could not reach them and they warned ...
1
vote
3answers
68 views

Risks associated with HTTP content injection?

I'm curious about the risks associated with HTTP content injection, where an ISP injects content to pages accessed over non HTTPS connections. Some examples: ...
0
votes
1answer
53 views

MITM sniffing packets

I fail to understand how a MITM attack sniffs packets and modifies them.In the case of ARP spoofing although the attacker has spoofed the MAC address of a host, how does he modify it as the IP layer ...
0
votes
0answers
59 views

Is facebook to facebook (mobile application call ) encrypted?

I understand facebook uses WebRtc to send voice data packet in network if any one end client is on the browser. Use of DTLS packets can be seen in captured (wireshark) file. But in case of mobile app ...
1
vote
0answers
82 views

Perform SSL MITM -> Decrypt packet -> Modify packet -> Encrypt packet -> Send it [closed]

I have a victim and a server. My goal is to intercept traffic, perform SSL MITM, decrypt packet, modify it, encrypt and send it further. Everything has to be on-the-fly and protocol agnostic. For now ...
8
votes
2answers
1k views

Man in the middle attack theory [duplicate]

Me and my colleague are trying to come up with a way around preventing a theoretical man in the middle attack. The scenario is: Communication is only through one channel and either sides isn't ...
3
votes
1answer
53 views

Is it safer to store valuable information on a unsecure client or send the data through the internet?

Background: I'm creating a secure web app with the purpose to act as a no-knowledge storage for small data (we're talking a few bytes). Since all the encryption and decryption happens client-side, ...
-1
votes
1answer
45 views

Does MITM attack work across Remote Systems?

I have question about if MITM works across remote systems? Often, I'm doing internal penetration test, but I'm not sure about how to do MITM attack when I am outside from that network. Does classic ...
3
votes
1answer
98 views

Any tools like PuTTY for manually stepping through network communications?

Are there any tools that would allow me to "manually" step through the network-stack processes of a device connecting to a network and communicating with other devices? Similar to using PuTTY to ...
0
votes
1answer
127 views

Which systems in a network are able to spoof a TCP handshake?

I am reviewing for my final exam tomorrow, I came across a past exam question. An attacker wants to initiate a TCP handshake with a target to make him think E initiated it, attacker knows IP ...
0
votes
2answers
112 views

Would my protocol be safe?

Suppose I have a protocol like the one below between users A and B; -A sends random nonce G1 to B -B sends back hash_k(G1) and random none G2 -A verifies hash_k(G1), then sends back hash_k(G1 | ...
4
votes
1answer
62 views

Does mutual authentication have any impact on MiTM possibilities?

When doing a Man-in-the-middle attack against a classic one-way authentication server, the attacker just have to: Use a certificate credible enough to be trusted by the victim, Act as a standard ...
0
votes
2answers
53 views

Is there any possibility that a trusted CA can perform a man in middle attack? [duplicate]

Is there any possibility that a trusted CA can perform a man in middle attack? Since the CA certificate is installed and trusted by the browser it will never raise a warning message. Hope my doubt ...
0
votes
2answers
151 views

How do google or facebook know I'm behind a man in the middle proxy?

Whenever I'm behind a man in the middle proxy such as burp, and try to access either google or facebook, I get an alert message telling me that the connection is not reliable and blocks the page from ...
7
votes
1answer
176 views

Distinguish between Wi-Fi Captive portal and MitM attack

Not sure whether this should be asked in Super User or here. How does Chrome distinguish between a Wi-Fi access point intercepting with a captive portal and a man-in-the-middle attack on HTTPS? Are ...
1
vote
3answers
105 views

Prevent MITM between custom phone app and local server

We're building a Wifi enabled device. The device will be installed locally on each client's office and people in the the small office will connect to this Wifi enabled device, They will send/receive ...
2
votes
1answer
109 views

someone may be doing something nasty

I have an ssh server. earlier toady, I was about to login to my server, when I got a message that said something along the lines of "Someone may be trying to do something nasty" and indicating a man ...
1
vote
0answers
87 views

How to recreate the Freak attack?

