How can someone access data that I am requesting when I use HTTP?

Question

I have heard that HTTP use plain text communication. If it is so how can a hacker or someone tap it. From my little knowledge I know that if we sent a request to a web server it replies back to us using our IP address. So if an attacker wants to know what I am doing, how does he do it? Is it necessary to know my IP address or does he intercept it in between? Or is it like this: an attacker decides to attack someone and he picks some data and he finds that this belong to say X, which means does he attack randomly?

Answer 1

When you access a website, say Google, your request goes through multiple steps (nodes) until it reaches its final destination. The first node is your home router, then your ISP's routers, and then other big routers, and then Google's routers. At any of these nodes, your request is momentarily stored in the devices' memory, which means it can be accessed by an attacker. Of course, that's not a very likely situation.

The bad news is that an attacker could somehow trick your computer into thinking that his computer is a real node in the path between you and a legitimate node. This attack is called a man-in-the-middle (MiTM) attack. MiTM come in many shapes and forms, the most famous ones are:

• ARP Spoofing

• DNS Cache Poisoning

• DHCP Spoofing

I won't go through each type because it will make this answer too big, but please have a look at pages and learn more about these attacks.

As a solution to this problem, we have HTTPS. It works by layering HTTP over SSL/TLS to make sure that your request is going from your browser to the intended server and making sure that anyone snooping around won't be able to see what the request or response you get from the server contain.

Answer 2

Not completely necessary. If the attacker is using ARP spoofing¹, he can be sitting anywhere in the chain of communication². For example, if he's connecting to the same ISP node as you are (physically near you), then he can sniff all the plaintext data of everyone connecting to the ISP in that subnet. He doesn't need to know your IP for this, however he will find out who sent the HTTP request. So he doesn't need to find out your exact IP or do random shots-in-the-dark until he does find it; he can very easily just fetch all packets from your subnet and sift through those.

Note that an attacker can choose to ARP spoof only you, if he does know your IP. This is much more convenient a there's less unwanted noise on the line, but he can just as well spoof everyone on the subnet and proceed.

---

The way this works is that the TCP/IP protocol (well, the ARP protocol) is inherently insecure. When data needs to be sent to a certain IP, the computer with that IP is asked to identify itself. It's an easy matter to pretend to be that computer and accept the packets, and then forward them on to the real recipient.

For this, the attacker needs to be on the same subnetwork as a node which is transmitting the data. This node could be you, an intermediate ISP node, or the web server.

^{1. This is not the only way to MITM, see Adnan's answer for more. All three of those methods can work without knowing the exact IP.}

^{2. It is very unlikely that an attacker is sitting between two intermediate nodes. It is very easy for an attacker to be sitting on the you-(your)ISP connection and not too unlikely for the web host-(their)ISP connection. Anything else is very improbable.}

Answer 3

I just wanted to answer your question on whether there is some shared key(can't comment because not enough rep).

When you use HTTPS you will be using SSL for encryption. Servers that support HTTPS will have certificates which hold their public key and also can be used for verification. Clients will use the public key to encrypt a pre master secret to send to the server. Afterwards, they both will use that pre master secret to generate the master secret key for a symmetric encryption scheme(one where they use the same key to encrypt and decrypt data).

Hope that helps!

Edit:

To answer your last question of whether an attacker could pretend to be a user: of course! It's pretty trivial for an attacker to establish an https connection to a server. However, this should not allow the attacker to be able to read messages from other users using https, because their secret keys will be different.