A man-in-the-middle attack (MiTM) is an attack against a communication protocol where the attacker relays and modifies messages in transit. The parties believe they are talking to each other directly, but in fact both are talking to the attacker.
98
votes
8answers
8k views
Are “man in the middle” attacks extremely rare?
In
http://cdixon.org/2012/02/12/the-iphone-contact-list-controversy-and-app-security/
Chris Dixon makes a statement about web security
Many commentators have suggested that a primary security ...
15
votes
4answers
556 views
Credit card forms on HTTP pages a MITM risk?
The other day, there was a web developer mailing list thread about a fundraiser page.
One person noted that the page with the credit card form was HTTP, not HTTPS.
In response, one person said that ...
14
votes
6answers
681 views
Safe to make a VPN connection over coffee shop WIFI?
On my work laptop I regularly create a VPN connection that I use to remote desktop to our web server. Is this safe to do on a coffee shop where random people are connected to the same wifi network?
14
votes
6answers
3k views
Can I detect a MITM attack?
Based on this question here:
Are "man in the middle" attacks extremely rare?
Is it possible to detect man-in-the-middle attacks, and if so, how would one go about it?
In addition, what if ...
14
votes
3answers
2k views
What's an easy way to perform a man-in-the-middle attack on SSL?
I'd like to perform a man-in-the-middle attack on SSL connections between clients and a server.
Assuming the following:
I've got a certificate that the client will accept, via poor cert validation ...
13
votes
4answers
340 views
How to safely synchronize time over Internet?
All modern OS now keep accurate time by regularly synchronizing time over an untrusted network - Internet. Could an attacker conducting a MITM attack, influence or change the time of a computer while ...
12
votes
4answers
2k views
Does TOR Hidden Service Protocol provide more threat protection than a standard HTTPS session?
DuckDuckGo is a search engine that has a TOR Exit Enclave. This site is focused on the safe, secure searching of its users.
Since DNS is not used in TOR, it appears that HTTPS is less secure due to ...
11
votes
4answers
352 views
How can a web application protect IE users when this browser doesn't support HSTS?
HTTP Strict Transport Security (HSTS) is a very useful feature at preventing OWASP a9 violations and attacks like SSLStrip which try and prevent the client from making a secure connection.
My ...
11
votes
6answers
2k views
Why is ARP poisoning killing all network activity?
Using ettercap and ARP poisoning, I was able to eavesdrop on other connections, but suddenly I was unable to make any connection to the Internet. To restore Internet connectivity, I had to restart my ...
10
votes
9answers
6k views
Tracking down a rogue access point
Over the course of about a month we have received multiple reports of a rogue access point attempting to intercept traffic. I suspect an attacker is using a wifi pineapple, or similar hardware ...
10
votes
2answers
769 views
How might the U.K. Government's proposed internet surveillance equipment “bypass” encryption?
http://www.channel4.com/news/black-boxes-to-monitor-all-internet-and-phone-data
http://rt.com/news/uk-privacy-internet-freedom-186/
'Black boxes' will be installed by internet services providers ...
10
votes
1answer
506 views
Is Nokia's “institutional MITM” of SSL traffic vulnerable to CRIME attack?
It's recently been in the news that some Nokia phones proxy all traffic, including SSL connections, through a Nokia proxy. This is effectively an "institutional MITM" attack on users those phones.
...
8
votes
3answers
638 views
Preventing a spoofing man in the middle attack?
I was humming along with my usual routine of listening to old Defcon videos trying to understand some of the basics of what's going on in the IT Security world, when I came across one explaining man ...
8
votes
5answers
232 views
How do RSA fingerprints protect from MITM attacks?
I understand that RSA fingerprints are used to verify that you are really connecting directly to who you want to connect to, and not someone else posing as that site.
Like when you do a git push, it ...
8
votes
3answers
289 views
How practical/important is the Lucky Thirteen TLS attack?
I was reading this article which talks about a new attack against TLS being called Lucky Thirteen. It claims to allow repeatable MitM attacks against HTTPS connections.
It's described as being fairly ...
8
votes
4answers
2k views
Options when defending against SSLstrip?
I'm wondering, does anyone have any suggestions to defend against SSLstrip particularly?
