A man-in-the-middle attack (MiTM) is an attack against a communication protocol where the attacker relays and modifies messages in transit. The parties believe they are talking to each other directly, but in fact both are talking to the attacker.

learn more… | top users | synonyms (1)

80
votes
5answers
13k views

How can my employer be a man-in-the-middle when I connect to Gmail? [duplicate]

I'm trying to understand SSL/TLS. What follows are a description of a scenario and a few assumptions which I hope you can confirm or refute. Question How can my employer be a man-in-the-middle when ...
18
votes
4answers
7k views

Options when defending against SSLstrip?

I'm wondering, does anyone have any suggestions to defend against SSLstrip particularly?
42
votes
3answers
60k views

How does SSLstrip work?

I've been reading up on SSLstrip and I'm not 100% sure on my understanding of how it works. A lot of documentation seems to indicate that it simply replaces occurrences of "https" with "http" in ...
127
votes
8answers
16k views

Are “man in the middle” attacks extremely rare?

In "Some thoughts on the iPhone contact list controversy and app security", cdixon blog Chris Dixon makes a statement about web security Many commentators have suggested that a primary security ...
26
votes
5answers
30k views

Can I detect a MITM attack?

Based on this question here: Are "man in the middle" attacks extremely rare? Is it possible to detect man-in-the-middle attacks, and if so, how would one go about it? In addition, what if ...
12
votes
6answers
3k views

Is it possible for corporation to intercept and decrypt SSL/TLS traffic? [duplicate]

I found there are some companies claim that they offer service that can eliminate SSL/TLS blind spot, such as Blue Coat and Gigamon. Are they talking about some way of decipher the https content (...
26
votes
3answers
4k views

For an HTTPS web application, is it worthwhile to encrypt the password before POSTing it, to keep a MITM attacker from harversting it?

Our application has recently gone through penetration testing. The test found one critical security breach, which is essentially: The problem: Attacker sets up a WiFi spot. User enters our site (...
9
votes
2answers
4k views

HSTS bypass with SSLstrip2 + DNS2proxy

I am trying to understand how to bypass HSTS protection. I've read about tools by LeonardoNve ( https://github.com/LeonardoNve/sslstrip2 and https://github.com/LeonardoNve/dns2proxy ). But I quite don'...
18
votes
3answers
972 views

Can a nation-state adversary perform a MITM attack by compelling a CA to issue them with fake certs?

As I understand it, with any encryption system based on a trust chain / CAs (eg SSL, TLS, S/MIME), it would be possible for a nation-state adversary (such as the NSA) to compel the CA to issue them ...
7
votes
3answers
5k views

arp spoofing protection on LAN

I am a network administrator in company. I read this article eject any wifi device from network with android Some of employers are using mobile phones and company`s wireless network. Theses employers ...
151
votes
4answers
18k views

Is there anything preventing the NSA from becoming a root CA?

There are now tons of Certification Authorities (CAs) that are trusted by default in major OS's, many of which are unrecognizable without online lookup or reference. While there have been attempts ...
14
votes
9answers
34k views

Tracking down a rogue access point

Over the course of about a month we have received multiple reports of a rogue access point attempting to intercept traffic. I suspect an attacker is using a wifi pineapple, or similar hardware device....
10
votes
2answers
6k views

How safe is Tor from MITM/snooping attacks?

I am behind an HTTP proxy, and I frequently tunnel out via an ssh -D SOCKS proxy (I have access to a couple of outside servers which I can tunnel to) when the HTTP proxy causes problems1. Now, this ...
7
votes
3answers
8k views

How do I check that I have a direct SSL connection to a website?

I always thought that if I had an SSL connection there would be no MITM attacks. Now it appears that isn't true (see comments in this question Is it okay from a security perspective to read foreign (...
6
votes
1answer
462 views

Can an SSH server fingerprint be spoofed?

If I simply connect to an SSH server, get its key fingerprint, and immediately disconnect, does the SSH protocol ensure that the server also had the private key in order to get that far into the ...
19
votes
4answers
2k views

Credit card forms on HTTP pages a MITM risk?

The other day, there was a web developer mailing list thread about a fundraiser page. One person noted that the page with the credit card form was HTTP, not HTTPS. In response, one person said that ...
11
votes
2answers
2k views

How might the U.K. Government's proposed internet surveillance equipment “bypass” encryption?

http://www.channel4.com/news/black-boxes-to-monitor-all-internet-and-phone-data http://rt.com/news/uk-privacy-internet-freedom-186/ 'Black boxes' will be installed by internet services providers ...
4
votes
6answers
2k views

How to “demonstrate” man-in-the-middle attack?

