A man-in-the-middle attack (MiTM) is an attack against a communication protocol where the attacker relays and modifies messages in transit. The parties believe they are talking to each other directly, but in fact both are talking to the attacker.

learn more… | top users | synonyms (1)

1
vote
2answers
42 views

Can a properly implemented TLS connection be intercepted?

Assuming a TLS connection where both the server and client perfectly adhere to the pertinent standards. Can an transparent HTTPS proxy intercept the TLS connection? (Assuming the "mock CA" ...
1
vote
2answers
24 views

Unencrypted FTP to transfer encrypted data - okay if IP-restricted?

If unencrypted FTP over the public internet is the only file transfer option for a particular situation, what security concerns are applicable assuming: The data being transferred is strongly ...
11
votes
1answer
103 views

How can mobile sign-on be secured from imposter authentication screens?

History seems to have come almost full circle where old issues are shown in new/emerging technologies. Background If you trust the operating system, Windows originally had the Control - Alt - Delete ...
4
votes
1answer
89 views

How to Man-in-the-middle a whole network?

When performing a MiTM attack, you generally need to specify the router's IP address and the "victim" IP address. I'm trying to demonstrate to a business owner why he needs to secure his network, but ...
2
votes
2answers
70 views

SSL stripping in home network

I am trying to monitor the traffic of some "smart devices" in my home (TV, coffee machine, ...) but most of them communicate over SSL. What possibilities are there to look into SSL encrypted ...
-1
votes
0answers
32 views

WPA explained for the non-technical?

Can anybody give me a simple explanation of the WPA mechanism used in our WiFi routers? How does my device know that it's connecting with the router I want to connect to (i.e. no man in the middle ...
2
votes
0answers
96 views

ssh dns spoofing warning - possible investigation?

Recently the router my ISP provided started to work suspiciously. At times the wireless connection from my devices to the router breaks and the router stops responding while sometimes the connection ...
1
vote
3answers
149 views

MITM on popular sites - DNS

Can a MITM attack on popular sites such as Facebook.com Google.com be done by intercepting the DNS requests? Will the user notice something? For instance: Loading https://fb.com The client ...
0
votes
1answer
136 views

Any real-world examples of root certificate store compromises?

Apart from the infamous Superfish/Lenovo case this year, are there any other known cases of a malicious root certificate being installed on a target machine to allow transparent MITM attacks, whether ...
2
votes
1answer
179 views

ARP poisoning and port forward together

Suppose these assumptions: Router IP address: 192.168.1.1 Router MAC address: 00:00:00:00:00:00 My IP address: 192.168.1.2 My MAC address: 00:00:00:00:00:01 Victim IP address: 192.168.1.3 ...
0
votes
2answers
149 views

How is this SSL spoofing possible?

Here is a description of a seemingly successful SSL certificate spoof: https://cryptostorm.org/viewtopic.php?f=67&t=8713 The session is initiated by pointing a newly-opened icedove window ...
0
votes
0answers
10 views

MITMf import error [migrated]

I was trying to install MITMF on Ubuntu 15.04. I followed the instructions on git. I installed all the dependencies, including those in requirements.txt and ran setup.sh. However, I recieved the ...
2
votes
1answer
84 views

Why is referer checking needed for Django to prevent CSRF

Today I learned that Django's CSRF protection uses refer(r)er header checking in addition to checking a hidden form field against a cookie. It seems to be important, judging from docs and issue below. ...
0
votes
2answers
71 views

Does man in the middle require physical access to the network infrastructure?

Reading other questions such as this or this or this, it seems if I'm the only one using the wifi connection at home I can be sure no man in the middle attack is happening, because there is no way to ...
3
votes
4answers
121 views

Can MITM change the protocol?

According to my experience surfing the web, many websites foo.com don't support https. When I go to https://foo.com, it just changes to foo.com Can attackers forge the fact that foo.com doesn't ...
2
votes
1answer
63 views

SSL certificate trust chain shows root certificate with 1024-bit public key - Is this evidence of a MITM attack?