Currently I am trying to recreate the Freak attack on a virtual machine. For this purpose I set up a Linux Mint 17.1 system with Apache 2.4.7 (with a self signed certificate) and OpenSSL 1.0.1f. I ...
3
votes
1answer
122 views

Can user send fake request if it has JWT token?

I developed an android application that request to a REST service for do actions! My questions are: If anyone trace the requests and responses, Can he get the token from headers? Where should I ...
4
votes
3answers
856 views

“Authorized” Man in the middle

I am implementing a TLS connection with a basic server and client. It’s a one way connection: the server has a certificate chained to the CA, and the client has a collection of trusted root ...
2
votes
3answers
82 views

Public key in resources for avoiding man in the middle attack

I am developing an android application which needs to communicate with a web server. Instead of using common SSL I would like to save my custom public key in resource folders of the application(APK ...
1
vote
2answers
83 views

Securing communications in decentralized network of servers

Lets consider the following setup: One has a decentralized network of servers. A single root certificate has been distributed to all servers which has been positively checked as authentic and ...
1
vote
1answer
151 views

Has anyone used this ICLOAK USB device? [closed]

Does anyone know about this ICLOAK USB device? Opinions or how well they work? I'm looking for a security solution when I'm using PCs where I work. Occasionally we have to log into to web sites, ...
0
votes
1answer
48 views

MitM Chrome Mobile

I just came across the issue about MitM on Opera/Nokia browser 2013. I know, this is an "old" problem, but it seems very interesting to me. I was wondering how Chrome on mobile handles the SSL ...
2
votes
0answers
234 views

SSL traffic manipulation through ettercap MitM and iptables

I am trying to understand the relation between some tools and concepts used for MitM on a wifi network and how https transaction (over this wifi network) between an android app and the respective ...
0
votes
4answers
114 views

Risks of using HTTP

What are the risks of using HTTP instead of HTTPS assuming that there isn't any rogue hacker sitting on my personal WIFI network waiting to sniff my traffic? Can a hacker sit in his boat in the ...
3
votes
2answers
122 views

Payment form from http is secure? [closed]

There are lot of payment gateways (Worldpay, PayPal, ..) offering easy integration, when the plain webpage using URL redirection to the payment page. HTTPS (worldpay,paypal), where the user posts his ...
2
votes
0answers
50 views

I need a secure laptop tethered to a mobile internet connection. [closed]

I invent things. Think energy, IT security algorithms, etc. I'm actively targeted for information breaches by the largest corporations on the planet. All paranoia aside... I'd like a secure ...
2
votes
1answer
59 views

ettercap use as local proxy [closed]

Hi everibody and sorry for my english, I'm looking for a way to use ettercap (or another program) to alter TCP traffic (coming from local) on the fly. I used "netsed" with iptables, but netsed is too ...
10
votes
2answers
2k views

How can I prevent a man-in-the-middle (MITM) attack on my Android app API?

I checked out the app Packet Capture. This app is able to decrypt my app APIs (SSL Enabled) data by mounting a MITM attack using the Android VPN service. This does not even require root. How can I ...
2
votes
2answers
57 views

ssl_error_bad_certificate_domain, does Firefox still validate the certificate? [duplicate]

I have a private NAS device. It uses a self-signed SSL certificate. I can import the cert into Firefox and everything works as long as I'm accessing the device from somewhere on the internet. SSL ...
0
votes
1answer
63 views

Using randomly generated numbers to authenticate with a Relay server

I'm developing a public VoIP relay server, that will help bypass internet firewalls by allowing two clients to connect with it and then it will relay data between the two. Both clients will connect ...
0
votes
1answer
52 views

Decrypting SSL within Multiple Products

I've read the various questions tagged [ssl] and [mitm] and [proxy] and I couldn't find a duplicate. I cannot find any documentation on this subject online. All of the traffic is currently flowing ...
3
votes
1answer
160 views

A certificate site name mismatch when using preinstalled Toshiba software? (Superfish?)

On my Toshiba laptop there are a variety of different Toshiba programs that came pre-installed. Many of them are some sort of utility, optimizer, checkup, and update kind of programs that I guess are ...