Hot answers tagged

4

Because there is no encryption over the wifi connection between your device and the xfinity gateway you are vulnerable to a man in the middle attack at the least! Additionally, xfinity public wifi does not allow VPN connections which severely limit the security you could hope to give yourself. It is considered a breach of ToS as seen here. My advice is to ...


4

[Disclaimer: I'm one of the mitmproxy authors. My opinions may be biased. :)] sslsplit sslsplit is a transparent proxy that can intercept TLS connections using a man-in-the-middle attack. sslsplit supports plain TCP, TLS and also HTTP to the extent that it removes HPKP, HSTS and Alternate Protocol response headers. Intercepted connections can be dumped ...


3

The list of nodes provided by the authorities is signed by all 8 authorities, the public keys of which are embedded in the tor client. You could prevent the client from booting, but it won't accept your list of nodes. (https://www.torproject.org/docs/faq#KeyManagement) : Coordination: How do clients know what the relays are, and how do they know that ...


3

There is an in-depth analysis of the security of SAML in the PhD thesis of Thomas Gross (Bochum): http://www-brs.ub.ruhr-uni-bochum.de/netahtml/HSS/Diss/GrossThomas/diss.pdf His analysis led to the revision 2.0 of the SAML standard. It is very clear that certain communications have to be encrypted to keep the protocal secure, and that you need to know that ...


2

The act of setting up an evil twin is not sniffing, but the generally accepted definition (CISSP) is that the purpose of the evil twin attack is to harvest credentials, etc. It might also be argued that the evil twin attack is not strictly a sniffing attack if the attacker only uses it to DoS the people on the network.


2

This question, and this exact scenario, actually came up on Serverfault a few months ago. See http://serverfault.com/questions/744147/can-someone-using-the-same-dns-server-as-me-hijack-my-domains


2

Assuming that you control both the app and the server, the best strategy for preventing MiTM in mobile apps is to always require SSL and use certificate pinning. Certificate pinning forces your application to only accept a specific cert. This will prevent an MiTM even against an attacker who has obtained an illicit but valid cert for your site.


2

One way that an attacker can pull-off a MITM attack in a place where public wifi is available (like a hotel) it to create a fake wifi hotspot, which uplinks to the hotel's wifi. Then, the attacker can use a tool like sslsniff to intercept SSL connections. Edit: To protect against a MITM attack, the client should check that the server's certificate (or the ...


2

I'm assuming that they either need to be on the same network as the sending or receiving end of the email. There are lot more possibilities: In the sending or receiving network. This vector could be mostly eliminated when sending/receiving the mail with TLS, at least if the certificates are correctly validated (which is mostly the case in this step of ...


2

It's not really related to Active Directory or Group Policy. That's just one way to do it. If someone can install their own root cert in your trusted store(s) then they can issue fake certs and everything thing looks legit. See Charles Proxy. One legit use for this is to allow tools like Snort to monitor encrypted traffic on a network. Some applications ...


2

This got me thinking, if I was on a public network somewhere, could they issue their own certificate making it appear trusted, and therefore giving me a green padlock on my bank site for example? Yes. does it appear trusted because of a group policy telling the PC to trust the cert? Yes. (Or some other mechanism telling the PC to trust the cert. ...


2

I saw in that article and in many other places (including security.stackexchange), that if the user installs a certificate of an unknown 3rd party. That 3rd party can exercise MitM attacks in other apps of the device. If you install a certificate for a certificate agency (not a certificate for a site) then you effectively trust the certificate agency ...


1

I.e without access to others computer. I'm assuming that you mean that A cannot access the computer of B and B not of A, but they can access other computers on the internet. Since information are not exchanged directly between parties but involve multiple hops there are several ways to intercept the data. Just to give you an idea what can be done here ...


1

During the session initiation, through the signaling channel, the peers (two or more) are sharing information about their environment in order to create the stream. You expose not only yourself (aka your application), but also your users by not using a secure connection.


1

I would guess because you are arp spoofing the gateway IP address. Therefore when your victim navigates to https://192.168.1.5, their traffic is going directly to 192.168.1.5 and not via the spoofed internet gateway (local traffic does not require the gateway). With ARP spoof, enter 192.168.1.5 as the last command argument intead of the gateway IP, and it ...


1

No, it isn't a silver bullet, for example: You are using static ARP entries. This will completely mitigate the risk of ARP spoofing. You are using encryption and you are using it properly. The bad guy can sniff your traffic, but he can't do anything with it.


1

It highly depends on the kind of data you offer for downloading and what kind of trust relationship there is between the user and your site. Just take a closer look at what HTTPS offers and what not: It offers some kind of privacy through encryption. If the data are already encrypted by other means then you don't need another layer of encryption. If the ...


1

I'm assuming that you are talking about session in the context of a web application, i.e. not the TCP session or TLS session but an authorized session of a web application. This one is usually maintained by a cookie and often all what you need to hijack the session is to have access to this session cookie. Access to this session cookie can be done with a ...


1

Session Hijacking can also hijack a session that has already been established. And you're right, all you need is the packet, and not to be in the middle of the flow. For instance, if the session management is improperly configured, you could reestablish the same session if the user disconnects from the server. Perhaps what you are reading is making a ...


1

While I am not sure exactly how DigitalOcean handles it, as their code is proprietary, if I were to design a similar system I would only allow the domain to be in the system exactly one time. If someone did try to register it again I would not allow it. However, if the domain is really theirs, they could contact support and prove it. After proving it to ...


1

There is no legitimate way for an unauthorized eavesdropper to access those specific packets. So let's break it down: Make it legitimate. Eve* could ask Alice or Bob for those packets. Authorize it. Eve could be a law enforcement officer, and request the network provider to deliver copies of those packets. Be less specific. If Eve is a thief who just ...


1

WAP2 only secures the wifi against outsiders. Once you are in the inside, e.g. using the service, your transmission medium is considered trusting, and it is up to the other layers to use other means of security and/or encryption. Or put otherwise, the encryption done at WPA2 only is effective for who is kept outside the network. Regular spoofing attacks ...



Only top voted, non community-wiki answers of a minimum length are eligible