0
votes
2answers
61 views

Are SSL encrypted communications through a company network safe?

If I'm using Skype, Facebook, or another type of communication at my work, can the network administrator see my Skype and Facebook conversations, although its encrypted with SSL? I found this text: ...
8
votes
2answers
671 views

HTTPS login vs MITM attack

http://www.troyhunt.com/2013/05/your-login-form-posts-to-https-but-you.html My question is, if the threat is that someone controls your internet connection and can serve up bad login pages, couldn't ...
1
vote
0answers
60 views

Threats against website running without TLS but with PGP messages

Are there any threats against a web site that isn't running SSL but uses PGP to encrypt all information to the server (except session identifier) The information flow is as such: 1. Session ID set on ...
14
votes
5answers
2k views

How safe is SSL? [closed]

If I got an SSL certificate for my website and use an SSL secured connection (HTTPS), is this safe enough to send my login and password data or should I add some encryption or hashing? And how safe ...
0
votes
1answer
80 views

CAPTCHA Bypassing with Captcha Clipping Attack is Like MiTM between servers, Is that even Possible?

Sorry if this is a very amateur question. I was checking out some article regarding CAPTCHA bypassing. And I though this article seemed interesting ...
1
vote
1answer
66 views

Behavior of trusting a self signed SSL certficate

I have just deployed a Turnkey appliance which comes configured with a self signed certificate. This is a server that only I will be using, so I don't want to pay for a certificate. If I add this ...
1
vote
1answer
74 views

Legitimate use case of man-in-the-middle attack for DPI?

I am working on a device that should sit between the end-user and the server, and that will do deep packet inspection. It is basically a parental control node. This device will be sold to the user, so ...
2
votes
0answers
209 views

What is going on with my download of the recent Apple security update?

The update in question is the Mavericks combined update which, among other things, claims to fix the recent SSL vulnerability/gaping hole. This issue really annoyed me, so I decided to procure ...
1
vote
1answer
71 views

Is it dangerous to sync my data with my personal server through unencrypted http?

Since Apple force iPhone users to use iCloud to sync contacts & calendar, I moved to a local ownCloud instance that works well. However, it would be more convenient if I could sync everywhere and ...
1
vote
2answers
73 views

Why do client certificates not protected against improper server certificate validation

I understand the question of client certs and MITM attacks has been asked several times, but I don't believe this specific scenario has been answered. It was my (seemingly incorrect) assumption, that ...
1
vote
2answers
181 views

Actually, isn't it bad to redirect http to https? [duplicate]

I have a two-part question about question #570288 over on ServerFault. Question: Is it bad to redirect http to https? Accepted answer (185 up-votes): [...] Hell no. It's very good. Part 1 ...
0
votes
2answers
145 views

Is using an SSL Session ID along with a cookie based session verification more secure or not really?

I am using Django which is a web framework for Python. I love it but the session handling is cookie-based. Now over SSL I'm sure it's reasonably "secure" but I don't think there is any kind of fail ...
2
votes
2answers
199 views

Any MITM tool for forcing weak SSL cipher suite?

Let's say I'm trying to reverse engineering communctions between an Android app and a web server uing HTTPS. At beginning, I tried to do MITM using webmitm and a fake cert. But the app failed to ...
0
votes
1answer
648 views

Javascript http to https redirect - how vulnerable/how secure? [duplicate]

If I had a website http://site.com redirecting to https://site.com via javascript (with a HTTP/1.1 403 Forbidden), what are the attack vectors I could be vulnerable too? Why is this not a good ...
3
votes
2answers
330 views

How a provider can tap an internet line even for SSL encrypted connection [duplicate]

I heard once from someone I trust, that the French governement is about to buy and certify a software to put on tap an internet line even for HTTPS connection. I don't really care about the legal ...
1
vote
1answer
160 views

Does Skype Trump SSLStrip?

