Tag Info

New answers tagged

1

What you're suggesting is completely compatible with the Android TLS framework. When you create a connection to a remote server, you can specify your own trusted CA list. This means that instead of using the default CA store trusted by the OS, for this connection you trust only certificates signed by the CAs you specify, which don't need to be known to ...


1

You're overcomplicating things and reducing security for no reason. Do use SSL¹ — why on earth would you not use it? The whole point of SSL is to avoid MitM attacks. If I understand your protocol correctly: When the application is installed, it sets up a per-device secret key which it shares with the server. You haven't said how — are you going to use SSL ...


1

What you are asking is basically redefining the "common SSL". However, you are basing trust on the server only, whereas in SSL the trust is delegated to a third party. Moreover, in SSL certificates are signed, therefore you can verify their authenticity. So yes, the scenario will be able to prevent MitM attack (in a way), but the user loses some trust in ...


1

This setup is trying to match domains and ssl keys. However, I would start by questioning what are ‘domains’ here why are they important. Could the domain simply be a hash of the ssl key? That way you no longer need the CA. How are the domains assigned? If they are centrally assigned, could the ssl signing be simply provided as one step of the domain ...


1

In light of the broad question I will concentrate on answering your more specific one regarding full access to the centralised server. I'll refer to said server as a CA because this is essentially what you are describing. TL; DR it depends Let's presume that full access means knowledge of the CA's private key. This may not always be the case if we consider ...


1

Snake oil, this is just a glorified Linux live-USB with lots of bold claims to fool naive customers (they advertise it as a silver bullet solution for anonymity and privacy, which is impossible to do by just inserting an USB stick in a machine - does it magically detect hardware keyloggers or compromised firmware?). You can make your own by installing Tails ...


1

If you believe what Google claims here, SSL traffic is not proxied: Is my secure traffic optimized by the compression proxy? No, data compression proxy operates on non-encrypted traffic: HTTPS requests are sent directly from the mobile device to the destination server. That said, I've not hooked up a debugging proxy to snoop the network traffic, ...


2

HTTP is an inherently "trusting" protocol: it contains little or no built-in security. This means that it is susceptible to the following: Traffic monitoring Anything transmitted over HTTP can be intercepted and read by anyone connected to any network sitting between the source device and the target server. Traffic redirection and manipulation With little ...


0

In addition to what some of the answerers pointed out, most secure sites (e.g. banking web site, etc.), will not even allow you to access secure content through their sites via http. So, using http is not even an option with these sites - you have to use https.


1

Apart from the technological hurdles of getting a tap on the intercontinental lines that could actually read the data, the scenario you provided is indeed possible. If you use HTTP instead of HTTPS your data is travelling as clear text from end-to-end, so your ISP, anyone inbetween and the ISP of your destination host can read or even modify your data if ...


0

You can sniff HTTP Packets using Tools like Wireshark and its like a walk in the park to read your data Packets.An attacker can Intercept your Data Packets modify it and forward it. eg:You ask your bank to pay you - Attacker modify this packet and ask the Bank to Pay Him. I dont understand what you mean by HTTP in your WIFI Network.Dont you want to access ...


0

"Secure enough" and "trusted" are risky phrases. If you're talking about transmitting a credit card number, email address, SSN, or other personal information unencrypted as plain text via a URL parameter then this is definitely unsecure, regardless of where it is going. The page would need to be an encrypted page for that information to be encrypted in ...


1

Such a setup can be trusted, since the payment details cannot be extracted by your hacker and the payment details can be verified securely. The thing to watch out for is that a lot of user might not bother to double-check the details on the https page, or if there are 'hidden' paramaters sent along that aren't displayed and verified explicitly.


0

There's a number of tools you might want to use for this, some examples.. tcpprox from iSec Canape from Context IS Mallory from Intrepidus


3

To give the good answer from thexacre a broader touch: If the application itself does the certificate checking correctly (not all do, see http://www.kb.cert.org/vuls/id/582497) then an MITM attack is only possible if the attacker is somehow trusted by the owner of the device. In case of an owner which is curious what the application does the attacker is the ...


18

That app (and all MITM proxy apps such as SandroProxy and mitmproxy) work by installing their own trusted CA certificate on the device. That allows them to sign their own certificates which the device will accept. You have to manually install their certificate to the user key-store using a dialogue such as this: After which it displays warnings such as ...


0

However, I would have to make sure that Firefox actually checks the validity of the certificate, or am I wrong? Does Firefox do that? If you add an exception for a certificate to Firefox it will only associate the exception with the hostname in the URL. If you then get the same certificate with another hostname you must add the exception again. If ...


0

It sounds like you haven't included a subjectAltName section in your self-signed certificate, listing all the domain names and IP addresses under which you'll access the NAS device. Even though Firefox has been told to disregard that this certificate has no trusted issuer, it still can't confirm that the URL you're using is covered by your security ...


1

As you described it, this relay scheme is secure, if the data relayed via the server is properly authenticated and encrypted. The only attack vector I found would be, that an attacker could determine (based on the pairing codes) which 2 clients want to talk which each other, but traffic analysis would have shown this either way. As the API distributes keys ...


0

I ended up asking on the OTR's developer mailing list and here's the response I got: On Wed, Apr 08, 2015 at 02:51:14PM +0200, Jacek Wielemborek wrote: Hello, Here's something that keeps bugging me for a moment. It's a hypothetical situation, so please refrain from question like "how did you send the FP to your friend?". ...


1

Would the target URL be aware that multiple SSL Interceptions have happened? In theory the target URL is not aware of SSL interception at all, no matter how many SSL interceptions you do. It only sees that it is doing the SSL handshake with some kind of client and can not see if it is doing the handshake directly with the browser or with some SSL ...


3

It is hard to tell you exactly what is going on because we don't know what request actually triggered the message and you do. What it looks like, however, is that for some reason, a secure request intended for Toshiba's update server went to www.bcrea.bc.ca. There can be many reason for this but few are really encouraging: Something in your DNS resolution ...


2

Setup proper 802.1X authentication / WPA-Enterprise to connect to the network. So each client will have their own credentials and they'll be logged accordingly. VPN could also be set up in the same manner if you need remote access. All of these protocols are designed with security in mind and thus inherently prevents any form of MITM attacks if implemented ...


1

If you want to ensure you have your employees taking to you, and not some third party, you need to create a set of keys you distribute securely, and the tool you use depends on both ends having keys. Some few VPNs may do that, but not many. I think ssh can do so.


2

Keep in mind the context here - since it's an interview question, the goal is to assess your understanding of the terminology and concepts. They were probably not interested in some specific tool, or an exact command you would be running (although you might get kudos for knowing something like that). As mentioned in comments, there are MANY specifics ...


3

If you notice that someone is actively man-in-the-middling a server the first thing you should do is inform your incident response/security team. They should decide on mitigating controls, that's their task. It's highly dependable on what technology is being MiTM and in what way. It also depends largely on where the MiTM is occuring. Aside from ...


1

In the first messages between client and server, both send their list of supported algorithms, in order of preference. Then the algorithm that will be used is the first one on the client list that also appears somewhere in the server list. This is specified in RFC 4253, section 7.1: encryption_algorithms A name-list of acceptable symmetric encryption ...


1

There are a few ways that you can detect if you are a victim of a MITM attack, where the attacker has the ability divert traffic and/or to create bogus certificates from a trusted CA. In the case where you are connecting to a host that you've previously connected to, certificate pinning can be used. With certificate pinning, your client stores the ...



Top 50 recent answers are included