New answers tagged

0

The Electronic Frontier Foundation (EFF) publishes a secure messaging scorecard. For the messaging applications it covers, this should give you some idea of the broad classes of attack to which they are vulnerable. For example, when the EFF reviewed Mxit, the EFF found that Mxit did not encrypt messages in transit. That means an attacker would potentially ...


1

This could be a browser intelligence as well. Try browsing https://google.com in Chrome when Fiddler is on and decrypt https traffic option selected. The browser stops sending request saying - your connection is not private.


-1

UPDATED QUESTION: well this is moot. If you do a FULL MITM attack then there's nothing else to be done there. You have full control of the communication to the server. Even the in browser store won't work. You have FULL control if you've intercepted the created session in its entirety. At this point the browser is securely talking to you, and on it's behalf ...


1

I don't believe this would provide any more protection then the normal double submit cookies. If an attacker can overwrite one cookie using an unsecured (https) subdomain, they could just as easily overwrite 2 cookies. The attacker in the senario would get a legitimate token and signed token value, they would embed both of those in the request, and write ...


1

The problem with naive double submit is that if the attacker could insert an attacker controlled cookie he could also set the CSRF token to this cookie and this way defeat the CSRF protection - because token and cookie match. This can be defeated if the attacker is not able to create a CSRF token and guess the matching verification cookie. This can be ...


2

Yes, a https connection (TLS/SSL) will be secure against snooping by your VPN provider, although they will know the IP address of the website you're connected to, so they will be able to run reverse DNS and likely at least figure out what domain you went to.


1

You can run a local machine as the web proxy and point all others to use that for all http traffic. Squid is one option. Another option is to setup one machine to be the DNS server, e.g, using bind. You can then collect all the DNS logs. You can set up your router to give this local DNS machine as the primary DNS server via DHCP. Another way (albeit the ...


2

OS detection goes a lot further, using all kind of data of the IP and TCP headers fields. If you're into reading, "Silence on the Wire" by Michal Zalewski addresses a lot on this topic.


1

Properly validating a certificate is a really complex matter. As with many things in crypto, it's best to leave this validation to a library instead of trying to implement it yourself. Typically, you'd ask your library to perform all the hard work and then check for any additional properties you are interested in afterward. As for the details: First, you ...


0

Whitelisting is technically narrowing the possible threats to you to the ones that actually target you specifically. By denying large amount of more general threats through whitelisting you can let your encryption work on full power against a much smaller chunk of threats that can go through whitelisting.


1

And you should make a lot of checks about the cerificate genuinity, i.e. to avoid MitM or false-issued certificate by "so-called stolen" CA key. Take a look and star at Perspectives Project to have a full picture


3

When talking about security (in general), it is important to think about what problems you are attempting to solve, and what tools you are using to solve them. These have to align. If the problem you are attempting to solve is general attacks from the internet, then whitelisting may be a useful tool - to overcome whitelisting, you have to be somewhere on ...


13

If the data is unencrypted, anyone sniffing the packets between your server and their server can see it. A whitelist only lets their server verify that the source of the data. It doesn't assure that no one sniffed it during transfer, or that it wasn't intercepted and manipulated at any point during the process. In short, encrypt the data, keep the whitelist ...


64

The sniffing problem is about "confidentiality", which whitelisting does not cover, as the traffic can be intercepted and read. The MitM problem is about "authenticity", which whitelisting does not cover either, as an intercepted packet can be modified without evidence of tampering. I assume the whitelisting uses IP addresses, which can be arbitrarily ...


0

There are three flags in a DNSSec packet that are responsible for communicating the validation requirements of a domain. The DO bit The DO bit is set by the resolver to indicate that it requires authentication Resource Records to be included in the response. If a resolver is security aware, it MUST set the DO bit. If a Name Server gets a message without ...


0

Based on this question and its answer, you have to do the following: remove iptables entries. arpspoof -i wlan0 -t 192.168.2.117 -r 192.168.2.254 arpspoof -i wlan0 -t 192.168.2.254 192.168.2.117 notice the -r flag.


2

BGP hijacking is real and there are enough and easy to find reports in the internet, like this one or this one or this one. But of course you need to be at the right place to do it. Simple from your DSL connected system is not possible but you need to be at the level of ISP's which actually participate in BGP routing. Though you can still play with the ...


1

Wireshark alone does not do that, it can only watch the traffic if you already have knowledge of the keys/certificates in order for it to decrypt the traffic in the TLS connection. There is a type of proxy, a transparent proxy, that applications have to use because they sit on port 80/443 of the gateway and simply intercept all traffic. This would be the ...


-2

SSLStrip+ works without deleting browser data too. The script needs a fake DNS server to work, in fact modifying DNS queries you have an huge possibility to bypass HSTS. So you don't need to clear your data. Also HSTS depends on the HTTP request header, so for example when you navigate to Google you make a GET request and the response header says to the ...


1

To circumvent the proxy problem, there is ARP spoofing available. MiTM the ssl, there's sslstrip. There are loads of tutorials on how that works. If however the certificate gets validated, you will be out of luck. As Steffen pointed out in the comments, there is no way to make wireshark - being a passive sniffer- sniff active. Yet, the tutorial I linked ...


7

Assume, you have a girlfriend, and you saved her number as GF in your phone. And in the same way, your girlfriend saved your number as BF in her phone. Now an attacker X, manages to gain access to your phone, and change your GF number as his number. In the same way, he manages to gain access into her phone and changes your number as his number. So the ...


36

There are many, many ways you can become a MITM, virtually at all layers of the networking stack - not only the physical one. Being physically close to your target can help, but is by no means a necessity. At the physical layer, the attacks you can get are very overt: splice a ethernet cable, use a optical tap, or capture radio signals. A passive ...


2

You seem to have some confusion about how communications take place in Internet. I suggest you to read: Internet (Wikipedia) But interesting to note, would be that the information you exchange over the network transit is small packets, through different nodes. The exact location of the nodes depends on many factors. But when Alice in LA use skype to ...


34

TL;DR: Get the traffic routed through a system under your control and have MITM whereever you, the victim or the destination are. A: Not quite. First off, the internet is packet switched, so there might not be a single actual wire all packets go through. To establish a MITM, that MITM must make sure the requests from the user get routed to him instead of ...


10

The adversary doesn't necessarily need to be physically located on the network route that they're hacking. They may have previously compromised a network device that is on the route, and thus be able to login to it and conduct their attack from any location.


5

Those sites (and some more) use public key pinning with HSTS, whereas the browser does not accept other certificates or a downgrade to http.


0

These are all good answers so I won't go on and say how "yes, it's possible and being done within many organizations around the globe". What I did want to say is that HTTPS inspection is (generally) done NOT to spy on you but to ensure that traffic traversing their network is legitimate and safe. They want to ensure that it's you doing your banking on your ...


3

What that someone probably meant to say was: There are a lot of certificate authorities out there, which's keys can be used to generate valid certificates. While that is true, trusted CAs are not going to be trusted quite long when they hand out certificates to be used for MITM attacks (or, for that matter, do not comply with other rules regarding ...


5

If your company owns and manages your computer, they have following options to inspect your HTTPS connections: Adding their certification authority to operating system/browser trusted certificate store. This will allow them to generate valid certificates on the proxy for any website you are connecting to. Furthermore, they are even able to turn off ...


0

Potentially yes, but you would need to implement bgp-hijacking


3

Wouldn't that require Browser Providers to implement a massive backdoor in browsers? (or ISPS?) There is no need to implement anything in the browser to block internet access. This can be fully implemented at the ISP level, similar to how capture portals at public hotspots deny access until the user provided some sort of login, payment or acknowledgment ...


1

There's a couple of interesting things to look at. Firstly, just look at the cert - it will not come form a well-known Certificate authority. This is visible (firefox, Windows) by clicking the arrow on the right once you click the green padlock. Eg. Facebook says "Digicert". Once you have seen one or two certs generated by TMG you will identify them with ...


1

To answer your questions, Yes - that is exactly how the company manages to get that "green lock". This may differ for other browsers, though. Some, like Firefox, use their own trust store and some, like chrome, use the one of the operating system. So the exact installation location of the certificate might be what you err on. Generally, yes, that's how ...


0

Yes, generally speaking. The comments have linked you correctly to the mitm proxy documentation for that feature already. If that however is a feature of fiddler I do not know. If it's not in the documentation, go for MITM proxy instead:) This, by the way, is independent of you using certificate pinning; this would work fine without a pinned certificate ...


1

TFTP is easily observable, here are some options to prevent it to be observed by untrusted party, varying in security effectiveness depending on potential physical access and remote access, and independent or alternative each other: use the console port in cisco (usually RS232 over an RJ45 socket) where you might not have reason to mind of the fact that ...


3

I think you've answered the question yourself mostly: unless there are protections against sniffing inside the network an attacker could be able to see the configuration. But if this is a problem in your specific environment cannot be decided, because it is unknown if you have protections against sniffing or if the configurations are free from sensitive ...



Top 50 recent answers are included