New answers tagged

1

I.e without access to others computer. I'm assuming that you mean that A cannot access the computer of B and B not of A, but they can access other computers on the internet. Since information are not exchanged directly between parties but involve multiple hops there are several ways to intercept the data. Just to give you an idea what can be done here ...


0

If you do use ws instead of wss it means your users are on an http webpage and not an https one. You should use https for webpage to protect your users, thus, you have to use wss (because for obvious security reason, ws is not allowed in https webpage).


1

During the session initiation, through the signaling channel, the peers (two or more) are sharing information about their environment in order to create the stream. You expose not only yourself (aka your application), but also your users by not using a secure connection.


2

I saw in that article and in many other places (including security.stackexchange), that if the user installs a certificate of an unknown 3rd party. That 3rd party can exercise MitM attacks in other apps of the device. If you install a certificate for a certificate agency (not a certificate for a site) then you effectively trust the certificate agency ...


1

I would guess because you are arp spoofing the gateway IP address. Therefore when your victim navigates to https://192.168.1.5, their traffic is going directly to 192.168.1.5 and not via the spoofed internet gateway (local traffic does not require the gateway). With ARP spoof, enter 192.168.1.5 as the last command argument intead of the gateway IP, and it ...


4

[Disclaimer: I'm one of the mitmproxy authors. My opinions may be biased. :)] sslsplit sslsplit is a transparent proxy that can intercept TLS connections using a man-in-the-middle attack. sslsplit supports plain TCP, TLS and also HTTP to the extent that it removes HPKP, HSTS and Alternate Protocol response headers. Intercepted connections can be dumped ...


0

When a change in the fingerprint of the key is detected, it can mean a few things: the key on the server genuinely changed - this is normal after an OS reinstallation and can happen after the sshd reinstallation someone is posing as your server, trying a MitM attack. This is possible only with password-based authentication. Your comment about a ...


0

HSTS is there to prevent users from acessing specific webpages without SSL for a specified time. Also there is a list maintained by google where website owners can add their website. Webpages that are listed there will never be contected using HTTP even if the server never requested the client to use SSL by HSTS. You can anyway prevent HSTS from working by ...


0

It seems they are different tools which achieve the same result. They don't really break TLS though. Both tools just perform a MITM, initiate the TLS handshake to the server and then send the victim a HTTP page. So if the victim is aware he will notice a missing green key in his browser. To avoid these types of attacks, HSTS was invented which forces the ...


1

No, it isn't a silver bullet, for example: You are using static ARP entries. This will completely mitigate the risk of ARP spoofing. You are using encryption and you are using it properly. The bad guy can sniff your traffic, but he can't do anything with it.


2

I'm assuming that they either need to be on the same network as the sending or receiving end of the email. There are lot more possibilities: In the sending or receiving network. This vector could be mostly eliminated when sending/receiving the mail with TLS, at least if the certificates are correctly validated (which is mostly the case in this step of ...


2

It's not really related to Active Directory or Group Policy. That's just one way to do it. If someone can install their own root cert in your trusted store(s) then they can issue fake certs and everything thing looks legit. See Charles Proxy. One legit use for this is to allow tools like Snort to monitor encrypted traffic on a network. Some applications ...


2

This got me thinking, if I was on a public network somewhere, could they issue their own certificate making it appear trusted, and therefore giving me a green padlock on my bank site for example? Yes. does it appear trusted because of a group policy telling the PC to trust the cert? Yes. (Or some other mechanism telling the PC to trust the cert. ...


3

The list of nodes provided by the authorities is signed by all 8 authorities, the public keys of which are embedded in the tor client. You could prevent the client from booting, but it won't accept your list of nodes. (https://www.torproject.org/docs/faq#KeyManagement) : Coordination: How do clients know what the relays are, and how do they know that ...


1

It highly depends on the kind of data you offer for downloading and what kind of trust relationship there is between the user and your site. Just take a closer look at what HTTPS offers and what not: It offers some kind of privacy through encryption. If the data are already encrypted by other means then you don't need another layer of encryption. If the ...


3

There is an in-depth analysis of the security of SAML in the PhD thesis of Thomas Gross (Bochum): http://www-brs.ub.ruhr-uni-bochum.de/netahtml/HSS/Diss/GrossThomas/diss.pdf His analysis led to the revision 2.0 of the SAML standard. It is very clear that certain communications have to be encrypted to keep the protocal secure, and that you need to know that ...


