A man-in-the-middle attack (MiTM) is an attack against a communication protocol where the attacker relays and modifies messages in transit. The parties believe they are talking to each other directly, but in fact both are talking to the attacker.

learn more… | top users | synonyms (1)

1
vote
2answers
183 views

Is Linux getting less or more secure? [closed]

The famous so-called virus-and-hacker-free Mac is a thing of the past: As it gets more popular it gets more vulnerabilities. Will Linux be the same at some point in time? Is it getting less of more ...
1
vote
2answers
66 views

Would MITM be able to manipulate the X-Frame-Option

I was wondering if the following scenario was realistically achievable. We have a Network with a Computer that is used by Bob. He is security conscious person and uses a password manager. His ...
6
votes
3answers
1k views

How to securely read a physical memory address in Linux?

I am trying to read a physical memory address in a device running embedded Linux with our application. The widely suggested method is to use mmap, convert it into virtual address and then read the ...
2
votes
1answer
82 views

How does SSL inspection work on personal devices without deploying a trusted custom certificate?

My (limited) understanding of SSL inspection is that the process involves deploying a certificate to each host that SSL inspection will be monitoring. In an enterprise environment, I can understand ...
1
vote
0answers
64 views

Why don't more servers use HTTPS to secure executable downloads? [duplicate]

I actually check for TLS before I use any exe files. I've been trying to download a bootable usb creator tool for windows. However, I can't find a single one that actually uses any form of TLS (or ...
1
vote
3answers
161 views

Can man-in-the-middle attacks affect anyone not connected to the attackers network?

I'm trying to understand what these attacks are restricted to. I'm aware that man-in-the-middle attacks can be done if the attacker is on the same network (using something like Wire Shark), but is it ...
5
votes
2answers
128 views

How to check if your Android app was updated by MitM?

As I was browsing on my phone yesterday, a gray popup appeared on my screen just as I was swiping up, and I accidentally hit the accept button. In the fraction of a second it was on I was able to read ...
7
votes
2answers
129 views

Does using a VPN completely stop MITM (man in the middle) attacks? If not, what other defences should I consider?

Just for added context, I am curious about connecting to a remote desktop using a VPN but if there are any major differences that can be highlighted for other services I would be interested in that ...
4
votes
2answers
146 views

SSLStrip still HTTPS

I did all the configuration right. IPtables, port forwarding, ARPspoof, everything. However, in the browser websites like Facebook and Twitter are still HTTPS. What am I doing wrong?
2
votes
3answers
69 views

Can a file get accidentally corrupted while downloading?

I read an answer here about websites providing downloadable files together with their hashsums. It contained a sentence I'm thinking about whenever I download something, but I never really understood ...
1
vote
2answers
517 views

How can I see the websites visited by clients of my WLAN?

How can I view the websites that are visited by the user of my wifi? What tools are required to do this? And one more question: can I see the WhatsApp communications?
3
votes
4answers
70 views

How to Protect Webservice on Private Network?

We are building a webservice that will only be queried by other servers on our private network. I was suggesting that we put that webservice over https and use either client ssl authentication or a ...
2
votes
1answer
34 views

Security of https website which resolves to local ISP (ex. twitter)

Recently I noticied that some of social networks (ex. twitter) domains points to an IP in my local ISP. (ping twitter.com resolved to local ip: 3.4.5.6-static.bad-government-isp.com). Note: now ...
8
votes
1answer
173 views

Can ICMP Redirects still be used to redirect traffic in a LAN?

I tried just tried to migrate a MITM attack using hping3 with ICMP Redirects in my testlab. hping3 -I eth0 -C 5 -K 1 -a 192.168.2.1 --icmp-ipdst 192.168.2.15 --icmp-gw 192.168.2.100 --icmp-ipsrc ...
1
vote
0answers
392 views

cgi-bin/webproc : Is my wifi router hacked [closed]

When I try to access the yahoo.com I am asked user name and password then I am routed to yahoo.com/cgi-bin/webproc Not only yahoo likewise for so many sites I am getting the same problem. ...
7
votes
1answer
190 views

“Fix” man in the middle

I've just tried to ssh connect to a server (auth via ssh key), and get the well-known message WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!. I'm the server administrator (but I'm not really a good ...
2
votes
2answers
57 views

What problem does PKI fix; how would someone “lie about their identity”? [duplicate]

What does having a certificate issued by a Content Authority protect against? In everything I've red (and watched) they teach it as "you are given the public key to communicate with Alice, but how do ...
4
votes
1answer
274 views

Why does sslstrip+ fail to intercept the traffic from websites like facebook and gmail?

