Tag Info

Hot answers tagged

4

The answer also depends on the physical aspect of the network configuration. If your modem or router (or combo) is easily accessible by someone else, it is much easier to eavesdrop through Wifi, although like @VirtualJJ said, the communication is encrypted. Because through the LAN with ethernet protocol the communication can be wide open for anyone to ...


4

Would HSTS be effective if the Proxy's CA is in the trusted store? The public key pinning built into Chrome and Firefox is ignored if the certificate is signed by a CA which was explicitly imported by the user (i.e. trusted but not built in). This is to support the common use case of legal SSL interception in security devices and software, i.e. to ...


4

So I could MITM all https traffic, and spy on my users? No, unless the attacker has the private key for a certificate authority (CA) that is trusted by the user's browser (or intermediate CA that is signed by a trusted CA). A browser does not make requests to a remote certificate authority. Web browsers have a list of trusted certificates of ...


4

As a router, can I send forged certificates, and intercept requests to CA and return responses that they are valid. Yes you could do man-in-the-middle attacks on the router. But you cannot usually do SSL intercepting without the user noticing because the browser warns about invalid certificates. To do interception without these warnings you have to ...


4

To clarify, your question is about detecting a passive sniffer on the wire. Therefore I will not discuss detection of much noisier ARP spoofing MitM attacks. Since a passive sniffer only "reads" packets without responding or modifying them, these is virtually no way to detect it. However, if you know the Ethernet cable length to your next hop, you can ...


3

It does not have to be even this. On the Internet, there are lots of so called fake mailers. One of it is for example Emkei's Fake Mailer https://emkei.cz/ So you will have to be careful until your contact persons will (or their admins will) set up SPF record which will prevent this type of the attack.


3

Yes, as deviantfan has explained, if you do it that way, Bob can see your traffic. A more secure way to achieve your goal is to use the proxy features built into SSH. Add the following to your ~/.ssh/config: Host C ProxyCommand ssh -W %h:%p usera@Bob Note that the -W option was added in OpenSSH 5.4; if you don't have this, you can use netcat instead ...


3

Yes, Bob can see the communication if he wants. Essentially, the second ssh call is executed in a shell on Bob´s computer, similar to someone sitting there and typing on the real keyboard. Bob´s computer must have it (and every input) unencrypted. And the output from the target comes back to Bob, gets "displayed" in the shell of usera, and because of that ...


2

Once C's browser has established that S is a known HSTS host (either via its preload list or by having previously received a valid Strict-Transport-Security header), self-signed certificates and similar security problems produce errors that the user can't simply click through. https://tools.ietf.org/html/rfc6797#section-12.1 So the answer to your question ...


2

You will need to analyse message headers to determine what is going on. Google's Message Header Analyser is here. Using the tool, check the from servers to find out if the emails pass through your contacts' servers or only your own. Also check whether SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) pass - if they do pass, it is more ...


2

A MitM attack may have more than one purpose, it may just be an information gathering project, or it may be an impersonation project. For information gathering purposes just listening to traffic is good enough, and like Steffen mentioned in the comments, setting up a NIC in this mode would achieve the desired result. How to enable promiscuous mode depends ...


2

In an environment like an apartment building, the main threat would be ARP poisoning. There's a variety of tools to detect this threat, better covered in this SE question reply The other, less likely attack scenario would be through a switch that supports dumping all traffic to a monitoring port. This would require a switch that supports this feature ...


2

Ethernet (802.3) and wireless (802.11) are simply communication protocols. How secure they are depends on configuration. How to configure security for both ethernet and wireless will be out of scope for this answer. Out of the box, with no security configuration at all it would be easier to eavesdrop on an unencrypted wireless connection since the person ...


1

Wireless networks are always on, and always open to being cracked. That said, WPA2 with a strong passphrase will be very difficult to break. So, for wireless, it really depends on your settings. Physical ethernet wires are not encrypted, but they have the benefit of being physical: if you can secure the physical ports (and cable modem in your case) so that ...


1

You are absolutely correct, when there is no valid HTTP inside of the SSL encryption, a decrypted flow will not work through a SSL intercept proxy. One of the things you need to do before implementing SSL intercept is that you need to identify SSL based applications that are not http-based to prevent denied access (handling through Whitelist). I can only ...


1

The attacker can still spoof the IP address and use bank's IP address, but the response from your website will go to the spoofed IP address (bank's IP address) and not to the attacker's actual IP address. Usually a TCP handshake is required to initiate a TCP connection. HTTP uses TCP. The attacker will send a SYN packet with spoofed IP(bank's IP), your ...


1

The rg is trying to get you to look at a different page by hijacking the one you were headed to. Similar to the way some WiFi gateways will force a redirect to an auth page by hijaçkong the first thing you try to access on 80 or 443. Att does this fptr different reasons, like when they were pushing bittorrent users to pages trying to promote paid video and ...


1

"No user recourse" RFC 6797, section 12.1 states that the user SHOULD not be presented with a "click here to ignore and proceed" dialog. Now this is a "SHOULD" clause and not a "MUST" clause. In RFC speak this means you are free to ignore it. But urged not to. So if your browser honors the RFC's recommendation, then you won't be able to ignore it. And if ...


1

"Would it be possible for the attacker to change this packet before reaching its destination and modify it telling instead that I´ve got 0 health and then send to the server with modified values" They could intercept and alter the packet easily, but forwarding the altered packet to the server without the server knowing it's come from another user is the ...


1

Yes, it's perfectly possible. The answer is to use encrypted connections, since encryption protocols such as TLS/SSL and SSH will stop the attacker from seeing what's in the packets, and also allow the server to detect and reject any changes from what was sent by the client.


1

I am certainly no expert on NTP, so I can't give you a full answer, but: delorean expects you to specify an interface via its IP address, as opposed to the name that is displayed in ifconfig. This was what kept me busy for a couple of hours when I tried the tool ;) Maybe you are having the same issue?


1

Considering that the code they inject can be anything, one would have to assume that there are risks. Perhaps their code has a vulnerability in it that allows injection. Perhaps it obscures important items on the page. Perhaps it references an external resource (eg: JavaScript) of less security. Who knows? It certainly seems a risk to me. There are other ...



Only top voted, non community-wiki answers of a minimum length are eligible