Tag Info

Hot answers tagged

18

That app (and all MITM proxy apps such as SandroProxy and mitmproxy) work by installing their own trusted CA certificate on the device. That allows them to sign their own certificates which the device will accept. You have to manually install their certificate to the user key-store using a dialogue such as this: After which it displays warnings such as ...


8

You just need to add the tool certificate in the trust store of the client, so that the client trust your "tool as a server". Then in order not to have any errors, every time the client tries to open a TLS connection, you have to clone the actual cert with your custom CA: Client tries to initiate connection with the server, it goes through your proxy The ...


3

Did you take a look at this answer? There are a few tools listed. However the key point for you is to have a certificate that your client will accept. To answer your question, in its simplest form you need: A valid SSL certificate (signed by the CAs that are trusted by the client) Control of DNS resolution (but if you control the environment you'd have ...


3

To give the good answer from thexacre a broader touch: If the application itself does the certificate checking correctly (not all do, see http://www.kb.cert.org/vuls/id/582497) then an MITM attack is only possible if the attacker is somehow trusted by the owner of the device. In case of an owner which is curious what the application does the attacker is the ...


3

It is hard to tell you exactly what is going on because we don't know what request actually triggered the message and you do. What it looks like, however, is that for some reason, a secure request intended for Toshiba's update server went to www.bcrea.bc.ca. There can be many reason for this but few are really encouraging: Something in your DNS resolution ...


2

If anyone trace the requests and responses, Can he get the token from headers? If an attacker is in a suitable position to perform a MitM (Man in the Middle) attack and is able to intercept and view the requests, then yes, they can get the token from headers. To prevent this, make sure that the REST service in use is using SSL/TLS. This will prevent ...


2

Setup proper 802.1X authentication / WPA-Enterprise to connect to the network. So each client will have their own credentials and they'll be logged accordingly. VPN could also be set up in the same manner if you need remote access. All of these protocols are designed with security in mind and thus inherently prevents any form of MITM attacks if implemented ...


2

HTTP is an inherently "trusting" protocol: it contains little or no built-in security. This means that it is susceptible to the following: Traffic monitoring Anything transmitted over HTTP can be intercepted and read by anyone connected to any network sitting between the source device and the target server. Traffic redirection and manipulation With little ...


1

Apart from the technological hurdles of getting a tap on the intercontinental lines that could actually read the data, the scenario you provided is indeed possible. If you use HTTP instead of HTTPS your data is travelling as clear text from end-to-end, so your ISP, anyone inbetween and the ISP of your destination host can read or even modify your data if ...


1

Such a setup can be trusted, since the payment details cannot be extracted by your hacker and the payment details can be verified securely. The thing to watch out for is that a lot of user might not bother to double-check the details on the https page, or if there are 'hidden' paramaters sent along that aren't displayed and verified explicitly.


1

As you described it, this relay scheme is secure, if the data relayed via the server is properly authenticated and encrypted. The only attack vector I found would be, that an attacker could determine (based on the pairing codes) which 2 clients want to talk which each other, but traffic analysis would have shown this either way. As the API distributes keys ...


1

Would the target URL be aware that multiple SSL Interceptions have happened? In theory the target URL is not aware of SSL interception at all, no matter how many SSL interceptions you do. It only sees that it is doing the SSL handshake with some kind of client and can not see if it is doing the handshake directly with the browser or with some SSL ...


1

If you want to ensure you have your employees taking to you, and not some third party, you need to create a set of keys you distribute securely, and the tool you use depends on both ends having keys. Some few VPNs may do that, but not many. I think ssh can do so.


1

What you're suggesting is completely compatible with the Android TLS framework. When you create a connection to a remote server, you can specify your own trusted CA list. This means that instead of using the default CA store trusted by the OS, for this connection you trust only certificates signed by the CAs you specify, which don't need to be known to ...


1

You're overcomplicating things and reducing security for no reason. Do use SSL¹ — why on earth would you not use it? The whole point of SSL is to avoid MitM attacks. If I understand your protocol correctly: When the application is installed, it sets up a per-device secret key which it shares with the server. You haven't said how — are you going to use SSL ...


1

What you are asking is basically redefining the "common SSL". However, you are basing trust on the server only, whereas in SSL the trust is delegated to a third party. Moreover, in SSL certificates are signed, therefore you can verify their authenticity. So yes, the scenario will be able to prevent MitM attack (in a way), but the user loses some trust in ...


1

This setup is trying to match domains and ssl keys. However, I would start by questioning what are ‘domains’ here why are they important. Could the domain simply be a hash of the ssl key? That way you no longer need the CA. How are the domains assigned? If they are centrally assigned, could the ssl signing be simply provided as one step of the domain ...


1

In light of the broad question I will concentrate on answering your more specific one regarding full access to the centralised server. I'll refer to said server as a CA because this is essentially what you are describing. TL; DR it depends Let's presume that full access means knowledge of the CA's private key. This may not always be the case if we consider ...


1

Snake oil, this is just a glorified Linux live-USB with lots of bold claims to fool naive customers (they advertise it as a silver bullet solution for anonymity and privacy, which is impossible to do by just inserting an USB stick in a machine - does it magically detect hardware keyloggers or compromised firmware?). You can make your own by installing Tails ...


1

If you believe what Google claims here, SSL traffic is not proxied: Is my secure traffic optimized by the compression proxy? No, data compression proxy operates on non-encrypted traffic: HTTPS requests are sent directly from the mobile device to the destination server. That said, I've not hooked up a debugging proxy to snoop the network traffic, ...



Only top voted, non community-wiki answers of a minimum length are eligible