Hot answers tagged man-in-the-middle
78
My favorite current resource for cold, hard, real world data is the Verizon 2011 Data Breach Investigations Report. An excerpt from page 69 of the report:
Actions
The top three threat action categories were
Hacking, Malware, and Social. The most common
types of hacking actions used were the use of
stolen login credentials, exploiting ...
19
Yes, that last someone is correct, in addition to encryption (confidentiality) HTTPS gives you the assurances that the form is coming from where you think it is (authentication), and that it has not been interfered with in transit (integrity). Without HTTPS the form could be modified by a MITM as described.
It'sNot using HTTPS for this is simply bad ...
18
The simple answer is no - there is a wide variety of evidence that this type of attack is common.
Some of the controls brought in by banks (two factor authentication etc) were in part required to combat the ever more common MITM attacks on customers.
While there are other forms of attack (compromise of client is a good one) which may now be easier to carry ...
14
The short answer is: No, not always. I have studied this topic in depth and please read this entire post before forming a conclusion.
SSLSniff is a proof of concept exploitation platform to leverage flaws in the PKI, such as vulnerabilities in OCSP or the (ingenious) null-prefix certificate attack. If you are using a fully patched system, and you ...
12
ARP spoofing usually works by fooling all the clients into thinking that you're the router, by faking the ARP responses that translate IP addresses to MAC addresses. When clients receive the ARP response, they remember the MAC that was associated with the IP.
Once you stop the application that's handling the man-in-the-middle part of the operation, the ...
12
Yes, a VPN connection encrypts the connection between your computer and the remote VPN host. The connection would just look like gibberish to anyone sniffing the traffic, either in the coffee shop or on the Internet. It is worth noting that the same applies to any content sent over HTTPS even if you aren't using a VPN.
It is also worth noting that if you ...
12
A router misbehaving and trying to act as a fake server with regards to the client, and a fake client with regards to the true server, forwarding data in both directions, is the exact definition of a man-in-the-middle attack. Apart from routers (which act at the IP level), classic practical methods for MitM include:
hijacking a HTTP proxy
subverting the ...
11
Products which purport to be able to filter SSL-encrypted traffic usually do so by doing a man-in-the-middle attack, just like an active attacker would do. The "security product" sits on the Web proxy, through which the connection is performed. It intercepts the flow, and generates on-the-fly a custom certificate with the name of the target site; the client ...
10
Here are my recommendations for what users can to defend themselves against SSLstrip, Firesheep, and similar attacks:
Install HTTPS Everywhere or ForceTLS. (HTTPS Everywhere is easier to use.) This tells your browser to use the SSL versions of web sites, where possible.
If the browser gives you a certificate warning, do not bypass the warning, and do not ...
10
They will get a CA that is in the CA root zone for all browsers to issue them valid certificates. This CA will probably be a UK based company. Spying will be completely transparent to the users. Browsers will show no warnings. This will work for a few days, until it is detected by the public at which point browser vendors will revoke the root certificate of ...
10
Full-fledged NTP implementations only allow a limited skew. For example, the de facto standard (formerly ISC) implementation on Linux will not deviate from the local clock by more than 1/2000 by default (a bit less than one minute per day). Hence an attacker cannot cause a huge clock deviation with such an implementation. In a typical site-wide or server ...
10
Updated:
For HTTP you can use Burp Suite's proxy (Java), or mitmproxy.
tcpcatcher is a more general Java-based capture and modify proxy which might be closer to your requirements, it includes content decoding and modification (manual and programmatic). It's HTTP biased, but accepts any TCP. It has SSL support, though the only drawback seems to be ...
9
The way that SSL and TLS work is that there is some way to provide authentication for at least one side.
Normally the server has a private key where the client has the fitting public key (or, more usually, some root public key of a certificate chain which certifies the public key of the server). Alternatively, also some password-based authentication methods ...
9
You can't.
The best you can do is to use SSL sitewide. Have all HTTP connections immediately redirect the user over to HTTPS (redirect over to the front page via HTTPS, e.g., http://www.example.com/anything.html should redirect to https://www.example.com/). Don't serve any content over HTTP (other than an immediate redirect to your front page, over ...
