Tag Info

New answers tagged

1

You could go and do a GeoIP lookup on the IP address, given that it's not spoofed (which 9/10 times it is). If the IP isn't hopping too much, you could create a drop rule to block traffic from that IP. You may even be able to drop the subnet given all the source IP's are in that subnet. It seems like they are throwing random attacks at you. There isn't a ...


2

If the client's initial request is for HTTPS, then the client will insist on first doing the SSL handshake, and only then, within the newly created SSL tunnel, will the client send the actual HTTP request, the one you want to respond to with a 301 code. This means that if the client entered the https:// URL (either he typed it, or followed a bookmark which ...


1

If the client specifically types in https in their browser, then you couldn't do what you are saying as the browser would first request the certificate before allowing you to send the 301 redirect. You don't have a valid certificate for the domain, so the user would see a certificate exception. If the client does not initially try to set up an HTTPS ...


1

To really know what is happening, you should not set your Linux machine as a proxy but as a router. The "proxy" really is an HTTP proxy. Applications which want to do HTTPS (HTTP-within-SSL) may use the system settings and use a CONNECT method to make your proxy forward the traffic in both directions; but they may also connect directly to the serve, ...


1

DNSSec does not prevent against MITM attacks. This is also mentioned in the following answer and a bit more explanation of how DNSSec works and some of its limitations. In this paper author discusses ways to circumvent DNSSec in Section VI, including 'intruder-in-the-middle' attack.


2

I think I understand the question as: If a servers' private keys have been compromised, won't a MITM attack be possible even if the heartbleed vulnerability has been patched? (given that not all browsers mandate Certificate Revocation List (CRL) checking?) And I believe the answer is indeed yes. Patching against the heartbleed vulnerability ...


0

If your own company is an enemy then you have a problem. Or possibly you are the problem. Normally, you connect your machine on the company's network based on a contractual agreement which makes you the employee, and defines your rights and duties. In particular, many companies do not allow employees to plug their own hardware on the company network; or ...


0

If you have full control over your computer it should be easy to detect SSL interception, because the browser will complain about unknown issuer if you access https-Sites. At least if the firewall administrators did not get an intermediate CA from a trusted CA (see https://lwn.net/Articles/480279/). And even these you will be able to spot if you use Google ...


9

You are correct. Some ways for the site to decrease that attack vector would be to... Use an HSTS header to prevent any data from being sent to the site in plaintext. Advertise only the HTTPS URL and do not allow any plaintext connections. This will ensure most bookmarks use encryption. The point being that sites should force SSL from the beginning, ...


3

Yes. The attacker could simply serve you http://www.facebook.com/ and hijack all the requests and responses to and from your computer. In that scenario, you are correct: it would be up to the user to be vigilant and realize that they are not browsing securely.


0

To detect a MITM attack, you need some way to communicate with the other end that is not easily tampered with by a third party. If there's a MITM attack, the key you're using is different than what the other end is using, and the crypto bits are different. A classic way to do this appeared in some early public-key phone encryption units. After call setup, ...


0

As explained here, some operating systems ignore some ARP responses. In particular, Linux will ignore unsolicited responses, but will use apparently legit request and replies from other hosts on the network. So the attacker must emit both fake requests and fake answers, and make sure that the target hosts see them nonetheless, which more-or-less implies the ...


0

You need to remember to tell the client about the gateway (which is you) and the gateway about the client (which is also you). It seems you have as the error says only spoofed one side of the network. You need to tell the router your the PC and the PC your the router and enable yourself to forward these packets along too. Forwarding is achieved in linux be ...


1

You asked quite a lot of different questions here. I'll try answering each. Spoofing/sniffing: The cure is encryption. More specifically Public Key Infrastructure. Then B can't modify (or even decrypt) data that it's relaying. The only question here is how you want to implement the key exchange (so that it can't be attacked). Open ports: An open port is ...



Top 50 recent answers are included