I have been reading an article about sslstrip and mitm. Before the introduction of HSTS it was possible to strip ssl and send an insecure http page to the victim. Anyway it was overcome by using HSTS ...
3
votes
2answers
241 views

Is it possible for my employer to replace the root CA on my phone?

I've read about corporate MITM 'attacks' where they replace the root CA on company hardware in order to monitor traffic over SSL that takes place on their network, but is it possible for them to do ...
2
votes
1answer
90 views

Flaw in HTTP Digest Authentication

I am working through my textbook and I came across this question: Below is the message format for a browser response to access a password-protected web page using HTTP digest authentication. GET URI ...
4
votes
0answers
80 views

How should software respond when Captive Portals or Untrusted SSL certs prevent connectivity?

I need to fix an issue where the initial (or perhaps only) HTTPS call to a website is blocked by a captive portal, not managed by me. The resolution has been to ask the user to navigate to a "http" ...
-2
votes
1answer
134 views

How to dnsspoof against HTTPS

I am doing a dnsspoof PoC, but apparently it doesn't work with HTTPS because of the certificate. Please don't tell me that I have to generate a certificate or send a legitimate certificate, I want ...
2
votes
2answers
46 views

How to Ensure Post Data in Services is Safe from User Tampering In WebGL Games?

We are currently making WebGL games for an online portal that then rewards users points they get from In Game Score. The Score is sent to the WebServer in the form of POST service, Recently we have ...
2
votes
2answers
96 views

Is it possible to let a fake certificate appear valid by sending fake OCSP responses?

In a MITM-Attack I can exchange the server certificate by one I created on my own with tools like MITMProxy or SSLSplit. But this only works well when I have installed a fake CA cerrtificate in the ...
0
votes
1answer
122 views

How are man-in-the-middle attacks actually implemented? [closed]

For research purposes. I'm wondering, in a high level way, how MITM attacks are actually done in the real world. So over the internet the client talks to the server, or one person emails the other, ...
2
votes
1answer
95 views

Is it possible to maintain security and data integrity through a network decrypting HTTPS?

A network I often use has started to decrypt HTTPS traffic (and reencrypt, using a different key) using a local proxy. This proxy is operated by people I mostly trust. However, I would like to know if ...
4
votes
1answer
115 views

Intercept DNS query packet and send spoofed response after ARP poisoning

On my network, I am able to perform ARP poisoning but only for a target machine not router. Therefore, I cannot spoof responses by intercepting router's packets and modifying them ...
1
vote
1answer
105 views

Network Security with EAP: PEAP and Phase 2: MSCHAPv2?

I want to connect to my college WiFi but I’m worried about the security (data leakage, hacks, MITM). The configuration I used to connect to my college WiFi is as follows, EAP: PEAP Phase 2: MSCHAPv2 ...
1
vote
1answer
54 views

DHCP Exhaustiation / Rogue DHCP interrupted by real DHCP NACK

I was trying to run a Rogue DHCP Server which should cause a MITM attack. I did the following Exhaust the real DHCP Server using DHCPig (worked) Run a Rogue DHCP Server using the ...
0
votes
0answers
43 views

How does STK (Short Term Key) generation work in a Bluetooth Low Energy?

I want to understand how STK (Short Term Key) generation works in a Bluetooth Low Energy. I don't want to go deep at a packets exchange level of a Security Manager Protocol, but I want to understand ...
1
vote
2answers
114 views

Arp network (prevent mitm attack)

On my school network, using wireshark to see network traffic (filter=arp), I only see gratuitous packets. Meaning, all hosts on network send gratuitous packets (ex: gratuitous for 10.10.3.54, ...
12
votes
6answers
2k views

Is it possible for corporation to intercept and decrypt SSL/TLS traffic? [duplicate]

I found there are some companies claim that they offer service that can eliminate SSL/TLS blind spot, such as Blue Coat and Gigamon. Are they talking about some way of decipher the https content ...
2
votes
1answer
103 views

Can MITMf exploit SSL CCS vulnerability (CVE-2014-0224)?

