Questions tagged [man-in-the-middle]
A man-in-the-middle attack (MiTM) is an attack against a communication protocol where the attacker relays and modifies messages in transit. The parties believe they are talking to each other directly, but in fact both are talking to each other via the attacker in the middle.
1,363
questions
419
votes
14
answers
69k
views
How is it possible that people observing an HTTPS connection being established wouldn't know how to decrypt it?
I've often heard it said that if you're logging in to a website - a bank, GMail, whatever - via HTTPS, that the information you transmit is safe from snooping by 3rd parties. I've always been a little ...
- 4,485
178
votes
4
answers
25k
views
Is there anything preventing the NSA from becoming a root CA?
There are now tons of Certification Authorities (CAs) that are trusted by default in major OS's, many of which are unrecognizable without online lookup or reference.
While there have been attempts ...
- 2,071
138
votes
8
answers
23k
views
Are "man in the middle" attacks extremely rare?
In "Some thoughts on the iPhone contact list controversy and app security", cdixon blog
Chris Dixon makes a statement about web security
Many commentators have suggested that a primary security ...
- 4,564
104
votes
5
answers
147k
views
How does SSLstrip work?
I've been reading up on SSLstrip and I'm not 100% sure on my understanding of how it works.
A lot of documentation seems to indicate that it simply replaces occurrences of "https" with "http" in ...
- 3,228
101
votes
5
answers
33k
views
How can my employer be a man-in-the-middle when I connect to Gmail? [duplicate]
I'm trying to understand SSL/TLS. What follows are a description of a scenario and a few assumptions which I hope you can confirm or refute.
Question
How can my employer be a man-in-the-middle when ...
- 1,144
88
votes
7
answers
22k
views
Why is SMS used as a way of verifying a user's mobile, when it is not even encrypted in transit?
I did some research about how secure and private SMS messages are.
Providers and governments can see these SMS messages in plaintext,
but what is weird is that these messages are not encrypted in ...
- 1,219
75
votes
1
answer
17k
views
How can Kazakhstan perform MITM attacks on all HTTPS traffic?
There is now MITM on HTTPS traffic in Kazakhstan.
But for MITM to work, other than installing the certificate, there has to be someone proxying the request, right? Will that role be played by the ...
- 2,473
64
votes
3
answers
14k
views
Why is Firefox (and only Firefox) reporting that my connection is insecure on multiple sites?
After installing Firefox 54.0.1 on my work laptop, the first page I see warns me that "Your connection is not secure" when opening https://www.mozilla.org/.
"The owner of Firefox has configured their ...
- 1,535
63
votes
3
answers
5k
views
Why aren't IMSI catchers rendered ineffective by standard MITM defenses?
There's been a lot of reporting in the past few years about law enforcement agencies using IMSI catchers (also known as Stingrays after a popular brand of them) to intercept cellular communications.
...
- 1,182
62
votes
10
answers
15k
views
Is there such a thing as a "Black Box" that decrypts Internet traffic?
I have been reading about the Snoopers charter bill that was passed in the UK this week.
It mentions a "Black Box" which is cited here: ‘Black boxes’ to monitor all internet and phone data.
It ...
- 3,041
61
votes
4
answers
11k
views
Is there a way to make sure my government does not swap out SSL certificates?
I was recently wondering whether there exists a way to make sure my government is not swapping out SSL certificates in order to intercept the traffic.
I know almost all browsers are complaining in ...
- 681
61
votes
3
answers
12k
views
Is it common practice for companies to MITM HTTPS traffic?
My company has just introduced a new VPN policy whereby once connected all traffic is routed the company network. This is to allow for improved monitoring of data theft.
It would appear that this ...
- 2,772
59
votes
3
answers
11k
views
Is receiving fake torrent data possible?
While downloading a file via a torrent, what will happen if some of the peers send me fake chunks?
Also, can any of the peers send me a whole fake file? For example, if I download a .torrent file ...
user156092
57
votes
4
answers
161k
views
How to verify the checksum of a downloaded file (pgp, sha, etc.)?
Maybe I have been negligent towards the verification of software I download over the Internet, but I (or anybody I ever met) have never tried to verify the checksum of the contents I download. And ...
- 1,345
54
votes
5
answers
12k
views
Are all these attacks possible with WiFi MitM or is it over-hyped nonsense?
My dad sent me this video asking if he should be worried about this?
The video shows:
a wifi AP broadcasting an airport's wifi name
security researcher seeing the sites the victim browses
security ...
- 3,711
52
votes
6
answers
11k
views
Should a bank/financial service use external URL shortener services?
Say there is a bank/financial service that wants to have hyperlinks on their secure website/domain (or even in emails they send out to customers). In some of these links there are some long/obscure ...
- 637
51
votes
2
answers
75k
views
Why is it possible to sniff an HTTPS / SSL request?
I'm new to the realm of HTTP requests and security and all that good stuff, but from what I've read, if you want your requests and responses encrypted, use HTTPS and SSL, and you'll be good. Someone ...
- 611
47
votes
5
answers
59k
views
What's an easy way to perform a man-in-the-middle attack on SSL?
I'd like to perform a man-in-the-middle attack on SSL connections between clients and a server.
Assuming the following:
I've got a certificate that the client will accept, via poor cert validation ...
- 135k
46
votes
5
answers
8k
views
How does someone become a man in the middle?
As I understand it in order to commit a successful MiTM attack you need to be "sitting" somewhere along the traffic path. I assume this means being hooked up to one of the nodes inbetween the end ...
- 587
46
votes
6
answers
93k
views
Can I detect a MITM attack?
Based on this question here:
Are "man in the middle" attacks extremely rare?
Is it possible to detect man-in-the-middle attacks, and if so, how would one go about it?
In addition, what if ...
- 757
43
votes
7
answers
10k
views
Why is the HTTP protocol more susceptible to being intercepted than the BitTorrent protocol?
I'm downloading an .iso file that is offered through the main website, which recommends users to use BitTorrent. In addition, they offer the download via HTTP using different mirror sites that belong ...
- 869
43
votes
3
answers
33k
views
Why is there no web client for Signal?
I’ve read about E2EE (end to end encryption) of Signal in web clients on a Signal Community discussion forum, and wonder why they say that the browser is insecure for E2EE and native apps are secure.
...
- 547
40
votes
2
answers
11k
views
Did a Huawei modem just try to do a Man-In-The-Middle attack on me?
I have a replica of Huawei B535-333 LTE modem. While I was working from home on my computer I randomly got a security alert saying that certificate for connection with outlook.office365.com was issued ...
- 503
37
votes
1
answer
3k
views
Why are some websites seemingly immune to self-signed certificate MitM attacks?
I recently did an experiment using MitM to gain account information (username and password) while accessing websites. I used two PCs in the scenario; one as the target, running Internet Explorer, and ...
- 473
36
votes
4
answers
10k
views
Why can't a hacker just obtain a new SSL certificate for your website?
SSL is meant to protect your website from a man-in-the-middle attack.
But if someone is able to do that, couldn't that just request a new certificate from a CA and then modify the traffic sent from ...
user28763
33
votes
3
answers
7k
views
For an HTTPS web application, is it worthwhile to encrypt the password before POSTing it, to keep a MITM attacker from harversting it?
Our application has recently gone through penetration testing. The test found one critical security breach, which is essentially:
The problem:
Attacker sets up a WiFi spot.
User enters our site (...
- 655
32
votes
4
answers
5k
views
Can or should whitelisting replace encryption?
I've noticed that there is a third-party webservice we utilize programmatically at my job to transmit somewhat sensitive information and I was surprised to see that the endpoint was only using http, ...
- 475
32
votes
6
answers
5k
views
Is it possible for a name server provider to hijack MX records?
Let’s say:
We buy a domain from http://cheap-unsecure-domains.example.
Then in our control panel at cp.cheap-unsecure-domains.example we configure it to use the Cloudflare service.
We set some MX ...
- 423
32
votes
2
answers
4k
views
Why is Stack Overflow not using HTTPS for all its pages?
Most webpages from Stack Overflow use http even if you are logged in.
Isn't it a security issue?
Could an eavesdropper steal my session and authentication cookie then impersonate me since it's sent ...
- 6,981
29
votes
5
answers
45k
views
How safe is SSL? [closed]
If I got an SSL certificate for my website and use an SSL secured connection (HTTPS), is this safe enough to send my login and password data or should I add some encryption or hashing?
And how safe ...
- 441
28
votes
3
answers
4k
views
Why are developers using embedded user agents for 3rd party auth? What are the alternatives?
I've noticed a trend in mobile and desktop apps in recent years with the advent of OAuth (and it may also affect other frameworks) to request a user to sign up or log in using 3rd party authentication ...
- 331
27
votes
2
answers
6k
views
How is this "captive portal" intercepting and manipulating my HTTP requests?
I sometimes use a free Wifi service to get access to the internet.
Like most/all providers of services like this, this service employs a captive portal. So if you try to make a HTTP request (request a ...
- 757
27
votes
7
answers
15k
views
Safe to make a VPN connection over coffee shop WIFI?
On my work laptop I regularly create a VPN connection that I use to remote desktop to our web server. Is this safe to do on a coffee shop where random people are connected to the same wifi network?
- 8,195
27
votes
4
answers
3k
views
Can a nation-state adversary perform a MITM attack by compelling a CA to issue them with fake certs?
As I understand it, with any encryption system based on a trust chain / CAs (eg SSL, TLS, S/MIME), it would be possible for a nation-state adversary (such as the NSA) to compel the CA to issue them ...
- 484
26
votes
7
answers
6k
views
Why do browsers allow custom root CAs?
At my work all browsers have a custom root CA installed, which then allows them to snoop on all https traffic while the users get the false impression that they are browsing a secure https page.
Why ...
- 394
26
votes
5
answers
4k
views
What prevents a man in the middle from requesting a certificate for your server?
Let's say you have a server at shop.example.com and you are requesting a certificate from some trusted CA like Comodo (they say they'll issue it within few minutes online).
First of all, how can they ...
- 2,287
26
votes
4
answers
2k
views
How can a web application protect users when the browser doesn't support HSTS?
HTTP Strict Transport Security (HSTS) is a very useful feature at preventing OWASP a9 violations and attacks like SSLStrip which try and prevent the client from making a secure connection. This ...
- 47.2k
26
votes
3
answers
7k
views
Bypassing HTTP to HTTPS cached 301 redirect to use SSLstrip
I'm doing some pen. tests on a HTTPS (443) server that does not have HSTS implemented (no HSTS headers on response and the address is not on Chrome HSTS preload list).
The problem is that in my ...
- 361
25
votes
4
answers
6k
views
Is it possible to boot an encrypted server remotely and securely?
Imagine you have a server that is at a location which is not trustworthy. People might have physical access to the machine who are not supposed to look at the data stored on it.
In this scenario I ...
- 672
24
votes
6
answers
33k
views
Possibility to sniff HTTPS traffic on devices without installing a certificate
My goal is to sniff the HTTPS traffic of some digital devices (AppleTV, game consoles, etc.), and decrypt the HTTPS packets in my local network.
I cannot figure out a way by using some HTTPS ...
- 359
24
votes
2
answers
43k
views
Specific risks of embedding an HTTPS iframe in an HTTP page
I need help listing the specific risks of embedding an HTTPS iframe that enables credit card checkout inside of an HTTP page. Are there security issues with embedding an HTTPS iframe on an HTTP page? ...
- 343
24
votes
2
answers
12k
views
Is it safe to disable SSH host key checking if key-based authentication is used?
I have some tasks that go like so:
Spin up some new EC2 instances (Amazon Web Services)
Get them to execute a task
Kill them
The problem is that they're (seemingly) randomly assigned an IP address, ...
- 538
23
votes
9
answers
8k
views
How does one take advantage of unencrypted traffic?
Let's assume an ecommerce site works over HTTP, rather than HTTPS.
What are the practical dangers here? How could an attacker exploit this?
Whenever I read about dangers of unencrypted traffic, it is ...
- 377
23
votes
8
answers
48k
views
Tracking down a rogue access point
Over the course of about a month we have received multiple reports of a rogue access point attempting to intercept traffic. I suspect an attacker is using a wifi pineapple, or similar hardware device....
- 47.2k
23
votes
3
answers
3k
views
Superfish vs. Corporate MITM
I work for a consulting company, and I have been implementing a tool from a security vendor, which is a cloud proxy for all user traffic. It will perform malware scanning and filtering of all web ...
- 1,229
22
votes
6
answers
19k
views
Is it possible for corporation to intercept and decrypt SSL/TLS traffic? [duplicate]
I found there are some companies claim that they offer service that can eliminate SSL/TLS blind spot, such as Blue Coat and Gigamon. Are they talking about some way of decipher the https content (...
- 321
22
votes
4
answers
18k
views
How can I detect HTTPS inspection?
In my company I do use my computer for private things like online banking and personal email during lunch time.
I've always thought that when Firefox shows me the green lock symbol that a valid HTTPS ...
- 221
22
votes
4
answers
9k
views
Options when defending against SSLstrip?
I'm wondering, does anyone have any suggestions to defend against SSLstrip particularly?
- 321
22
votes
2
answers
2k
views
Fully transparent proxy
By default, mitmproxy will use its own local IP address for its server-side connections. What I want instead is mitmproxy to use the client’s IP address for server-side connections.
The following ...
- 321
21
votes
7
answers
9k
views
Is encryption still applied if you ignore the SSL certificate warning for self-signed certs?
Would encryption still be applied on communication with devices using self-signed certificates if you ignore the warning and proceed without installing the certificate? Would you need to install it to ...
- 327