Tag Info

New answers tagged

4

Since all of the other subquestions have been adequately answered, I will attempt to answer the question regarding registration of domains that are similar to the original. This action is known as typosquatting and since the typosquatter owns the domain, they will have complete control over the verification requests that the SSL certificate authority ...


5

how can they ensure that you are really an admin of this myshop.com, perhaps it was an attacker who requested this certificate to be able to perform man in the middle attack? They can't. If you can receive mail for admin@example.com then you can get a cert for that site. what prevents the same attacker from requesting the certificate for the same ...


12

Certificate Authorities make a living based on their reputation of only giving out certs to the rightful admins of a domain. If a CA starts giving out too many fraudulent certs, the browsers will pull out their root cert and the CA goes bankrupt, so it's in the CA's best interest not to do this. Exactly how a CA verifies the identity of the applicant varies ...


3

A provider of domain-validated certificates will typically ask you to create a TXT DNS record of their choosing for myshop.com or put online a web page of their choosing on http://myshop.com/, to prove that you own the domain. That will generally stop an attacker from getting an SSL certificate for your domain, unless they have already compromised your DNS ...


30

A CA is supposed to make sure that the certificates it issues contain only truthful information. How they do that is their business; serious CA are supposed to publish detailed "Certification Practice Statements" that document their procedures. In practice, when you want to buy a certificate for a www.myshop.com domain, the CA "challenges" you, so that you ...


11

"Remaining anonymous" and "verifying identity" are contradictory, aren't they? I would say if you want to pay someone and guarantee that they get the money, they can't remain anonymous. If I ask them to give me a personal password and in return I give them each a unique public key, will that be enough to verify their identity assuming they took ...


2

You can prove that someone owns an email address quite easily. You send them an email containing a random code, and ask the user to enter the code to confirm their email address. This is a very common technique for online signups, and the secret code is usually hidden inside a link, which the user has to click to confirm. As you have identified, there are ...


0

It all boils down to trust and the competence of the parties involved. If you send them a password(i.e. shared secret) and the recipients forget to delete it and remains in the inbox then any attacker with access to that account may claim to be the indented recipient and will also be able to perform valid transactions. You could use an escrow service for ...


0

Tor communication is not only encrypted but Tor is also functioning in a way that makes it looking like normal HTTPS which thing renders its detection almost impossible. In other words, the communication between Tor's exit nodes and the Internet is not different from normal traffic which thing makes Tor also prone to MITM attacks. But (your question's ...


0

If you are running Arpwatch with alerting on you can write a script to stop all traffic when it detects an MAC address change. This will protect you from IP spoofing, and force your attention to the problem. This assums they are not MAC spoofing as well. But this only works for active MITM attacks, this will not work for passive MITM, for that you need to ...


0

Your ISP if they are preforming a MITM(SSL strip) attack can indeed see what you send the first hop, but they will be able to see the second and not be able to see or inject into the third. Tor works in layers. Each layer is a separate TLS connection. MITM You | GuardN RelayN ExitN Dest | -----|-----| ----------------------| ...


0

Tor was written to be secure even when connecting through an insecure network. Since they're giving you Internet access they can obviously read all your traffic, but unless they have exploits no one knows about or managed to utilize the known ones they won't be able to decrypt your traffic.


5

They can not read your traffic, because the communication between you and the entry node is already encrypted.


5

If the MITM attack was done using arp poisoning (for example in public WiFi network), then you will not see the attackers IP anywhere. Lets say the default gateway of a WiFi network is 192.168.1.1. The attacker can send arp responses to your machine telling it that he is 192.168.1.1. Your machine will continue to send packets to the address 192.168.1.1, ...


0

Yes, but not in all cases. this depends on your network and routing setup. If you are behind a proxy firewall, then you will probably only see the IP address of the proxy all the time, as all of your web requests will be routed through it. Also, if the webserver(i assume) is behind a Public IP/gateway and that MITM is also behind that same public ...


3

While your question looks complex I think it boils down to the following setup: two servers, client does not know which one is the correct one both require authentication with client certificates And your question is, if client authenticates against server A: can this server use the successful client authentication to authenticate against server B? The ...


