A man-in-the-middle attack (MiTM) is an attack against a communication protocol where the attacker relays and modifies messages in transit. The parties believe they are talking to each other directly, but in fact both are talking to the attacker.

learn more… | top users | synonyms (1)

1
vote
0answers
43 views

someone may be doing something nasty

I have an ssh server. earlier toady, I was about to login to my server, when I got a message that said something along the lines of "Someone may be trying to do something nasty" and indicating a man ...
1
vote
0answers
47 views

How to recreate the Freak attack?

Currently I am trying to recreate the Freak attack on a virtual machine. For this purpose I set up a Linux Mint 17.1 system with Apache 2.4.7 (with a self signed certificate) and OpenSSL 1.0.1f. I ...
-2
votes
0answers
13 views

Is there a MITM tool for forcing weak SSL cipher suite like by using ettercap or mitmproxy? [duplicate]

I know that this question has already been asked before, but i could not get an answer of how to do it?
3
votes
1answer
44 views

Can user send fake request if it has JWT token?

I developed an android application that request to a REST service for do actions! My questions are: If anyone trace the requests and responses, Can he get the token from headers? Where should I ...
4
votes
3answers
814 views

“Authorized” Man in the middle

I am implementing a TLS connection with a basic server and client. It’s a one way connection: the server has a certificate chained to the CA, and the client has a collection of trusted root ...
2
votes
3answers
59 views

Public key in resources for avoiding man in the middle attack

I am developing an android application which needs to communicate with a web server. Instead of using common SSL I would like to save my custom public key in resource folders of the application(APK ...
1
vote
2answers
66 views

Securing communications in decentralized network of servers

Lets consider the following setup: One has a decentralized network of servers. A single root certificate has been distributed to all servers which has been positively checked as authentic and ...
1
vote
1answer
63 views

Has anyone used this ICLOAK USB device? [closed]

Does anyone know about this ICLOAK USB device? Opinions or how well they work? I'm looking for a security solution when I'm using PCs where I work. Occasionally we have to log into to web sites, ...
0
votes
1answer
36 views

MitM Chrome Mobile

I just came across the issue about MitM on Opera/Nokia browser 2013. I know, this is an "old" problem, but it seems very interesting to me. I was wondering how Chrome on mobile handles the SSL ...
1
vote
0answers
71 views

SSL traffic manipulation through ettercap MitM and iptables

I am trying to understand the relation between some tools and concepts used for MitM on a wifi network and how https transaction (over this wifi network) between an android app and the respective ...
0
votes
4answers
103 views

Risks of using HTTP

What are the risks of using HTTP instead of HTTPS assuming that there isn't any rogue hacker sitting on my personal WIFI network waiting to sniff my traffic? Can a hacker sit in his boat in the ...
3
votes
2answers
108 views

Payment form from http is secure? [closed]

There are lot of payment gateways (Worldpay, PayPal, ..) offering easy integration, when the plain webpage using URL redirection to the payment page. HTTPS (worldpay,paypal), where the user posts his ...
2
votes
0answers
44 views

I need a secure laptop tethered to a mobile internet connection. [closed]

I invent things. Think energy, IT security algorithms, etc. I'm actively targeted for information breaches by the largest corporations on the planet. All paranoia aside... I'd like a secure ...
2
votes
1answer
21 views

ettercap use as local proxy [closed]

Hi everibody and sorry for my english, I'm looking for a way to use ettercap (or another program) to alter TCP traffic (coming from local) on the fly. I used "netsed" with iptables, but netsed is too ...
10
votes
2answers
2k views

How can I prevent a man-in-the-middle (MITM) attack on my Android app API?

I checked out the app Packet Capture. This app is able to decrypt my app APIs (SSL Enabled) data by mounting a MITM attack using the Android VPN service. This does not even require root. How can I ...
2
votes
2answers
47 views

ssl_error_bad_certificate_domain, does Firefox still validate the certificate? [duplicate]

I have a private NAS device. It uses a self-signed SSL certificate. I can import the cert into Firefox and everything works as long as I'm accessing the device from somewhere on the internet. SSL ...
0
votes
1answer
50 views

Using randomly generated numbers to authenticate with a Relay server

I'm developing a public VoIP relay server, that will help bypass internet firewalls by allowing two clients to connect with it and then it will relay data between the two. Both clients will connect ...
0
votes
1answer
45 views

Decrypting SSL within Multiple Products

I've read the various questions tagged [ssl] and [mitm] and [proxy] and I couldn't find a duplicate. I cannot find any documentation on this subject online. All of the traffic is currently flowing ...
3
votes
1answer
135 views

A certificate site name mismatch when using preinstalled Toshiba software? (Superfish?)