I'm TAing a particular course on system security. A specific example is transitting the password in plain text when developing a web application (as part of a class project). Over the years a bunch ...
4
votes
2answers
741 views

Should the Keygen element be used to create a certificate for mutual auth TLS? What alternatives are there?

I'm interested in using mutual auth TLS to improve the security of my javascript based webservices . I've looked at the Keygen element and given all its issues, not sure if this can even be used for ...
1
vote
1answer
694 views

Who can carry out Man-in-the-Middle (MITM) attacks?

We seem to spend a lot of time guarding against Man-In-The-Middle (MITM) attacks without discussing who we are actually guarding against. This is important because if these individuals are unlikely ...
1
vote
3answers
215 views

Can man-in-the-middle attacks affect anyone not connected to the attackers network?

I'm trying to understand what these attacks are restricted to. I'm aware that man-in-the-middle attacks can be done if the attacker is on the same network (using something like Wire Shark), but is it ...
41
votes
4answers
46k views

What's an easy way to perform a man-in-the-middle attack on SSL?

I'd like to perform a man-in-the-middle attack on SSL connections between clients and a server. Assuming the following: I've got a certificate that the client will accept, via poor cert validation ...
13
votes
5answers
5k views

Does HTTPS Everywhere defend me against sslsniff-like attacks?

http://www.thoughtcrime.org/software/sslsniff/ If I have a domain on my HTTPS Everywhere list, so that theoretically it could be only visited via an HTTPS connection in my Firefox, then could an ...
11
votes
1answer
819 views

Is Nokia's “institutional MITM” of SSL traffic vulnerable to CRIME attack?

It's recently been in the news that some Nokia phones proxy all traffic, including SSL connections, through a Nokia proxy. This is effectively an "institutional MITM" attack on users those phones. ...
4
votes
3answers
4k views

Do client certificates provide protection against MITM?

I'm looking for a way to protect clients from a MITM attack without using a VPN, and ToR. My thought is that client certificates might do the job, but I'm not entirely sure since not too much server ...
17
votes
2answers
28k views

Specific risks of embedding an HTTPS iframe in an HTTP page

I need help listing the specific risks of embedding an HTTPS iframe that enables credit card checkout inside of an HTTP page. Are there security issues with embedding an HTTPS iframe on an HTTP page? ...
11
votes
1answer
2k views

Why is stackoverflow not using HTTPS for all it's page?

Most webpage from stackoverflow use http even if you are logged in. Isn't it a security issue? Could an eavesdropper steal my session and authentication cookie then impersonate me since it's sent ...
13
votes
1answer
855 views

Kaspersky Antivirus “secure connection scan” as broken as Superfish?

I've read a lot about Superfish (and similar ad-ware) lately and I basically understand the vulnerability to MITM attacks. But I'm actually wondering if the "secure connection scan" by Kaspersky ...
5
votes
2answers
4k views

SSL / TLS Renegotiation Handshakes MiTM Plaintext Data Injection- medium or low risk?

This is a Nessus finding, which is considered medium by default. Basically it may allow for some plaintext injection which may allow for some man in the middling. My question is, has these been ...
11
votes
3answers
5k views

Preventing a spoofing man in the middle attack?

I was humming along with my usual routine of listening to old Defcon videos trying to understand some of the basics of what's going on in the IT Security world, when I came across one explaining man ...
10
votes
2answers
8k views

How to thwart sslstrip attack?

I need help understanding the dynamics of an sslstrip attack. I'm using it to test the security of a site that I own. I can successfully sniff the victim (in this case, myself) credentials over the ...
9
votes
2answers
4k views

How can end-users detect malicious attempts at SSL spoofing when the network already has an authorized SSL proxy?

I'm working on one client's network where they have enabled HTTPS authority spoofing on their proxy. This allows them to effectively perform a man-in-the-middle attack to decipher all outgoing ...
5
votes
2answers
5k views

Are VPNS vulnerable to active man in the middle attacks?

I know that with SSL/TLS, man in the middle attacks are not possible. For example if Alice and Bob are trying to communicate and Trudy is trying to perform a man in the middle attack, then when Alice ...
5
votes
4answers
3k views

Mitigating SSLStrip by only serving a site over HTTPS?