2

Assuming that you control both the app and the server, the best strategy for preventing MiTM in mobile apps is to always require SSL and use certificate pinning. Certificate pinning forces your application to only accept a specific cert. This will prevent an MiTM even against an attacker who has obtained an illicit but valid cert for your site.


0

I think you got something fundamelntally wrong. A MitM attack is an attack whichs goal it is to redirect traffic over the attackers host. The attacker then acts as a proxy but he will not be able to install an additional certificate on your host without having root/administrative access to that host. How to perform a MitM attack MitM Attacks are mostly ...


2

One way that an attacker can pull-off a MITM attack in a place where public wifi is available (like a hotel) it to create a fake wifi hotspot, which uplinks to the hotel's wifi. Then, the attacker can use a tool like sslsniff to intercept SSL connections. Edit: To protect against a MITM attack, the client should check that the server's certificate (or the ...


4

Because there is no encryption over the wifi connection between your device and the xfinity gateway you are vulnerable to a man in the middle attack at the least! Additionally, xfinity public wifi does not allow VPN connections which severely limit the security you could hope to give yourself. It is considered a breach of ToS as seen here. My advice is to ...


0

First of all Session Hijacking does not require MiTM and can be achieved also by other attack vectors such as cookie stealing through XSS or other web attacks such as Session Fixation. Also Packet Sniffing with tools like Wireshark will not work on Switched Network and to be able to to MiTM you will need to perform other attacks such as ARP spoofing. ...


0

To answer your question, you do not need a man in the middle attack if you are already able to observe their traffic. However, a MitM attack may be required on a switched network, for example, because the victim's traffic will not otherwise travel to your computer. With an open (or encrypted with a known key) wireless network, you don't usually need to to ...


1

I'm assuming that you are talking about session in the context of a web application, i.e. not the TCP session or TLS session but an authorized session of a web application. This one is usually maintained by a cookie and often all what you need to hijack the session is to have access to this session cookie. Access to this session cookie can be done with a ...


1

Session Hijacking can also hijack a session that has already been established. And you're right, all you need is the packet, and not to be in the middle of the flow. For instance, if the session management is improperly configured, you could reestablish the same session if the user disconnects from the server. Perhaps what you are reading is making a ...


2

The act of setting up an evil twin is not sniffing, but the generally accepted definition (CISSP) is that the purpose of the evil twin attack is to harvest credentials, etc. It might also be argued that the evil twin attack is not strictly a sniffing attack if the attacker only uses it to DoS the people on the network.


0

Attackers who set up Evil Twins (An Evil Twin is a rogue wireless access point set up to mimic legitimate company wireless access points; many times the SSID is duplicated to make it look like it's the official SSID of the company) usually use some sort of sniffer/protocol analyzer, but the Evil Twin in and of itself is hardware; a rogue AP. To answer your ...


2

This question, and this exact scenario, actually came up on Serverfault a few months ago. See http://serverfault.com/questions/744147/can-someone-using-the-same-dns-server-as-me-hijack-my-domains


1

While I am not sure exactly how DigitalOcean handles it, as their code is proprietary, if I were to design a similar system I would only allow the domain to be in the system exactly one time. If someone did try to register it again I would not allow it. However, if the domain is really theirs, they could contact support and prove it. After proving it to ...


1

There is no legitimate way for an unauthorized eavesdropper to access those specific packets. So let's break it down: Make it legitimate. Eve* could ask Alice or Bob for those packets. Authorize it. Eve could be a law enforcement officer, and request the network provider to deliver copies of those packets. Be less specific. If Eve is a thief who just ...


0

Here are two ideas which show the dangers of phishing and social engineering, among other things. If it's a 10BASET or 100BASETX network (unlikely), Bob can fly to LA and try to find their network entry point. If Bob has enough money, this is even easier. Bob shows up pretending to work for the ISP and says he has to fix something. Corporate/business ...


1

WAP2 only secures the wifi against outsiders. Once you are in the inside, e.g. using the service, your transmission medium is considered trusting, and it is up to the other layers to use other means of security and/or encryption. Or put otherwise, the encryption done at WPA2 only is effective for who is kept outside the network. Regular spoofing attacks ...


1

A perfect man an the middle attack can probably not detected, but usually these attacks (or legal SSL interceptions in firewalls) are not perfect. I would suggest to have a look at the ClientHello, especially about the ciphers offered by the client. Which ciphers are ordered and in which order a very typical for today's browsers. Man in the middle solutions ...



Top 50 recent answers are included