My account at my domain name registrar was hacked and I am trying to understand how the hackers were able to steal my login credentials. Because the root certificate in the trust chain for the ssl ...
2
votes
2answers
61 views

Forwarding an SSL connection

My general question: Can a two-way SSL connection be forwarded to a 3rd server? The specifics: I have a WebLogic server supporting two way-SSL, client side's cert is from their CAC card. The ...
24
votes
5answers
2k views

What prevents a man in the middle from requesting a certificate for your server?

Let's say you have a server at shop.example.com and you are requesting a certificate from some trusted CA like Comodo (they say they'll issue it within few minutes online). First of all, how can ...
4
votes
3answers
1k views

How do I verify someone's identity if the only method of contact is their email address?

Email addresses can be hacked or perhaps even spoofed. I need to pay individuals via paypal and I fear that over time people's email will change or become compromised. How can I ensure I am paying the ...
0
votes
0answers
18 views

OTR and active Man In The Middle attacks [duplicate]

As I'm currently playing around with cryptography, especially OTR, I'm wondering about its security against active MitM attacks. Let's say Alice and Bob created an OTR session, but Eve is acting as ...
5
votes
4answers
124 views

MITM attack between me and TOR entry node

In which ways can my ISP, who by the way controls the WiFi router I connect to, do a MITM attack on my TOR connections and hence read the traffic?
3
votes
3answers
114 views

Detecting a MITM attack

If my session is under a Man-In-The-Middle attack, can I detect it by checking the ip addresses my machine is connected to? For example, I want to know if my connection to a certain website is MITMed ...
2
votes
1answer
55 views

Security bounds of TLS client authentication (from browsers)

Say that there are two servers that perform TLS. Both servers have valid end-point certificates. In other words, neither of them would raise a warning from the browsers after the connection has been ...
1
vote
2answers
125 views

How do I perform a legal SSL MitM attack for my company?

I have been given a task to test some of our company's security. I have SSL stripped before but on a very basic level and now days with the security is a bit harder. I want to allow all HTTPS traffic ...
-4
votes
1answer
114 views

Is it possible for someone to read Gmail messages with a man in the middle? [duplicate]

Assuming these hypotheses: 1) Your account isn't hacked (hacker has not entered your account directly) 2) Gmail encrypts via SSL end-to-end 3) The hacker is not Gmail or Google 4) There is no ...
3
votes
1answer
62 views

Is it possible for an SSH MITM to attack only if the key isn't in the known_hosts?

I was trying to connect a server using a different port when the network seemed too slow. It gives an ECDSA key, while the previous key in the known_hosts is RSA. I refused to continue the connection ...
3
votes
1answer
64 views

Security of OpenVPN against sophisticated DPI solution

I'm planing to build a device (prototype) that act as a portable security gateway. To make this, I choosed OpenWRT running on Raspberry Pi with OpenVPN for VPN connection. My main purpose of this ...
3
votes
1answer
124 views

How was my email intercepted? [closed]

I've recently sent an email to a non-Protonmail user, using a code phrase. Someone on the recipient's home network was able to intercept the email and responded to me in detail as to the content of my ...
0
votes
2answers
123 views

Could a compromised root CA impersonate any SSL certificate?

My question is about MITM attacks against https and how those would appear to the end user. Suppose a trusted root CA were compromised / coerced into producing fraudulent SSL certificates. What would ...
-3
votes
1answer
75 views

Tor website HPKP (key pinning) failure

I'm currently facing a key pinning error when trying to access the torproject.org website with Firefox. Is anyone facing the same problem? Does anyone know if they changed their certificate? If not, ...
1
vote
0answers
46 views

For attackers looking to launch arp spoof on a target, does the attack have to happen in real time?

I was surfing the web at 3 in the morning and I got a warning which seems to indicate a MITM attack. Does this mean the attacker was able to passive sniff my activity in real-time in order to launch ...
1
vote
4answers
117 views

is it easier to eavesdrop on ethernet connection rather than wifi?

I heard someone say that ethernet connection is vulerable if someone can connect to your LAN, and that the traffic isn't encrypted in the way it might be if you're using WPA wifi encryption. Is this ...
2
votes
0answers
47 views

If I install a certificate for the purposes of logging into a Wifi connection, is it still safe?

There are some wifi networks (large universities for example) which use HTTPS to get to a login page, and in order to verify that they have not been spoofed, provide the certificate ahead of time ...
2
votes
4answers
86 views

What are some ways to spot email spoof attacks?