7
votes
5answers
2k views
Does HTTPS Everywhere defend me against sslsniff-like attacks?
http://www.thoughtcrime.org/software/sslsniff/
If I have a domain on my HTTPS Everywhere list, so that theoretically it could be only visited via an HTTPS connection in my Firefox, then could an ...
6
votes
4answers
292 views
Man-in-the-middle scenario for TLS
Consider the following scenario: You want to securely communicate with a.com and you only trust the VeriSign root certificate.
a.com presents a certificate signed by VeriSign with CN=a.com, so you ...
6
votes
2answers
241 views
How to hack a switch connected network with static ARP?
For example, if there is a network with three computers connected to the same switch, Alice, Bob, and Eve. If Alice and Bob add each other on their own ARP list as a static ARP entry, and Eve wants to ...
6
votes
3answers
93 views
How to fuzz proprietary protocol over SSL?
I'm doing vulnerability research on a client/server architecture that uses a custom proprietary protocol sent over SSL (port 443). I need to be able to intercept the traffic, and be able to view it in ...
6
votes
1answer
81 views
Are there any situations when one can only mount a passive MITM?
This came up while discussing Web & insecure HTTP - Using RSA for encrypting passwords on the client side
Is there any such situation possible when requesting an HTTP page where an attacker is ...
6
votes
1answer
53 views
public key distribution from a central server
I'm trying to code up a encrypted communication program. Originally I was thinking that I would use public key cryptography and then I would keep the public keys in a database where users could query ...
5
votes
5answers
2k views
How would one fully protect himself against man in the middle-attacks?
Imagine I have a computer where all the trafic is being sent through the MitM. How would it be possible to have a secure connection through this setup?
In this case it would be OK to design a new ...
5
votes
3answers
286 views
Is it possible to “protect” against MITM attacks over HTTP?
In a conversation on twitter I warned a site about a security vulnerability. Specifically, the possibility of a MITM (Man in the Middle) attack used to compromise their registration form.
The ...
5
votes
3answers
921 views
How do I check that I have a direct SSL connection to a website?
I always thought that if I had an SSL connection there would be no MITM attacks. Now it appears that isn't true (see comments in this question Is it okay from a security perspective to read foreign ...
5
votes
3answers
940 views
Best tool for testing an SSL connection in my application
I have developed an application that send binary data between a .NET client and Java server via TCP.
I have recently implemented SSL for this connection and would like a way to demonstrate that it is ...
5
votes
2answers
190 views
Is it safe to sync private keys between iOS devices using iCloud?
My iOS app has to handle storing private keys for the user. Normally I would just use Keychain Services for this as I would a password, but it would be great if I could sync the keys between the ...
5
votes
4answers
755 views
MiTM - Non-HTTP TLS
I'm doing some research into the privacy of various iOS applications. My main source of data is via wireshark or Burp (HTTP/S proxy). This has been rather sucessfull for MiTM for decrypting HTTPS ...
5
votes
2answers
4k views
How to thwart sslstrip attack?
I need help understanding the dynamics of an sslstrip attack. I'm using it to test the security of a site that I own. I can successfully sniff the victim (in this case, myself) credentials over the ...
5
votes
3answers
116 views
Man in the middle attacks for Out of band Authentication
I was researching on methods to avoid man in the middle attacks. I thought of using out of band authentication but i read the wikipedia article on the same topic which goes as follows:
"In ...
5
votes
1answer
4k views
How to spoof a cell phone tower (cell site, base station) — homemade IMSI-Catcher
An answer to a recent question has given me an idea for a school project (security CS program).
Also, an active attacker (with a fake base station) can potentially force a mobile phone to use ...
4
votes
2answers
1k views
arp spoofing protection on LAN
I am a network administrator in company. I read this article eject any wifi device from network with android
Some of employers are using mobile phones and company`s wireless network. Theses employers ...
4
votes
1answer
675 views
DNS MITM Remote Attack
I guess this is not considered a true MITM attack since the attacker does not have to be between the server and client. My question is how it is possible to poison a DNS cache, and redirect traffic to ...
3
votes
3answers
276 views
How do a VPNs route SSL traffic and do they compromise security?
If my understanding of how VPNs operate is correct, all traffic between me and the Internet at-large is routed through the VPN's servers. So an attacker would only be able to see encrypted traffic ...
3
votes
5answers
149 views
Can SSL requests be proxied by issuing a second certificate?
Alice wants to login to her account at https://www.bobsbank.com/. However she clicks on a malicious link in an email and instead gets sent to the malicious site https://www.charliesbank.com/. The ...
3
votes
2answers
139 views
Are Windows Updates susceptible to tampering, eg. using a MiTM attack.
My real question is how are patches and updates authenticated in general. But for example how does windows know a windows update is really a windows update, does it just trust the URL or is there some ...
3
votes
2answers
292 views
MX record Man In The Middle Attack?
In theory it should be possible to change a MX record of site A (aspmx.exampleA.com) to site B (aspmx.exampleB.com) and send the mail back to site A (aspmx.exampleA.com)
So you can intercept all the ...
3
votes
4answers
407 views
How to “demonstrate” man-in-the-middle attack?
I'm TAing a particular course on system security. A specific example is transitting the password in plain text when developing a web application (as part of a class project).
Over the years a bunch ...
3
votes
2answers
135 views
In practice, does crypto software accept a *.com or or even a *. certificate?
Assuming this will be done with your own PKI, and not a public trusted CA.
Considering that *.sub.domain.com is valid, and so is *.domain.com is valid, is it technically possible to issue *.com and ...
3
votes
1answer
88 views
MITM and replay attacks prevention
I have a client (a mobile app) and a server, the app connects to the server via SSL.
The server uses a self-signed certificate, and the client has a file (I'm not entirely sure what, something to do ...
3
votes
3answers
598 views
Is there a method to detect an active man-in-the-middle?
Suposing an attacker that has gained access to the router. Is there a way, for the victim, to notice that is being attacked?
I think one of my friends is a victim of this kind of attack. How can I be ...
3
votes
2answers
264 views
Mitigations for Windows clients that don't support OCSP Nonces
Windows 7 clients (and older) don't support NONCES, a key feature used in securing the revocation check. Without a NONCE a MITM could replay a previously signed response and alter the validation of ...
3
votes
2answers
161 views
Unencrypted data over Magnetic Card Reader. What are the security risks?
I am working on evaluating the security of my University's student id card. The ID card contains both a magnetic stripe and a RFID component and is used to make payments as well as to provide access ...
3
votes
1answer
69 views
SSL Based Denial of Services due to Message Digest
On a very high level, its known that SSL/TLS uses message digests to verify the integrity of the messages sent.
However, the question I have in mind is :
How does SSL ensure a DoS does not happen ...
3
votes
2answers
498 views
How can end-users detect malicious attempts at SSL spoofing when the network already has an authorized SSL proxy?
I'm working on one client's network where they have enabled HTTPS authority spoofing on their proxy. This allows them to effectively perform a man-in-the-middle attack to decipher all outgoing ...
3
votes
2answers
108 views
Two-way secure communication using two pairs of public/private keys?
Let's say I want to create a protocol to securely communicate between two endpoints - each of the two endpoints know the other's public key and all data exchanged is encryted using one's public key ...
3
votes
1answer
57 views
How is the TLS protected against length field of the header being modified?
I know this question looks very silly, but, it has been bothering me for a while and I am unable to come up with an answer by myself. So, here it goes..
Packets in the TLS protocol consist of a 5 ...
3
votes
2answers
352 views
How do I block LinkedIn from extracting data from Microsoft Exchange Server?
LinkedIn now offers the ability to take a real user and password from the end user and connect to Exchange Server for the purpose of importing contacts into their system. (To do this yourself, click ...
3
votes
1answer
164 views
Is it possible that my home router is preventing my ARP poisoning attack?
As part of a school project I am trying to do a MITM attack on my local network using ARP poisoning. I choose a target and then I send a spoofed ARP packet to it and to the router every 100 ...
3
votes
1answer
119 views
How can I use certificates to secure my webservices? What is available to javascript?
I have a few web services that are accessed over public wifi connections and I think it would be a good idea to issue certificates to encrypt data, prevent MITM, and invalid impersonation (beyond what ...
