A man-in-the-middle attack (MiTM) is an attack against a communication protocol where the attacker relays and modifies messages in transit. The parties believe they are talking to each other directly, but in fact both are talking to the attacker.

learn more… | top users | synonyms (1)

1
vote
0answers
11 views

Using separate HAProxy and API tiers, how can I ensure a request came from HAProxy?

I have two machines and a HAProxy machine doing SSL termination and accepting client certs successfully. How can I configure HAProxy to ensure that the messages coming into the API box are from ...
1
vote
2answers
37 views

Unencrypted FTP to transfer encrypted data - okay if IP-restricted?

If unencrypted FTP over the public internet is the only file transfer option for a particular situation, what security concerns are applicable assuming: The data being transferred is strongly ...
2
votes
2answers
84 views

Can a properly implemented TLS connection be intercepted?

Assuming a TLS connection where both the server and client perfectly adhere to the pertinent standards. Can an transparent HTTPS proxy intercept the TLS connection? (Assuming the "mock CA" ...
11
votes
1answer
110 views

How can mobile sign-on be secured from imposter authentication screens?

History seems to have come almost full circle where old issues are shown in new/emerging technologies. Background If you trust the operating system, Windows originally had the Control - Alt - Delete ...
4
votes
1answer
92 views

How to Man-in-the-middle a whole network?

When performing a MiTM attack, you generally need to specify the router's IP address and the "victim" IP address. I'm trying to demonstrate to a business owner why he needs to secure his network, but ...
13
votes
8answers
7k views

Why is ARP poisoning killing all network activity?

Using ettercap and ARP poisoning, I was able to eavesdrop on other connections, but suddenly I was unable to make any connection to the Internet. To restore Internet connectivity, I had to restart my ...
2
votes
2answers
73 views

SSL stripping in home network

I am trying to monitor the traffic of some "smart devices" in my home (TV, coffee machine, ...) but most of them communicate over SSL. What possibilities are there to look into SSL encrypted ...
-1
votes
0answers
32 views

WPA explained for the non-technical?

Can anybody give me a simple explanation of the WPA mechanism used in our WiFi routers? How does my device know that it's connecting with the router I want to connect to (i.e. no man in the middle ...
8
votes
6answers
2k views

How do RSA fingerprints protect from MITM attacks?

I understand that RSA fingerprints are used to verify that you are really connecting directly to who you want to connect to, and not someone else posing as that site. Like when you do a git push, it ...
2
votes
0answers
97 views

ssh dns spoofing warning - possible investigation?

Recently the router my ISP provided started to work suspiciously. At times the wireless connection from my devices to the router breaks and the router stops responding while sometimes the connection ...
5
votes
1answer
3k views

ECDHE_RSA and gmail

I'm using Chrome on Ubuntu Linux to connect to Gmail. The connection info says that ECDHE_RSA is used for the https symmetric key exchange. Based on my understanding of TLS and Gmail, my client ...
1
vote
3answers
149 views

MITM on popular sites - DNS

Can a MITM attack on popular sites such as Facebook.com Google.com be done by intercepting the DNS requests? Will the user notice something? For instance: Loading https://fb.com The client ...
2
votes
1answer
180 views

ARP poisoning and port forward together

Suppose these assumptions: Router IP address: 192.168.1.1 Router MAC address: 00:00:00:00:00:00 My IP address: 192.168.1.2 My MAC address: 00:00:00:00:00:01 Victim IP address: 192.168.1.3 ...
0
votes
1answer
136 views

Any real-world examples of root certificate store compromises?

Apart from the infamous Superfish/Lenovo case this year, are there any other known cases of a malicious root certificate being installed on a target machine to allow transparent MITM attacks, whether ...
2
votes
1answer
336 views

SSL traffic manipulation through ettercap MitM and iptables

I am trying to understand the relation between some tools and concepts used for MitM on a wifi network and how https transaction (over this wifi network) between an android app and the respective ...
3
votes
1answer
63 views

Is it possible for an SSH MITM to attack only if the key isn't in the known_hosts?