I just wonder if MITMf (https://github.com/byt3bl33d3r/MITMf) can be used to exploit the 2014 early CCS bug, or is there a tool out there which can (preferably open source, so I will be able to ...
3
votes
1answer
400 views

How can Port Stealing be used as a MiTM attack?

I read about and tried a lot of MiTM attacks but I just don't get how Port Stealing can be used as a MiTM attack. In my understanding one can "steal" a Port by sending Ethernet Frames faking the ...
1
vote
0answers
69 views

What are the formal methods to analyze Authentication Protocol

I designed an authentication protocol for consumer-producer applications, which barrows features from Kerberos and Tesla. To check the strength of protocol I considered different well known attacks ...
0
votes
3answers
148 views

How to an “emulate” man in the middle attack for SSL and TLS?

I need to compare TLS and SSL for an essay and I thought a good way to do this would be to emulate a Man in the Middle attack, however I have no clue how to do it.
3
votes
2answers
52 views

Does the Content Security Policy header provide a false sense of security if a page is served over unencrypted HTTP?

I have been thinking about how a developer restricted (for whatever reason) to serving an unencrypted site might protect themselves from threats such as overzealous ISPs injecting ads or notifications ...
2
votes
1answer
94 views

Avoiding repeaters in radio-communication

Suppose a sender and a receiver communicate over some radio channel. Is there a way to prevent packets sent and received are not being repeated/forwarded by a MiTM? That is, when the agents are out of ...
2
votes
1answer
104 views

MitM Android Java Application

I'm trying to MitM an Android Application for research purposes (it's designed to be broken). I'm using Burp as an attack proxy and already exported the Burp CA certificate and imported it into the ...
5
votes
1answer
66 views

SSH MITM on new host

If you are connecting to a new host for the first time, what is to stop an intruder from performing a MITM attack: swap out the public key and fingerprint for a public key they have the private key to ...
2
votes
2answers
97 views

Using separate HAProxy and API tiers, how can I ensure a request came from HAProxy?

I have two machines and a HAProxy machine doing SSL termination and accepting client certs successfully. How can I configure HAProxy to ensure that the messages coming into the API box are from ...
2
votes
2answers
156 views

Can a properly implemented TLS connection be intercepted?

Assuming a TLS connection where both the server and client perfectly adhere to the pertinent standards. Can an transparent HTTPS proxy intercept the TLS connection? (Assuming the "mock CA" ...
1
vote
2answers
105 views

Unencrypted FTP to transfer encrypted data - okay if IP-restricted?

If unencrypted FTP over the public internet is the only file transfer option for a particular situation, what security concerns are applicable assuming: The data being transferred is strongly ...
12
votes
1answer
145 views

How can mobile sign-on be secured from imposter authentication screens?

History seems to have come almost full circle where old issues are shown in new/emerging technologies. Background If you trust the operating system, Windows originally had the Control - Alt - Delete ...
6
votes
2answers
344 views

How to Man-in-the-middle a whole network?

When performing a MiTM attack, you generally need to specify the router's IP address and the "victim" IP address. I'm trying to demonstrate to a business owner why he needs to secure his network, but ...
3
votes
2answers
185 views

SSL stripping in home network

I am trying to monitor the traffic of some "smart devices" in my home (TV, coffee machine, ...) but most of them communicate over SSL. What possibilities are there to look into SSL encrypted ...
2
votes
0answers
198 views

ssh dns spoofing warning - possible investigation?

Recently the router my ISP provided started to work suspiciously. At times the wireless connection from my devices to the router breaks and the router stops responding while sometimes the connection ...
1
vote
3answers
168 views

MITM on popular sites - DNS

Can a MITM attack on popular sites such as Facebook.com Google.com be done by intercepting the DNS requests? Will the user notice something? For instance: Loading https://fb.com The client ...
1
vote
1answer
160 views

Any real-world examples of root certificate store compromises?

Apart from the infamous Superfish/Lenovo case this year, are there any other known cases of a malicious root certificate being installed on a target machine to allow transparent MITM attacks, whether ...
3
votes
1answer
482 views

ARP poisoning and port forward together

Suppose these assumptions: Router IP address: 192.168.1.1 Router MAC address: 00:00:00:00:00:00 My IP address: 192.168.1.2 My MAC address: 00:00:00:00:00:01 Victim IP address: 192.168.1.3 ...