I am using SSLStrip against my own computer, but am not being redirected to HTTP. Skype automatically starts up and logs in at my computer's startup, so I was wondering whether the fact that port 80 ...
0
votes
1answer
179 views

Sniff HTTP(S) from PPTP VPN server

I've setup an PPTP VPN server on my Debian 7 server. I'm using this VPN in combination with my Android phone to ensure a secure connection. However, i'm getting curious of what my phone is sending ...
-1
votes
3answers
77 views

MiTM attacks SSL to SSL

I was wondering what ways there are to MiTM a client link to the server where I would give them a public key that they would then send their data via https://example.com using my key. Then without ...
0
votes
1answer
148 views

How does the MITM (Man in the middle) attack happen with respect to SQRL

I recently looked into SQRL and was intrigued by its simplicity. At first glance it seemed reliable and its author claimed it was inherently fail-proof against phishing and MITM attacks. But upon ...
-1
votes
1answer
252 views

How to MiTM SSL on a device with no proxy settings

I'm trying to MiTM a device on my network and having some problems. SSLstrip doesn't work because the URL is https://, and I can't use something like Fiddler because the device has no configurable ...
5
votes
3answers
418 views

How to Man in the Middle Internal AD Traffic

A coworker asked me why I thought encrypting internal AD Bind communication was important. I said because I follow a standard security practice, but couldn't actually articulate how an attacker would ...
0
votes
2answers
182 views

Man-in-the-middle SSL generation on request possible

I am doing some research on man-in-the-middle focusing on SSL in particular. I have been looking into generating a certificate on request when a client connects and requests a secured page. ...
1
vote
2answers
158 views

Understanding certificate security

I am reading Computer Networks by Tanenbaum and Weatherall. In chapter 8 they describe secure communication using public key exchange via certificates. They describe a situation where Alice is sending ...
3
votes
5answers
458 views

Why is it not possible for an ISP to man-in-the-middle attack an SSL connection? [duplicate]

If the ISP carries my data, why do people seem to think they cannot see the contents? Wouldn't they be holding the key?
3
votes
2answers
238 views

Is it true, that using symetric encryption, if attacker knows encrypted text, original message, and algorithm means he can calculate the secret?

I am a newbie in the security field, so sorry for the naive question. In my understanding, using symetric encryption, if attacker knows encrypted text, original message, and algorithm means he can ...
6
votes
2answers
2k views

How to detect the NSA MITM attack on SSL?

As Bruce Schneider reported here... https://www.schneier.com/blog/archives/2013/09/new_nsa_leak_sh.html ...the NSA reportedly performed a MITM attack on a company in brazil and decrypted their SSL ...
4
votes
1answer
4k views

How does SSLstrip work?

I've been reading up on SSLstrip and I'm not 100% sure on my understanding of how it works. A lot of documentation seems to indicate that it simply replaces occurrences of "https" with "http" in ...
1
vote
2answers
459 views

Sniffing From Squid SSL

I created a Squid proxy and a self-signed SSL certificate. The SSL certificate on the server is a private certificate linked to the ssl-bump feature. I am using tshark to dump the SSL traffic, but I ...
1
vote
0answers
248 views

Does ZRTP provide useful protection, given that the SAS is not verified?

Firstly, some important backstory. I'm producing a corporate version of an IM/VOIP/Screensharing client using the Open Source Jitsi. We are going to be using a central server and have already ...
3
votes
2answers
438 views

Why does Google SSL cert change so frequently?

For the last few months I have been using the Firefox addon Certificate Patrol to watch for changes to sites' SSL certs - so as to know if I am being MTIMed, against which SSL otherwise provides no ...
1
vote
3answers
203 views

How do I mitigate a MITM on https?

I am trying to view a https site (which worked perfectly fine till yesterday) and Chrome is showing me that the site's security certificate is not trusted. I am on a home network. How can I know if ...
1
vote
2answers
1k views

Man in the middle attack still possible against ssl?

I've heard about ssl strip in the past that allowed for man in the middle attacks to take place against browsers, but those vulnerabilities were patched long time ago. So my question is...are there ...
0
votes
3answers
4k views

How to prevent man-in-the-middle attacks beside of SSL?

I would like to discuss this scenario: There is a HTTPS service which responds with signed keys to an authenticated client. These signed keys can be used for another service to return very sensible ...
3
votes
4answers
477 views

What are the risks associated with SSL interception in an Organization?