I was trying to connect a server using a different port when the network seemed too slow. It gives an ECDSA key, while the previous key in the known_hosts is RSA. I refused to continue the connection ...
2
votes
1answer
84 views

Why is referer checking needed for Django to prevent CSRF

Today I learned that Django's CSRF protection uses refer(r)er header checking in addition to checking a hidden form field against a cookie. It seems to be important, judging from docs and issue below. ...
5
votes
5answers
2k views

What are the advantages of multi-level authentication?

By multi-level authentication, I am referring to the fact that the user makes use of a primary username password keypair to log into his account. Then, to perform some other actions, such as authorize ...
0
votes
2answers
149 views

How is this SSL spoofing possible?

Here is a description of a seemingly successful SSL certificate spoof: https://cryptostorm.org/viewtopic.php?f=67&t=8713 The session is initiated by pointing a newly-opened icedove window ...
0
votes
0answers
10 views

MITMf import error [migrated]

I was trying to install MITMF on Ubuntu 15.04. I followed the instructions on git. I installed all the dependencies, including those in requirements.txt and ran setup.sh. However, I recieved the ...
0
votes
2answers
71 views

Does man in the middle require physical access to the network infrastructure?

Reading other questions such as this or this or this, it seems if I'm the only one using the wifi connection at home I can be sure no man in the middle attack is happening, because there is no way to ...
3
votes
4answers
121 views

Can MITM change the protocol?

According to my experience surfing the web, many websites foo.com don't support https. When I go to https://foo.com, it just changes to foo.com Can attackers forge the fact that foo.com doesn't ...
2
votes
3answers
167 views

MITM on program with no proxy settings

I'm trying to inspect the traffic of a program (which is running on my computer) that uses SSL over TCP to a non-standard port. The traffic may or may not be HTTP traffic, likely isn't. Neither ...
2
votes
1answer
63 views

SSL certificate trust chain shows root certificate with 1024-bit public key - Is this evidence of a MITM attack?

My account at my domain name registrar was hacked and I am trying to understand how the hackers were able to steal my login credentials. Because the root certificate in the trust chain for the ssl ...
2
votes
2answers
63 views

Forwarding an SSL connection

My general question: Can a two-way SSL connection be forwarded to a 3rd server? The specifics: I have a WebLogic server supporting two way-SSL, client side's cert is from their CAC card. The ...
-4
votes
1answer
114 views

Is it possible for someone to read Gmail messages with a man in the middle? [duplicate]

Assuming these hypotheses: 1) Your account isn't hacked (hacker has not entered your account directly) 2) Gmail encrypts via SSL end-to-end 3) The hacker is not Gmail or Google 4) There is no ...
24
votes
5answers
2k views

What prevents a man in the middle from requesting a certificate for your server?

Let's say you have a server at shop.example.com and you are requesting a certificate from some trusted CA like Comodo (they say they'll issue it within few minutes online). First of all, how can ...
4
votes
3answers
1k views

How do I verify someone's identity if the only method of contact is their email address?

Email addresses can be hacked or perhaps even spoofed. I need to pay individuals via paypal and I fear that over time people's email will change or become compromised. How can I ensure I am paying the ...
0
votes
0answers
18 views

OTR and active Man In The Middle attacks [duplicate]

As I'm currently playing around with cryptography, especially OTR, I'm wondering about its security against active MitM attacks. Let's say Alice and Bob created an OTR session, but Eve is acting as ...
5
votes
4answers
124 views

MITM attack between me and TOR entry node

In which ways can my ISP, who by the way controls the WiFi router I connect to, do a MITM attack on my TOR connections and hence read the traffic?
3
votes
3answers
114 views

Detecting a MITM attack

If my session is under a Man-In-The-Middle attack, can I detect it by checking the ip addresses my machine is connected to? For example, I want to know if my connection to a certain website is MITMed ...
2
votes
1answer
55 views

Security bounds of TLS client authentication (from browsers)

Say that there are two servers that perform TLS. Both servers have valid end-point certificates. In other words, neither of them would raise a warning from the browsers after the connection has been ...
1
vote
2answers
126 views

How do I perform a legal SSL MitM attack for my company?

