New answers tagged

3

SSLStrip worked rewriting https requests to plain http, removing the protection and allowing both eavesdropping and modification. A server with HSTS protection will set a header on a HTTPS request asking the browser to only contact that server using HTTPS: Strict-Transport-Security: max-age=31536000 In this case, for one year the browser will only ...


3

The HSTS header stops MitM attacks by instructing the browser to always send HTTPS (as opposed to HTTP) request to the domain until the policy expires. So a browser that respects the header would send a request to https://example.com even if the user clicked a link to http://example.com. The logic behind HSTS has not changed since it was defined in an RFC ...


1

I have a similar set-up, a whitelisted linux ftp server, receiving an encrypted file in the clear, and have asked similar questions. For one, I have it set up as anonymous, since what is the point of a login in the clear? Second, it is whitelisted, so the only theoretical vulnerability is IP spoofing. I read up on IP spoofing specifically in regard to ftp, ...


6

Either you give the public key to Bob when you physically meet him and mutually verify identities (as at a key-signing party), or Bob verifies your public key through a trusted introducer (e.g. a Certification Authority) This is the "Infrastructure" part of PKI.


2

Diffie-Hellman (and variants such as ECDH) protect against passive eavesdroppers, but not (at least by themselves) against active man-in-the-middle attacks. An active MITM can substitute his own keys for Alice and Bob's keys during the initial exchange, something like this: Alice -> Bob (intercepted by Mallory): Hi Bob, I'm Alice and here's my public key: ...


0

Unless there's a flaw in the DH key exchange that isn't public, it's impossible. This is the exact scenario DH is intended to support: Diffie–Hellman key exchange (D–H) is a specific method of securely exchanging cryptographic keys over a public channel 


0

The whole point of using HTTPS is that it prevents such attacks that break the integrity of the connection. You would need to do an SSL MiTM and break the SSL. However breaking SSL will mean that the user's browser will prompt the user about this break in SSL, and you would need to be dependent on the user ignoring such errors. Also keep in mind that it is ...


2

For sites like google and facebook several browser have preloaded HSTS (enforce HTTPS) and HPKP (certificate/public key pinning) settings. This means that the browser knows that these sites should be reachable by https only and how the certificate should look like. And this means that stripping SSL and the HSTS header (i.e. your --hsts option) will not work ...


3

My question is has the malware installed proxy server on my pc? Based on your description this is very likely. How the malware has done this? Use of proxy is only a registry setting or similar (i.e. browser profile) setting and can be changed by a process (no manual interaction required). How to resolve this issue? Unless you have ...


0

As per OpenID Connect Core documentation: The nonce parameter value needs to include per-session state and be unguessable to attackers. One method to achieve this for Web Server Clients is to store a cryptographically random value as an HttpOnly session cookie and use a cryptographic hash of the value as the nonce parameter. In that case, the ...


4

No, it is not possible to determine the state of SSL pinning at the client. SSL pinning is part of the certificate validation done solely inside the client and the only feedback the server gets is if the validation succeeded (connection continues) or not (connection closed, maybe TLS alert). Also there is nothing fully reliable the server could to to "ask" ...


1

Android requires app updates to be signed by the same key as the original app. So unless the developers themselves have been compromised, a MITM won't be able to update existing apps. Note that this process is completely unrelated to SSL certificates. App signing certificates are self signed and don't rely on certificate authorities for trust. It sounds ...


0

In contrast to Polynomial's suggestion, I don't like exporting to DropBox or Email, since most end users use 3rd party applications that have access to the entire datastore using linked apps. DropBox in particular makes it too easy for an app to gain full access to the entire storage (keys and everything). I am presently leaning towards iCloud, where no ...


3

Begin each session by having the client generate a symmetric encryption key, encrypt it with the public key of the server, and send it to the server. Both server and client can then encrypt all further communication during the session with that symmetric key. An impostor server would not have the private key of the server, so it can not decrypt the ...


3

Look at the chain of custody. At the point of origin, you have a client; the client has a computer with a secret document, a ZIP program on it, and a secret password. At the point of receipt, you will accept the ZIP file, decrypt it with the secret password, and process it. We can assume that you and your clients are equally susceptible to attack at the ...