I use Gmail and I started getting malicious-sounding emails from people I know intimately. The people I spoke to said they did not send those emails. In order for the attacker to carry this off, are ...
3
votes
2answers
51 views

Security of nested ssh

First of all, by nested ssh, I mean the following way of using ssh: ssh usera@Bob 'ssh usera@C' suppose A wants to login on server C, but for some reason C is not directly available to A (e.g. C's ...
1
vote
1answer
47 views

Influence of SSL Intercept on SSLVPN

We're considering implementing an SSL Intercept proxy in my organization. It will perform a SSL MITM to be able to inspect traffic. It will be a solution of a commercial vendor. It is clear that we ...
3
votes
2answers
233 views

How can I tell if my ethernet connection is being sniffed? [duplicate]

I read in another post that wired traffic is not protected: The only real additional threat that a malicious network administrator would pose, is that they have access to the wired side of the ...
0
votes
0answers
30 views

Can Bluetooth be man in the middle'd at the L2CAP layer?

Bluetooth HID devices can be man in the middle'd with two bluetooth dongles and this code http://ossmann.com/shmoo-2010/ Is this technique limited to just HID profile bluetooth devices or could this ...
0
votes
2answers
91 views

Faking IP address without being aware of returning response

I read different articles on the subject (Spoofing IP address), someone said: Spoofing an IP is usually better suited to "fire-an-forget" scenarios like DDoS. due to TCP two-way communication ...
0
votes
1answer
136 views

Why am I sometimes spontaneously presented with an SSL certificate from my U-Verse Residential Gateway?

Sometimes, we will experience a brief "hiccup" in our AT&T UVerse internet service. When this happens, and a user happens to be surfing the web at the same time, we will suddenly be presented with ...
0
votes
2answers
62 views

Sniffing TLS / SSL through HSTS?

Imagine the following: Client C wants to communicate with server S. The evil attacker A is the Man-In-The-Middle. C sends a request to S, A intercepts it. A creates a self-signed certificate with ...
0
votes
3answers
98 views

Is it possible for an attacker to redirect a packet sent by a client, modify it then sent to original server

Theoretical question: Is it possible, or will it ever be possible, for an attacker to sniff/intercept it and redirect a packet, sent from a client through wireless, modify it and then sent to the ...
1
vote
0answers
68 views

Does HTTPS protocol leak HTTP body length?

It seems that in a MITM attack, hackers may know the whole HTTPS packet size sent through the network (i.e. size of HTTP headers + HTTP body + overhead). Besides that, does the HTTPS protocol also ...
0
votes
2answers
66 views

Protect SSL connections from MITM for users with modified clients

I'm working on a web app that uses SSL. I'm afraid that some people might access the app via a network that uses a proxy to intersect and inspect the SSL traffic [MITM]. Some people might access the ...
4
votes
1answer
141 views

Man in the Middle Attack against NTP

So, lately I've been really into penetration testing and learning the nitty-gritty of tech. I'm dong courses on computer architecture, cryptography, surveillance law, and computer networks. I never ...
1
vote
2answers
513 views

Can a wifi provider decrypt HTTPS usind MITM without users noticing? [duplicate]

As a router, can I send forged certificates, and intercept requests to CA and return responses that they are valid. So I could MITM all https traffic, and spy on my users?
1
vote
2answers
81 views

ARP poison detection [duplicate]

I tried ARP poison on my local test system with ettercap. It was successfully, so I decided to run a test on most secure systems, like Facebook and Google, but I could not reach them and they warned ...
1
vote
3answers
90 views

Risks associated with HTTP content injection?

I'm curious about the risks associated with HTTP content injection, where an ISP injects content to pages accessed over non HTTPS connections. Some examples: ...
0
votes
1answer
56 views

MITM sniffing packets

I fail to understand how a MITM attack sniffs packets and modifies them.In the case of ARP spoofing although the attacker has spoofed the MAC address of a host, how does he modify it as the IP layer ...
0
votes
0answers
120 views

Is facebook to facebook (mobile application call ) encrypted?

I understand facebook uses WebRtc to send voice data packet in network if any one end client is on the browser. Use of DTLS packets can be seen in captured (wireshark) file. But in case of mobile app ...