I have been given a task to test some of our company's security. I have SSL stripped before but on a very basic level and now days with the security is a bit harder. I want to allow all HTTPS traffic ...
3
votes
1answer
64 views

Security of OpenVPN against sophisticated DPI solution

I'm planing to build a device (prototype) that act as a portable security gateway. To make this, I choosed OpenWRT running on Raspberry Pi with OpenVPN for VPN connection. My main purpose of this ...
5
votes
2answers
971 views

HSTS bypass with SSLstrip2 + DNS2proxy

I am trying to understand how to bypass HSTS protection. I've read about tools by LeonardoNve ( https://github.com/LeonardoNve/sslstrip2 and https://github.com/LeonardoNve/dns2proxy ). But I quite ...
20
votes
7answers
4k views

Safe to make a VPN connection over coffee shop WIFI?

On my work laptop I regularly create a VPN connection that I use to remote desktop to our web server. Is this safe to do on a coffee shop where random people are connected to the same wifi network?
3
votes
1answer
124 views

How was my email intercepted? [closed]

I've recently sent an email to a non-Protonmail user, using a code phrase. Someone on the recipient's home network was able to intercept the email and responded to me in detail as to the content of my ...
0
votes
2answers
123 views

Could a compromised root CA impersonate any SSL certificate?

My question is about MITM attacks against https and how those would appear to the end user. Suppose a trusted root CA were compromised / coerced into producing fraudulent SSL certificates. What would ...
-2
votes
1answer
77 views

Tor website HPKP (key pinning) failure

I'm currently facing a key pinning error when trying to access the torproject.org website with Firefox. Is anyone facing the same problem? Does anyone know if they changed their certificate? If not, ...
1
vote
0answers
46 views

For attackers looking to launch arp spoof on a target, does the attack have to happen in real time?

I was surfing the web at 3 in the morning and I got a warning which seems to indicate a MITM attack. Does this mean the attacker was able to passive sniff my activity in real-time in order to launch ...
1
vote
4answers
118 views

is it easier to eavesdrop on ethernet connection rather than wifi?

I heard someone say that ethernet connection is vulerable if someone can connect to your LAN, and that the traffic isn't encrypted in the way it might be if you're using WPA wifi encryption. Is this ...
3
votes
2answers
550 views

How to know if I'm under a MITM attack

If I am connected in a public WiFi, is there any way to know whether I am under attack or not while browsing sites using SSL? For example, if I visit facebook.com and the URL starts with "https://", ...
2
votes
4answers
88 views

What are some ways to spot email spoof attacks?

I use Gmail and I started getting malicious-sounding emails from people I know intimately. The people I spoke to said they did not send those emails. In order for the attacker to carry this off, are ...
4
votes
1answer
142 views

Man in the Middle Attack against NTP

So, lately I've been really into penetration testing and learning the nitty-gritty of tech. I'm dong courses on computer architecture, cryptography, surveillance law, and computer networks. I never ...
1
vote
1answer
47 views

Influence of SSL Intercept on SSLVPN

We're considering implementing an SSL Intercept proxy in my organization. It will perform a SSL MITM to be able to inspect traffic. It will be a solution of a commercial vendor. It is clear that we ...
2
votes
0answers
47 views

If I install a certificate for the purposes of logging into a Wifi connection, is it still safe?

There are some wifi networks (large universities for example) which use HTTPS to get to a login page, and in order to verify that they have not been spoofed, provide the certificate ahead of time ...
3
votes
2answers
51 views

Security of nested ssh

First of all, by nested ssh, I mean the following way of using ssh: ssh usera@Bob 'ssh usera@C' suppose A wants to login on server C, but for some reason C is not directly available to A (e.g. C's ...
3
votes
2answers
233 views

How can I tell if my ethernet connection is being sniffed? [duplicate]

I read in another post that wired traffic is not protected: The only real additional threat that a malicious network administrator would pose, is that they have access to the wired side of the ...
0
votes
0answers
30 views

Can Bluetooth be man in the middle'd at the L2CAP layer?

Bluetooth HID devices can be man in the middle'd with two bluetooth dongles and this code http://ossmann.com/shmoo-2010/ Is this technique limited to just HID profile bluetooth devices or could this ...
1
vote
2answers
5k views

Unrecognized leaf certificate

Every 15 minutes or so I get this message in my system.log Apr 25 22:05:36 Ivans-MacBook-Pro.local apsd[194]: Unrecognized leaf certificate Apr 25 22:20:57 Ivans-MacBook-Pro.local apsd[194]: ...