So I just learned about SSLStrip now--I feel like I'm so late to the game. What I want to know is: If your site only serves content over HTTPS and hard fails on HTTP requests, with no redirect, are ...
2
votes
1answer
799 views

Arp Spoofing Causing Dropped Connections

I have had a lecture today based on Arp Spoofing. However, i can not get it to work. Scenario: My laptop - running kali Target laptop (housemate - with permission) - running windows 8 Commands ...
7
votes
5answers
9k views

Is there a method to detect an active man-in-the-middle?

Suposing an attacker that has gained access to the router. Is there a way, for the victim, to notice that is being attacked? I think one of my friends is a victim of this kind of attack. How can I be ...
5
votes
3answers
294 views

With HTTPS, what information would a MitM attacker be able to glean?

Consider a user accessing a site that is using HTTPS for all its traffic. A hacker is trying to use a man-in-the-middle to snoop on the user. What information can he glean? Obviously the content is ...
3
votes
2answers
368 views

Are MITM attacks possible on HTTP loopbacks?

I have a web server running at example.com. The web server performs a server-side request to example.com which results in a loopback, so the request never passes over the network. Is this request ...
2
votes
2answers
1k views

encryption method against man in the middle attack

Let's say there are 3 computers: Alice, Bob, Carol. Carol is network provider, so everything from Alice to Bob and vice versa passes through Carol. Carol can modify messages between Alice and Bob. Is ...
-1
votes
1answer
70 views

MITM of the SSH connection?

We connect to the servers via the "FOOBAR" machine. desktop -> FOOBAR(bar.com) -> server FOOBAR can log our SSH connections, what we type, etc. We log in via the following command: ssh -A -t ...
6
votes
1answer
184 views

Are there any situations when one can only mount a passive MITM?

This came up while discussing Web & insecure HTTP - Using RSA for encrypting passwords on the client side Is there any such situation possible when requesting an HTTP page where an attacker is ...
5
votes
0answers
619 views

Why is it not possible for an ISP to man-in-the-middle attack an SSL connection? [duplicate]

If the ISP carries my data, why do people seem to think they cannot see the contents? Wouldn't they be holding the key?
4
votes
1answer
461 views

Why does sslstrip+ fail to intercept the traffic from websites like facebook and gmail?

I have been reading an article about sslstrip and mitm. Before the introduction of HSTS it was possible to strip ssl and send an insecure http page to the victim. Anyway it was overcome by using HSTS ...
3
votes
3answers
428 views

Without SSL, what vantage point does one need to MITM non-SSL'd HTTP?

OK, so there are two things here: being able to read the content of the requests and responses, and then being able to modify them. The former may depend on the latter, I'm not sure. But basically, ...
2
votes
1answer
493 views

Who other than my ISP can perform man-in-the-middle attacks?

I've heard that not using https is dangerous because of man-in-the-middle attacks. Now, if I connect to a server from my home computer, I assume traffic passes through my ISP, so they could eavesdrop ...
22
votes
6answers
8k views

Possibility to sniff HTTPS traffic on devices without installing a certificate

My goal is to sniff the HTTPS traffic of some digital devices (AppleTV, game consoles, etc.), and decrypt the HTTPS packets in my local network. I cannot figure out a way by using some HTTPS ...
13
votes
2answers
39k views

How to spoof a cell phone tower (cell site, base station) — homemade IMSI-Catcher

An answer to a recent question has given me an idea for a school project (security CS program). Also, an active attacker (with a fake base station) can potentially force a mobile phone to use ...
10
votes
2answers
5k views

How can I prevent a man-in-the-middle (MITM) attack on my Android app API?

I checked out the app Packet Capture. This app is able to decrypt my app APIs (SSL Enabled) data by mounting a MITM attack using the Android VPN service. This does not even require root. How can I ...
14
votes
2answers
7k views

Is Apple's push notification service implementation vulnerable to a MitM attack

Recently(more info) I've spotted a strange message in the logs on my quite recent, fresh installation of OS X Mavericks 10.9.2 Apr 27 15:26:47 Ivans-MacBook-Pro.local apsd[194]: Unrecognized leaf ...
12
votes
1answer
158 views

How can mobile sign-on be secured from imposter authentication screens?

History seems to have come almost full circle where old issues are shown in new/emerging technologies. Background If you trust the operating system, Windows originally had the Control - Alt - Delete ...