8
The recent compromise of certificate authority DigiNotar resulted in the issuance of over 500 fake certificates for google.com, microsoft.com, cia.gov, and hundreds of other sites. These certificates somehow made their way into 40 different Iranian ISPs, resulting in a massive man-in-the-middle attack, confirmed to have affected over 300,000 Iranian users ...
8
Rather than "bypass" encryption, they can spoof the identity of the server, so as to perform a MITM attack (effectively).
Encryption itself is only one part of the configuration when setting up an SSL/TLS connection: this ensures the confidentiality of the communication between the client and the server. Before that, the client needs to verify the identity ...
8
WPA2 is the only secure method. WEP and WPA are "broken". Also, WEP is easier to crack than WPA. However, any security, even WEP, is better than no security as it will effectively prevent opportunistic connections to your network.
I just checked and indeed the new Mac Books Pro don't have an Ethernet port. All I can say is WTF?!?
8
A man in the middle could easily manipulate the post target, so it doesn't point to the secure HTTPS url anymore. The user cannot see whether the target is secure (without looking at the HTML code), so he just has to believe that the POST target is secure.
This scheme of an unsecure HTTP form calling a secure HTTPS url, is always vulnerable to SSL-strip.
8
To really protect against man-in-the-middle attacks, you have to:
apply some kind of integrity check on all exchanges between client and server;
enforce at least one-way authentication (the server must authenticate the client, or the client must authenticate the server).
Basically, doing what SSL does. In a Web context with plain HTTP, the client is ...
8
They are doing post submission over SSL. This will provide protection against a passive MITM since the credentials would be encrypted on the post back, however, it does effectively nothing against an active attacker that is able to alter traffic since they could simply alter the postback URL and the user experience would not change.
A smart client could ...
7
"HTTPS Everywhere" is only about using SSL whenever it is possible -- i.e. automatically using the SSL version of a site if it exists, even if the link you typed or followed is for the non-SSL site of the same name. That's all "HTTPS Everywhere" does.
"sslsniff" is an attack tool to hijack SSL connections. It requires two things:
A way to intercept ...
7
The general ways that a rogue access points are found:
An enterprise wi-fi access point spends some of its time not just serving clients, but listening on various channels for other wi-fi traffic. (This works best for the 2.4Ghz band where there are fewer channels. Fortunately this is also where most run-of-the-mill, non-targeted attacks are going to be. ...
7
While browsing, you can check every time if the certificate that is presented to you by the website is issued by a legitimate CA or its a fake certificate issued by some CA that your browser trusts. Obviously it is not possible do it manually. So, there are tools that do it for you.
Cert Patrol and Perspective are browser plugins that do essentially that. ...
7
Openssl ships with a tool called "s_client" that can be used to test SSL servers. This is available for *nix, cygwin, and Win32.
Sample Usage
$ openssl s_client -connect servername:port -CAfile /path/to/ca.pem -debug -showcerts
There are a myriad of options such as -pause, -state, etc. which you may find useful for tracking SSL through its setup and ...
7
Eve could sign a certificate stating "a.com" as name, with her private key, but Bob's browser will not accept it. When Bob's browser validates a certificate chain, it verifies all signatures, but not only the signature. The complete validation algorithm is intricate; see the standard. In this case, Bob's browser will raise a metaphorical eyebrow when ...
6
In the system used by Nokia, the Nokia server runs a man-in-the-middle attack (Nokia denies it because they really do not like the term "attack", but this is still, technically, a MitM). Their servers obtain, even so briefly, the decrypted data. Therefore, if Nokia is the attacker, then Nokia wins, and has no need of playing elaborate games like the CRIME ...
6
I point you to this particular blog post by Matthew Green which gives a good description of the attack. In particular this quote.
But there's no way this will work on TLS! It'll kill the session!
Please recall that I described this as a practical attack on Datagram TLS (DTLS) -- and as a more theoretical one on TLS itself.* There's a reason for this.
...
6
When the attack was first described in 2003 (the "bad padding" oracle through timing analysis), the intended attack scenario was an email client (e.g. Outlook Express) which connected regularly (e.g. once per minute) to the server to know whether some new mail has arrived (you cannot be notified of new mail when using the POP protocol; you have to poll). ...
Only top voted, non community-wiki answers of a minimum length are eligible