2

You can't authenticate as the server The problem is not that the server will "throw a fuss" it won't. You can easily spoof the server into thinking you are the user. The user isn't authenticating with an SSL cert. The problem is you can't trick the user or more specifically the user's browser. Remember for a MITM attack the attacker needs to establish ...


0

What are you asking for? Technical details or legal aspects? Technical details will rely on your company's infrastructure. In general, you have to create your own Certificate Authority, install its certificate as trusted in company's computers and then generate false certificates for each domain you want to test. Legal aspects cover 2 things: Company ...


0

Yes it is possible, but would require the user to be using an obscure web browser that links to OpenSSL. With another valid TLS leaf certificate the CA flag can be bypassed and that certificate used to sign a certificate for any site: https://community.rapid7.com/community/infosec/blog/2015/07/09/cve-2015-1793-openssl-certificate-authority-impersonation ...


2

DPI threats against OpenVPN is pretty hard, unless the attacker somehow grabs the random, freshly generated session keys which is transmitted over an SSL connection. The SSL connection, in turn, is secured using a pre-shared certificate and a secret server certificate. So an attacker would need to compromise the server itself. Usually, said attackers would ...


1

To answer the original question - most people never type https://something.com directly. They rely either on links (click here to access our secure login server) or on redirects (type "gmail.com" in the browser, and you will be automatically redirected to a secure site). This is where SSLStrip comes in - it intercepts the original, unsecured HTTP reply, and ...


0

1st risk: OS The first point of which depends the security of your proposed solution is the security of your OS which is the starting point of your VPN. Too many admins tend to forget that to use a VPN to reach his company network from a weak OS is above all a security risk, and a major one since a VPN incoming connection is usually classified as a trusted ...


4

Email is insecure. It is completely insecure. Between you and the recipient it likely passed through dozens of servers and for each one it was passed as pure plain text. Without specific details and logs it is impossible to say where a copy was lifted but regardless you should always ASSUME that anyone can read anything you put in an email. If that ...


5

Such compromises already happened and DigiNotar is just on example. In effect the attacker could impersonate almost all certificates this way, because for most certificates it does not matter who signed it but only that it was signed by a CA trusted by the browser. There are few exceptions which are thus safer: Chrome and Firefox (and IE with EMET?) have ...


3

The compromise of a Root CA does not mean that all certificates signed by that trusted root are indeed compromised. Rather, it means that fraudulent certificates can be made for man-in-the-middle attacks and signed so they appear trusted in a browser. When you submit your Certificate Signing Request (CSR) to a Certification Authority (CA), they are ...


1

SN: 09:48:B1:A9:3B:25:1D:0D:B1:05:10:59:E2:C2:68:0A SHA-256 Fingerprint: EA:16:D6:DA:76:9B:67:6B:C0:7A:19:A0:CD:21:AA:F1:5A:9A:66:93:A2:C3:CD:7A:87:81:7D:B1:6F:5F:48:F5 Nothing in the cert I am looking at has opendns in it. IIRC OpenDNS does not support DNSSEC, they support DNScrypt-proxy which would not involve any cert being exposed to the browser.


4

The answer also depends on the physical aspect of the network configuration. If your modem or router (or combo) is easily accessible by someone else, it is much easier to eavesdrop through Wifi, although like @VirtualJJ said, the communication is encrypted. Because through the LAN with ethernet protocol the communication can be wide open for anyone to ...


1

Wireless networks are always on, and always open to being cracked. That said, WPA2 with a strong passphrase will be very difficult to break. So, for wireless, it really depends on your settings. Physical ethernet wires are not encrypted, but they have the benefit of being physical: if you can secure the physical ports (and cable modem in your case) so that ...


2

Ethernet (802.3) and wireless (802.11) are simply communication protocols. How secure they are depends on configuration. How to configure security for both ethernet and wireless will be out of scope for this answer. Out of the box, with no security configuration at all it would be easier to eavesdrop on an unencrypted wireless connection since the person ...


-1

WPA is just encrypting your WIFI password. It doesn't encrypt the traffic. Stay connected through ethernet. There is no problem with ethernet. It is actually safer if you are concerned about it.



Top 50 recent answers are included