Tagged Questions

A man-in-the-middle attack (MiTM) is an attack against a communication protocol where the attacker relays and modifies messages in transit. The parties believe they are talking to each other directly, but in fact both are talking to the attacker.

learn more… | top users | synonyms (1)

6
votes
1answer
142 views

Are there any situations when one can only mount a passive MITM?

This came up while discussing Web & insecure HTTP - Using RSA for encrypting passwords on the client side Is there any such situation possible when requesting an HTTP page where an attacker is ...
1
vote
1answer
365 views

How should this system be protected from ARP spoofing?

Background My university uses an authenticated (squid) HTTP proxy server for accessing the internet. There are a few reasons for this: They want to track misuse of the connection Our university ...
4
votes
2answers
3k views

How safe is Tor from MITM/snooping attacks?

I am behind an HTTP proxy, and I frequently tunnel out via an ssh -D SOCKS proxy (I have access to a couple of outside servers which I can tunnel to) when the HTTP proxy causes problems1. Now, this ...
3
votes
2answers
410 views

What is the disadvantage of using spoofing protected version of ARP protocol

I read this article about man-in-the-middle arp poisoning and how it works , it seems that arp poisoning programs exploits the fact that ARP protocols trusts any packet to be true and modify its ...
3
votes
2answers
769 views

Unencrypted data over Magnetic Card Reader. What are the security risks?

I am working on evaluating the security of my University's student id card. The ID card contains both a magnetic stripe and a RFID component and is used to make payments as well as to provide access ...
6
votes
2answers
2k views

How to hack a switch connected network with static ARP?

For example, if there is a network with three computers connected to the same switch, Alice, Bob, and Eve. If Alice and Bob add each other on their own ARP list as a static ARP entry, and Eve wants to ...
5
votes
1answer
1k views

Is it possible that my home router is preventing my ARP poisoning attack?

As part of a school project I am trying to do a MITM attack on my local network using ARP poisoning. I choose a target and then I send a spoofed ARP packet to it and to the router every 100 ...
8
votes
3answers
823 views

Is it possible to “protect” against MITM attacks over HTTP?

In a conversation on twitter I warned a site about a security vulnerability. Specifically, the possibility of a MITM (Man in the Middle) attack used to compromise their registration form. The ...
2
votes
2answers
465 views

SSL: How to send generated client certificate from server to avoid MITM?

The question I have is simply how do I prevent a MiTM attack on a certificate once the server side creates a new one and tries to send it to a client? Does the certificate get encrypted by rsa and ...
8
votes
3answers
3k views

Preventing a spoofing man in the middle attack?

I was humming along with my usual routine of listening to old Defcon videos trying to understand some of the basics of what's going on in the IT Security world, when I came across one explaining man ...
7
votes
4answers
1k views

Man-in-the-middle scenario for TLS

Consider the following scenario: You want to securely communicate with a.com and you only trust the VeriSign root certificate. a.com presents a certificate signed by VeriSign with CN=a.com, so you ...
5
votes
2answers
630 views

Man in the middle attacks for Out of band Authentication

I was researching on methods to avoid man in the middle attacks. I thought of using out of band authentication but i read the wikipedia article on the same topic which goes as follows: "In ...
29
votes
4answers
25k views

What's an easy way to perform a man-in-the-middle attack on SSL?

I'd like to perform a man-in-the-middle attack on SSL connections between clients and a server. Assuming the following: I've got a certificate that the client will accept, via poor cert validation ...
1
vote
2answers
1k views

What is the best way to protect a captive portal againt MAC spoofing

What is the best way to protect a captive portal againt MAC spoofing? The MAC Address appears one of the only ways to distinguish wireless clients from one another, anything one authenticated client ...
8
votes
2answers
709 views

Is it safe to sync private keys between iOS devices using iCloud?

My iOS app has to handle storing private keys for the user. Normally I would just use Keychain Services for this as I would a password, but it would be great if I could sync the keys between the ...
0
votes
3answers
304 views

If a “man in the middle attack” obtains the username & password of user, are there mechanisms that can prevent them connecting to server?