3

There are always risk, the ones you are asking about have more to do with physical access and physical loss of the media. As many others have mentioned encryption is going to play a big part in helping with your solution. I'd recommend taking a step back and looking at the specific risks that concern your business and this data in particular then creating ...


3

In this case, no, your device will not be subject to MITM of https traffic. It is possible for employers to deploy a root certificate to machines in order to install a MITM proxy. (BlueCoat is a company that offers such a device commercially.) However, that requires a "trusted root" certificate to be installed in the client computers. In your case, the ...


1

I assume that you are connecting from your personal device. Many companies have their own certificates on their network somewhere in order for them to check HTTPS traffic going through their network. In many countries it is legal for companies to read traffic using their equipment, and they find this necessary to protect against viruses etc. As they can't ...


2

What is this certificate being used for? A standard implementation of WPA or WPA2 in enterprise environments is to use certificate-based authentication for wireless network access. For company-owned devices, it makes connecting to a company wireless network seamless - the required certificates are automatically installed at some point (during ...


0

This is the equivalent of creating a self-signed certificate. Imagine the following, you deploy a network. Inside of this network are systems you know you deployed, and trust. You create a self-signed certificate with strong encryption. This certificate cannot be validated by yourself unless you create your own Certificate Authority (CA). What you are ...


-2

yes you will be: it seems that a MITM is planting a cert in your device. Can you show a full certificate details? What are it's permitted usage capabilities? If it would be a valid internal certificate for - let's say - an intranet web interface to something - then no external name(like dot-com as I see on your screenshot) will ever be in the cert info


0

To play MITM with HTTPS, your ISP would need to create fake server certificates on the fly for the domains you visit. Your browser would flag these certificates as security probems, since they would not be signed by any trusted CA. That is, unless you imported the CA certificate used by the ISP as a trusted CA. In that case your browser will think everything ...


5

Effectively they can see everything you do that's not encrypted or sent through a tunnel and in many cases they can see what type of traffic that is too via DNS. I'll list a few examples: What sites you frequent. When you're active on-line. What operating systems you use and in many cases what software you use. How often you patch your computer. The ...


1

Assuming you have control of the network equipment then yes you can log and monitor their actions. Full packet capture: Ideally you want full-packet capture of all traffic at key ingress/egress points for each segment. You asked for the best way to do this and this would give you the most data about traffic on your network. Even if you can only capture the ...


2

Here is something interesting from Bruce Schneier's blog: Many wireless keyboards have a security vulnerability that allow someone to hack the computer using the keyboard-computer link. (Technical details here.) An attacker can launch the attack from up to 100 meters away. The attacker is able to take control of the target computer, without ...


1

It depends on what you are trying to achieve. If you are trying to prevent DNS leaks, DNSCrypt isn't what you need. DNSCrypt is intended to prevent DNS spoofing, which is quite different. You could think of it as Privacy vs Man-in-the-Middle. DNSCrypt is a protocol that authenticates communications between a DNS client and a DNS resolver. It prevents ...


3

The result of this attack is not really different from someone compromising your router, your ISP, your VPN endpoint or similar: the attacker will be able to intercept and modify the traffic. Depending on the way the attack is done and depending on the characteristics of the line (i.e. FTTH vs. xDSL vs. cable...) one might detect changes to the line ...


0

Looking at google certificate’s, it’s now very clear… The answer is yes of course since you can request to be a certificate authority for the domains you control…


0

I would just set up a wireless router and have both android devices and the PC connect to it. Most android devices have the ability to disable mobile data and thus force your connection to go over wireless.


1

My suggestion is a little different to what you asked: Download the app Packet Capture from the Google Play Store and install it on your Phone. Start the app, skip the generation of the root certificate (or generate one - this will help you decrypt SSL traffic), and start a capture. You can then capture and analyze packets directly on your phone - ...


1

This could be a browser intelligence as well. Try browsing https://google.com in Chrome when Fiddler is on and decrypt https traffic option selected. The browser stops sending request saying - your connection is not private.


-1

UPDATED QUESTION: well this is moot. If you do a FULL MITM attack then there's nothing else to be done there. You have full control of the communication to the server. Even the in browser store won't work. You have FULL control if you've intercepted the created session in its entirety. At this point the browser is securely talking to you, and on it's behalf ...



Top 50 recent answers are included