On my Toshiba laptop there are a variety of different Toshiba programs that came pre-installed. Many of them are some sort of utility, optimizer, checkup, and update kind of programs that I guess are ...
1
vote
0answers
38 views

How can MITM be performed in WebRTC?

From what I could tell, certificates are self-signed. When A wants to call B, after they finish relaying data to server, they initiate communication with each other. Certificates are self-signed, ...
1
vote
2answers
115 views

Is VPN the best solution against man-in-the-middle attack? [closed]

I'm looking for the best way to protect my enterprise against man in the middle attacks, because a lot of people connect to the same network. So I was thinking of creating a VPN. Is this really the ...
2
votes
0answers
200 views

hsts bypass with sslstrip2 + dns2proxy

I am trying to understand how to bypass HSTS protection. I've read about tools by LeonardoNve ( https://github.com/LeonardoNve/sslstrip2 and https://github.com/LeonardoNve/dns2proxy ). But I quite ...
2
votes
0answers
18 views

Mitigating the risk of disabling EPA on ADFS

I'm currently investigating the deployment of an Active Directory Federation Services (ADFS) server for providing Single Sign-on for various services. By default, ADFS enables support for Extended ...
4
votes
2answers
86 views

What are you doing if you notice a MITM attack against a Linux server? [closed]

I got this question at a job interview, but I did not know the answer. I think they expected some shell command or packages, which can help react to the attack. Assume that, you are a system admin and ...
1
vote
1answer
33 views

Choosing a cipher and MAC for an SSH connection

The cipher and mac selection according to this are in some sort of order in a config file. How do the client and server know that they are using the same ones though? Is this information exchanged in ...
1
vote
1answer
167 views

Why crack WEP or WPA/WPA2 PSK when it can be sniffed through monitor mode capture?

I am pretty new to the domain of wireless security and am trying to understand the various techniques used for compromising wireless networks. There are a few things that I am not able to co-relate ...
1
vote
1answer
36 views

User Key pairs and Man-in-the-middle issues

I'm trying to wrap my head around how to exchange user's keys with a server. Maybe during sign-up a JS applet generates a key-pair for the user. These keys would be used for signing subsequent ...
1
vote
2answers
122 views

Mitigation against MITM at Starbucks

Free public WiFi, for example Starbucks, is convenient. I wonder if there is a way to verify that a laptop has connected to the Starbucks wireless router and not to a man in the middle that tricked ...
-1
votes
2answers
40 views

How can I detect mode interface of other machine is promiscuous [closed]

I have a project that is to protect my box from attack man in the middle arp poison. I should detect if interface mode of other machine is promiscuous. I must write script python or command linux.
0
votes
0answers
19 views

Combining Hash Visualisation (VisualHostKey) and SiteKey to prevent MITM

TL;DR Skip to the No SiteKey + Plugin if you don't want to read this whole thing. VisualHostKey shows an SSH hash like this: # Host github.com found: line 53 type RSA 2048 ...
0
votes
1answer
41 views

Combining wildcard and subdomain-specific SSL certificates

Not quite sure which Google terms to use to find the answer, so I thought I'd ask it here, presented as a scenario: Say you have a corporate entity (Example Co) with a wildcard SSL cert issued for ...
6
votes
1answer
880 views

Is Man-In-The-Middle necessary for a CA to read HTTP plaintext?

Although I understand the basic theory behind certificates and asymmetric cryptography, I'm not quite sure on the details of the X.509 protocol. I'm wondering what attacker model a given CA requires ...
1
vote
1answer
103 views

How to properly test that an OpenVPN connection is secured?