Assume that we have a user that wants to connect to the server, for example with login page, when user submits the username & password goes to the server - if man in the middle reads the user ...
5
votes
1answer
2k views

ECDHE_RSA and gmail

I'm using Chrome on Ubuntu Linux to connect to Gmail. The connection info says that ECDHE_RSA is used for the https symmetric key exchange. Based on my understanding of TLS and Gmail, my client ...
18
votes
4answers
1k views

Credit card forms on HTTP pages a MITM risk?

The other day, there was a web developer mailing list thread about a fundraiser page. One person noted that the page with the credit card form was HTTP, not HTTPS. In response, one person said that ...
3
votes
6answers
1k views

How to “demonstrate” man-in-the-middle attack?

I'm TAing a particular course on system security. A specific example is transitting the password in plain text when developing a web application (as part of a class project). Over the years a bunch ...
1
vote
3answers
673 views

SMTP and SSL/TLS

If I understand correctly, communication between SMTP servers may be encrypted but is not required. Because it is optional, does it really have benefits? When server A connects to server B, both of ...
1
vote
2answers
13k views

Error code: sec_error_untrusted_issuer

I need help with a security issue concerning this code that has just been popping up recently as I visit my favorite websites. Based on some past history I KNOW something is not right, and I am not ...
8
votes
3answers
730 views

How practical/important is the Lucky Thirteen TLS attack?

I was reading this article which talks about a new attack against TLS being called Lucky Thirteen. It claims to allow repeatable MitM attacks against HTTPS connections. It's described as being fairly ...
4
votes
5answers
284 views

Can SSL requests be proxied by issuing a second certificate?

Alice wants to login to her account at https://www.bobsbank.com/. However she clicks on a malicious link in an email and instead gets sent to the malicious site https://www.charliesbank.com/. The ...
1
vote
2answers
985 views

Is SSH2 still vulnerable to man-in-middle attacks?

With SSH using RSA public key authentication, can an attacker spoof the server IP address and connect with client to obtain client password?
3
votes
2answers
359 views

Should the Keygen element be used to create a certificate for mutual auth TLS? What alternatives are there?

I'm interested in using mutual auth TLS to improve the security of my javascript based webservices . I've looked at the Keygen element and given all its issues, not sure if this can even be used for ...
2
votes
0answers
255 views

How can Nokia decrypt HTTPS data? [duplicate]

Possible Duplicate: Can real end-to-end SSL encryption be made? Regarding this piece of news, I wonder how can Nokia so easily decrypt HTTPS data? As I understand the data is encrypted by ...
3
votes
3answers
1k views

How do a VPNs route SSL traffic and do they compromise security?

If my understanding of how VPNs operate is correct, all traffic between me and the Internet at-large is routed through the VPN's servers. So an attacker would only be able to see encrypted traffic ...
11
votes
1answer
741 views

Is Nokia's “institutional MITM” of SSL traffic vulnerable to CRIME attack?

It's recently been in the news that some Nokia phones proxy all traffic, including SSL connections, through a Nokia proxy. This is effectively an "institutional MITM" attack on users those phones. ...
3
votes
1answer
499 views

Burp proxy between non proxy aware device

I want to intercept traffic between a Ethernet connected device, which is not proxy aware and modify/inject javascript. Conventionally when testing webapps I would use burp. Can burp sit on my ...
1
vote
3answers
2k views

Do client certificates provide protection against MITM?

I'm looking for a way to protect clients from a MITM attack without using a VPN, and ToR. My thought is that client certificates might do the job, but I'm not entirely sure since not too much server ...
1
vote
1answer
489 views

What's most standard way to secure internet connections and protect privacy?

It's common knowledge that Wi-Fi, or other Internet connections, should be encrypted via a VPN to be secure, and to hide our real IP address from intermediary network observers. However, one can't ...
2
votes
4answers
509 views

Which Wifi encryption method is secure?

you may wonder apple just removed ethernet port from new macbooks which means we have to use wifi! i made a wifi hotspot with my windows laptop to use for my macbook (my modem don't have wifi because ...
3
votes
1answer
274 views

How can I use certificates to secure my webservices? What is available to javascript?