If an SSL interceptor is installed for security reasons in an Organization, and a certificate from intermediate CA is installed on all domain machines, what kind of risks this setup presents?
5
votes
2answers
243 views

Avoiding MITM attacks when using HTTPS over mobile

There are a variety of other questions that address elements of this security issue, but none that seem (to a non-expert) to address the substantial core of the issues raised in this article: ...
1
vote
2answers
337 views

Prevent my site to be sniffed and changed by man-in-the-middle-attacks

I want to secure site which is locally used for Prepaid Services, the site has been hacked many times, for the first step, I implemented SSL and its now working fine, however, I want to be sure that ...
8
votes
1answer
423 views

Is it possible to recognise and prevent MitM attacks on devices which use self-signed SSL certs?

I use both Linux and Windows at work on a large enterprise LAN. The majority of the network configuration is out of my reach. Certain SaaS applications that are hosted locally on the enterprise LAN, ...
1
vote
1answer
299 views

Assuming no MITM, is Gmail communication 100% secure and private?

I sometimes have to use my personal Gmail account from my company workstation, where I know for fact they are using content-aware firewall(s) like Palo Alto, and potentially other nasty things like ...
4
votes
2answers
7k views

Specific risks of embedding an HTTPS iframe in an HTTP page

I need help listing the specific risks of embedding an HTTPS iframe that enables credit card checkout inside of an HTTP page. Are there security issues with embedding an HTTPS iframe on an HTTP page? ...
13
votes
3answers
725 views

Can a nation-state adversary perform a MITM attack by compelling a CA to issue them with fake certs?

As I understand it, with any encryption system based on a trust chain / CAs (eg SSL, TLS, S/MIME), it would be possible for a nation-state adversary (such as the NSA) to compel the CA to issue them ...
1
vote
2answers
261 views

Why is malwarebytes.org's SSL certificate from someone else?

I tried downloading and updating malwarebytes from https://www.malwarebytes.org but their certificate seems to be incorrect. This is the warning: This is probably not the site you are looking for! ...
6
votes
3answers
286 views

How to fuzz proprietary protocol over SSL?

I'm doing vulnerability research on a client/server architecture that uses a custom proprietary protocol sent over SSL (port 443). I need to be able to intercept the traffic, and be able to view it in ...
1
vote
1answer
441 views

how to make socat ignore client certificate?

I'm trying to set up a listener to check if an application checks the server's certificate (I'm strongly assuming it is not). So I've created a self-signed certificate fake.pem for a listener and am ...
3
votes
1answer
575 views

MITM and replay attacks prevention

I have a client (a mobile app) and a server, the app connects to the server via SSL. The server uses a self-signed certificate, and the client has a file (I'm not entirely sure what, something to do ...
3
votes
1answer
466 views

How to MiTM insert an iframe using burp or another tool?

So, I am trying to obtain a cookie without the secure flag enabled over HTTPS. After reading about it, I came across an answer: You visit https://secure.example.com/ which drops a cookie on your ...
1
vote
3answers
2k views

Can attackers steal SSL certificate from server and use it for MITM attacks?

I'm writing an iOS app for private use to acts as a client for a PHP server. To secure the connection I'm using a self-signed SSL certificate. Since the server is self-hosted, on the first connection ...
3
votes
1answer
137 views

How is the TLS protected against length field of the header being modified?

I know this question looks very silly, but, it has been bothering me for a while and I am unable to come up with an answer by myself. So, here it goes.. Packets in the TLS protocol consist of a 5 ...
8
votes
3answers
697 views

Is it possible to “protect” against MITM attacks over HTTP?

In a conversation on twitter I warned a site about a security vulnerability. Specifically, the possibility of a MITM (Man in the Middle) attack used to compromise their registration form. The ...
1
vote
2answers
356 views

SSL: How to send generated client certificate from server to avoid MITM?

The question I have is simply how do I prevent a MiTM attack on a certificate once the server side creates a new one and tries to send it to a client? Does the certificate get encrypted by rsa and ...
7
votes
4answers
1k views

Man-in-the-middle scenario for TLS

Consider the following scenario: You want to securely communicate with a.com and you only trust the VeriSign root certificate. a.com presents a certificate signed by VeriSign with CN=a.com, so you ...