I have a router (ASUS RT-AC66U) with an embedded OpenVPN server. I'm able to successfully connect to the OpenVPN on the router, as well as, access internal services in my home network; However, ...
0
votes
1answer
21 views

dm-crypt over iSCSI

I recently bought a NAS that supports iSCSI. I'd like to create a new LUN, and then from my computer, create a new dm-crypt/LUKS device on it and back up to it. Is this secure? Could the data or ...
23
votes
6answers
3k views

Possibility to sniff HTTPS traffic on devices without installing a certificate

My goal is to sniff the HTTPS traffic of some digital devices (AppleTV, game consoles, etc.), and decrypt the HTTPS packets in my local network. I cannot figure out a way by using some HTTPS ...
9
votes
4answers
5k views

In light of the FREAK TLS vulnerability, why do so many servers still offer RSA-EXPORT keys?

Ars Technica is reporting on a new attack against HTTPS. Called FREAK, the devices reported as vulnerable include iPhones, Android devices, and Macs running OS X. The attack (as has been clarified ...
0
votes
2answers
82 views

Can a school legally access an account that a student logged in to at school? [closed]

Is this scenario legal, A school has a few public computers that can be used. The only browsers that are installed are chrome and internet explorer, and the entire network is man-in-the-middled. ...
0
votes
0answers
24 views

Usefulness of checking MS-CHAP-Challenge by TTLS Server

I've spotted what may be a "missed opportunity" in the EAP-TTLS specification for "Challenge"-based authentication protocols (for instance MS-CHAP-V2). The client initiates MS-CHAP-V2 by tunneling ...
4
votes
4answers
105 views

What's to stop someone from just MITMing a checksum?

A lot of sites offer MD5 or SHA sums to verify the validity of your download, but why do some things rely almost entirely on this? Is there anything in place to prevent people from just replacing ...
0
votes
2answers
64 views

Is it possible to take back the control from an MITM in progress? [closed]

I heard that MITM also involves DNS poisoning, which basically tells the Net to take a different route than it was supposed to go.. (I'm not sure if my interpretation is correct..) Given there is an ...
22
votes
3answers
2k views

Superfish vs. Corporate MITM

I work for a consulting company, and I have been implementing a tool from a security vendor, which is a cloud proxy for all user traffic. It will perform malware scanning and filtering of all web ...
0
votes
1answer
83 views

Public WiFi behavior

Here's an observation: My apartment offers free wifi around the social congregation areas. It is not encrypted BUT as I have observed, each connecting device is confined to its own VLAN (based on MAC ...
9
votes
1answer
372 views

Kaspersky Antivirus “secure connection scan” as broken as Superfish?

I've read a lot about Superfish (and similar ad-ware) lately and I basically understand the vulnerability to MITM attacks. But I'm actually wondering if the "secure connection scan" by Kaspersky ...
2
votes
1answer
265 views

Intercepting HTTPS Android app traffic

I'm trying to intercept Android application traffic from my Android phone....Basically what worked before was that i had simply installed fiddler proxy on my PC, exported the root certificate (and ...
-2
votes
2answers
110 views

How do certificates stop this man in the middle attack?

Alice and Bob are trying to set up a secure conversation, but unknown to them in the middle is Eve, who can intercept and modify all packets sent between them. The communication goes as follows: ...
1
vote
2answers
61 views

Two-way encryption that can be nested?

In building a security system, I'm looking to prevent 'man-in-the-middle' attacks in a two-way encryption system, using the following setup: A sends B a message, encrypted with code 1 B sends it ...
1
vote
0answers
73 views

Is it possible to trick a CA into signing a certificate by intercepting on SSL domain validation email?

From my understanding domain validation certificate are verified by receiving an email on some special email addresses on the domain (e.g. postmaster@example.com, admin@example.com) or by sending on ...
2
votes
2answers
201 views

If your company/university requires you to install root certificates what protects you from man in the middle attacks?

Let's say that I'm on a university (or company) network that requires you to install a root certificate to connect to their website. Now let's say that you trust these people but not anybody else. Is ...
0
votes
1answer
74 views

How does the DNS-spoofer know the original destination of the packet?

It's perhaps my lack of deeper knowledge of how the DNS, NAT or TCP works, but I have been thinking about the following scenario and can't figure out the following problem which arises in DNS-spoofing ...
0
votes
0answers
86 views

Man in the middle attack, bridging wlan interface to virtual wired interface at0

I'm trying to execute a Man in the Middle attack on my mobile phone, I have two wireless cards, one inbuilt in the laptop, running AR9285 atheros drivers, the 2nd is an Alfa AWUS036NHA card with an ...