Tag Info

Hot answers tagged

18

That app (and all MITM proxy apps such as SandroProxy and mitmproxy) work by installing their own trusted CA certificate on the device. That allows them to sign their own certificates which the device will accept. You have to manually install their certificate to the user key-store using a dialogue such as this: After which it displays warnings such as ...


3

To give the good answer from thexacre a broader touch: If the application itself does the certificate checking correctly (not all do, see http://www.kb.cert.org/vuls/id/582497) then an MITM attack is only possible if the attacker is somehow trusted by the owner of the device. In case of an owner which is curious what the application does the attacker is the ...


3

If you notice that someone is actively man-in-the-middling a server the first thing you should do is inform your incident response/security team. They should decide on mitigating controls, that's their task. It's highly dependable on what technology is being MiTM and in what way. It also depends largely on where the MiTM is occuring. Aside from ...


3

It is hard to tell you exactly what is going on because we don't know what request actually triggered the message and you do. What it looks like, however, is that for some reason, a secure request intended for Toshiba's update server went to www.bcrea.bc.ca. There can be many reason for this but few are really encouraging: Something in your DNS resolution ...


2

Setup proper 802.1X authentication / WPA-Enterprise to connect to the network. So each client will have their own credentials and they'll be logged accordingly. VPN could also be set up in the same manner if you need remote access. All of these protocols are designed with security in mind and thus inherently prevents any form of MITM attacks if implemented ...


2

Keep in mind the context here - since it's an interview question, the goal is to assess your understanding of the terminology and concepts. They were probably not interested in some specific tool, or an exact command you would be running (although you might get kudos for knowing something like that). As mentioned in comments, there are MANY specifics ...


2

HTTP is an inherently "trusting" protocol: it contains little or no built-in security. This means that it is susceptible to the following: Traffic monitoring Anything transmitted over HTTP can be intercepted and read by anyone connected to any network sitting between the source device and the target server. Traffic redirection and manipulation With little ...


1

Apart from the technological hurdles of getting a tap on the intercontinental lines that could actually read the data, the scenario you provided is indeed possible. If you use HTTP instead of HTTPS your data is travelling as clear text from end-to-end, so your ISP, anyone inbetween and the ISP of your destination host can read or even modify your data if ...


1

Such a setup can be trusted, since the payment details cannot be extracted by your hacker and the payment details can be verified securely. The thing to watch out for is that a lot of user might not bother to double-check the details on the https page, or if there are 'hidden' paramaters sent along that aren't displayed and verified explicitly.


1

What you're suggesting is completely compatible with the Android TLS framework. When you create a connection to a remote server, you can specify your own trusted CA list. This means that instead of using the default CA store trusted by the OS, for this connection you trust only certificates signed by the CAs you specify, which don't need to be known to ...


1

You're overcomplicating things and reducing security for no reason. Do use SSL¹ — why on earth would you not use it? The whole point of SSL is to avoid MitM attacks. If I understand your protocol correctly: When the application is installed, it sets up a per-device secret key which it shares with the server. You haven't said how — are you going to use SSL ...


1

What you are asking is basically redefining the "common SSL". However, you are basing trust on the server only, whereas in SSL the trust is delegated to a third party. Moreover, in SSL certificates are signed, therefore you can verify their authenticity. So yes, the scenario will be able to prevent MitM attack (in a way), but the user loses some trust in ...


1

This setup is trying to match domains and ssl keys. However, I would start by questioning what are ‘domains’ here why are they important. Could the domain simply be a hash of the ssl key? That way you no longer need the CA. How are the domains assigned? If they are centrally assigned, could the ssl signing be simply provided as one step of the domain ...


1

In light of the broad question I will concentrate on answering your more specific one regarding full access to the centralised server. I'll refer to said server as a CA because this is essentially what you are describing. TL; DR it depends Let's presume that full access means knowledge of the CA's private key. This may not always be the case if we consider ...


1

Snake oil, this is just a glorified Linux live-USB with lots of bold claims to fool naive customers (they advertise it as a silver bullet solution for anonymity and privacy, which is impossible to do by just inserting an USB stick in a machine - does it magically detect hardware keyloggers or compromised firmware?). You can make your own by installing Tails ...


1

If you believe what Google claims here, SSL traffic is not proxied: Is my secure traffic optimized by the compression proxy? No, data compression proxy operates on non-encrypted traffic: HTTPS requests are sent directly from the mobile device to the destination server. That said, I've not hooked up a debugging proxy to snoop the network traffic, ...


1

As you described it, this relay scheme is secure, if the data relayed via the server is properly authenticated and encrypted. The only attack vector I found would be, that an attacker could determine (based on the pairing codes) which 2 clients want to talk which each other, but traffic analysis would have shown this either way. As the API distributes keys ...


1

Would the target URL be aware that multiple SSL Interceptions have happened? In theory the target URL is not aware of SSL interception at all, no matter how many SSL interceptions you do. It only sees that it is doing the SSL handshake with some kind of client and can not see if it is doing the handshake directly with the browser or with some SSL ...


1

If you want to ensure you have your employees taking to you, and not some third party, you need to create a set of keys you distribute securely, and the tool you use depends on both ends having keys. Some few VPNs may do that, but not many. I think ssh can do so.


1

In the first messages between client and server, both send their list of supported algorithms, in order of preference. Then the algorithm that will be used is the first one on the client list that also appears somewhere in the server list. This is specified in RFC 4253, section 7.1: encryption_algorithms A name-list of acceptable symmetric encryption ...


1

There are a few ways that you can detect if you are a victim of a MITM attack, where the attacker has the ability divert traffic and/or to create bogus certificates from a trusted CA. In the case where you are connecting to a host that you've previously connected to, certificate pinning can be used. With certificate pinning, your client stores the ...



Only top voted, non community-wiki answers of a minimum length are eligible