I have a few web services that are accessed over public wifi connections and I think it would be a good idea to issue certificates to encrypt data, prevent MITM, and invalid impersonation (beyond what ...
3
votes
1answer
328 views

Are man-in-the-middle attacks against p2p systems realistic?

I'm implementing a DHT based on Kademlia following this paper. The protocol described in this paper uses nonces to protect against man-in-the-middle attacks. The disadvantage is that latency gets ...
1
vote
2answers
546 views

Are SIP REGISTER transactions w/ HTTP Digest subject to replay attacks?

It is my understanding that the authentication during a SIP registration is done through some kind of an MD5 hashing algorithm known as HTTP Digest, and doing a tcpdump of the actual traffic I've ...
1
vote
2answers
266 views

Reg HTTPS man in the middle [duplicate]

Possible Duplicate: How is it possible that people observing an HTTPS connection being established wouldn’t know how to decrypt it? A browser sends a request to gmail.com, gmail sends the ...
1
vote
1answer
153 views

How safe is WSIT username authentication with symmetric key?

I have an ajax-ws web service (exposed via glassfish) that uses username authentication with a symmetric key to encrypt and authenticate clients(link). How secure is this mechanism? Is this enough to ...
12
votes
4answers
439 views

How to safely synchronize time over Internet?

All modern OS now keep accurate time by regularly synchronizing time over an untrusted network - Internet. Could an attacker conducting a MITM attack, influence or change the time of a computer while ...
15
votes
6answers
2k views

Safe to make a VPN connection over coffee shop WIFI?

On my work laptop I regularly create a VPN connection that I use to remote desktop to our web server. Is this safe to do on a coffee shop where random people are connected to the same wifi network?
20
votes
4answers
918 views

How can a web application protect IE users when this browser doesn't support HSTS?

HTTP Strict Transport Security (HSTS) is a very useful feature at preventing OWASP a9 violations and attacks like SSLStrip which try and prevent the client from making a secure connection. My ...
2
votes
2answers
1k views

How to correctly secure a ssh session against MITM attack?

How do you improve the security of your ssh session against a man-in-the-middle attack?
5
votes
3answers
960 views

Defending against rogue access points

Tools like Karma, and its offspring's, have the feature of becoming any AP that a client is probing for. Your client will naturally connect to this fake AP as it sees nothing wrong with it, thus ...
0
votes
2answers
742 views

encryption method against man in the middle attack

Let's say there are 3 computers: Alice, Bob, Carol. Carol is network provider, so everything from Alice to Bob and vice versa passes through Carol. Carol can modify messages between Alice and Bob. Is ...
0
votes
2answers
751 views

Is a VPN the only way to protect against rogue Wifi access points MITM attacks?

Given that it's very easy set up a rogue access point and MITM that connection, is a VPN to a trusted host the only real way to secure my browsing and other TCP/UDP actions? This question relates to ...
3
votes
4answers
3k views

Is there a method to detect an active man-in-the-middle?

Suposing an attacker that has gained access to the router. Is there a way, for the victim, to notice that is being attacked? I think one of my friends is a victim of this kind of attack. How can I be ...
0
votes
2answers
2k views

Should ettercap make the targets this slow?

I recently started experimenting with ettercap, however, I quickly noticed that when I try and arp poison targets they can almost never communicate with each other. Is this normal? My computer is a ...
2
votes
3answers
321 views

Without SSL, what vantage point does one need to MITM non-SSL'd HTTP?

OK, so there are two things here: being able to read the content of the requests and responses, and then being able to modify them. The former may depend on the latter, I'm not sure. But basically, ...
6
votes
2answers
3k views

arp spoofing protection on LAN

I am a network administrator in company. I read this article eject any wifi device from network with android Some of employers are using mobile phones and company`s wireless network. Theses employers ...
2
votes
4answers
482 views

MiTM, can a binary file be changed or swapped enroute

I genuinely looked for an answer to this but my terminology is lacking. If an attacker was in a MiTM position running a proxy, wouldn't it be possible for them to detect a binary like an .exe or .pdf ...
4
votes
2answers
227 views

Are Windows Updates susceptible to tampering, eg. using a MiTM attack.

My real question is how are patches and updates authenticated in general. But for example how does windows know a windows update is really a windows update, does it just trust the URL or is there some ...