Hot answers tagged

11

What you are referring to is called a captive portal. It allows WiFi providers to authorise users, get confirmation for service agreement from them, display ads, require payment for extended usage time, etc. Its existence doesn't have security implications in itself (unless it was poorly implemented and leaking user-provided information, but that is on a ...


7

Is it possible to perform MITM on HTTP POST? HTTP is not encrypted, so if you "get in the middle" you can read the communication and modify it. You can get in the middle by e.g. hacking a router or cutting a cable. Your ISP is already in the middle and can read your HTTP communication. This is true for all HTTP methods - POST, GET, etc. Is it possible to ...


5

When you execute: ssh -A -t foouser@bar.com you are establishing a session between desktop and bar.com. From now on, everything you type within this session is interpreted by and executed on bar.com. Then you establish a session from bar.com to server (sls is not a standard command, but I assume it is a wrapper for another SSH connection). You have a ...


3

As a client your basic countermeasure is to use a VPN. Since you don't have a good way to baseline anything about the multitude of Wifi access points you might have to use, your ability to spot a real one vs a Wifi Pineapple is pretty minimal. Your only hope, really, is to immediately route all traffic through a properly authenticated VPN which will resist ...


2

XML Namespaces are just strings in the format of URI's, not actual lookups: XML namespaces provide a simple method for qualifying element and attribute names used in Extensible Markup Language documents by associating them with namespaces identified by URI references. The request never occurs. If you go to http://www.w3.org/1999/XSL/Transform in your ...


2

A MiTM attack refers to the high level concept of intercepting traffic from host A, reading it, and/or modifying it, and then sending it to the original destination B, as if A sent it. The techniques to accomplish this are an entirely different matter. It might entail ARP poisoning, physically tapping a line, DNS attacks, sniffing wireless traffic, or even ...


2

Typically, controls are put in place to prevent "access to any upstream server". This includes: Proper device hardening for routers and switches Properly configured DNS servers Network monitoring solutions to detect MiTM attacks on the local LAN Certificate Authorities (CAs) to verify that the correct cert is used in the SSL handshake with the server You'...


2

You didn't give all the necessary information. It could be that Firefox is just incorrectly configured and does not use the proxy at all. Given that Firefox is setup correctly, which it sounds like, this is what I think is most likely. Firefox tunnels the traffic nicely through SSH, you can verify this by going to a website like whatismyip.com. What does ...


2

PKI Infrastructure provides the means to do this via revocation lists. If you purchase a domain from someone else, or snatch one up that has lapsed, part of that responsibility lies with the purchasing party. They should do their due diligence and contact the CA issuing authority to invalidate any other certificates that are out there. I'm sure there is ...


2

There are commonly two methods of controlling drones. Radio receivers and data transceivers (traditionally telemetry links). This really varies by device, autopilot hardware, etc. Some even use WiFi for everything. Receivers typically are receive-only, and convert received signals into PPM or PWM signals to speed controllers, servos, etc. Transceivers ...


1

In theory, yes. You'd need to disable IP forwarding so the data doesn't pass through the attacking machine. You'd need to forward the client's download request and then intercept the download as it bounces off the attacker. Once you have this file, modify it as you wish and send it to the victim while spoofing yourself as the server. NOTE: This process ...


1

To capture the combinations of IP -> HW addresses for each host, you'd have to put it on each host. (And tally up different outputs; i.e if you have 3 hosts: A, B and C. You want to ensure that both A and B have the same hardware address of C). This may be cumbersome. Typically, though, it would be easier to monitor traffic that leaves the LAN, which is ...


1

Arpwatch won't prevent MITM attacks but will just monitor ARP activity and concerning MITM, the ARP protocol isn't the only way to do a MITM (eg : ICMP redirect, DNS spoofing, port stealing, DHCP spoofing...). But if your goal is to detect host to host ARP poisoning attempts of all your network, yes you have to place an instance on each host. But I think ...


1

Although the captive portal doesn't technically allow anything that an attacker cannot already do with a fake hotspot, it may lure users into a false sense of security. As users expect such a portal, a fake portal can be set up in addition to the fake hotspot. It's likely that users put more trust in such a connection then in just the hotspot itself (their ...



Only top voted, non community-wiki answers of a minimum length are eligible