0

I have tried to perform a mitm attack on one of my pc's which has Eset antivirus installed.

I tried to intercept http/https data by forwarding port 80 & 443 with iptables. Then I used arpspoof command along with mitmproxy for the attack. I also used a on-the-fly ssl certificate with mitmproxy. Once I put everything in place and started the attack, the antivirus on my target pc immediately detected and blocked the attack.

The message I got is the following: Network event blocked - Duplicate IP addresses on network A computer on the network is sending malicious traffic. This can be an attempt to attack your computer. Well yes I redirected the traffic.

So I would like to know, how the antivirus actually was able to detect the attack?

Improve this question
3
  • 1
    What kind of MITM?
    – Arminius
    Commented Mar 25, 2017 at 0:17
  • 1
    You didn't mention through what method, tool, or technique you were using to perform it, or what you were trying to evade detection, but I'd imagine if your attack is known about and has expected behaviors, uses a recognizable piece of software, or has some other kind of marker to be a signal an AV vendor can work to create a defense for it.
    – dreamist
    Commented Mar 25, 2017 at 0:20
  • Still not enough information to know what you were doing: Did it complain about the plain text connection (port 80, http) or only about the encrypted connection (port 443, https)? What exactly was the message you got? Did you just redirect the traffic or did you try to actively man in the middle https - this would be easy to detect since the CA signing the certificate is an untrusted one.
    – Steffen Ullrich
    Commented Mar 25, 2017 at 8:14

1 Answer 1

Reset to default
3

Most likely your attempt was detected due to the arp-spoofing attack. This attack send several arp packets in a very short period of time, containing an already-in-use IP address. When a anti-virus (or IPS/IDS) see a machine with this behavior it automatically classify it as malicious and, depending on the software, it may blacklist the IP.

To understand the anatomy of a arp spoofing attack, check this page or this video that details the attack.

Improve this answer
1
  • 1
    It is also possible it detected an issue with an SSL cert, but ARP spoofing is much easier to detect, as it is very noisy
    – jrtapsell
    Commented Sep 24, 2017 at 22:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .