0

I have been thinking about an attack for SSL that would allow a third party to log all transmitted data. My idea is that you modify the client to connect to the server without SSL enabled and modify the DNS to return the attacker's computer. I was wondering if the attacker could then encrypt the data using the same parameters as the original client, making the server unaware that the connection had been tampered with. Please note, in this scenario the client would not be able to log the days itself.

TL;DR Could I strip SSL then add it later without a server knowing?

Normal: Client <-ssl-> Server

Idea: Client <-plain-> Attacker <-ssl-> Server

  • 1
    This is a very basic MitM attack. Look at "sslstrip" for an implementation of it. – schroeder Jan 3 '16 at 3:26
  • I thought that needed the client to have a malicious cert installed. Edit: The client does the initial connection with SSL, this looks like it needs a HTTP connection. – gudenau Jan 3 '16 at 3:32
  • Why do you need the client to connect as plain HTTP? MitM simply requires a self-signed cert, not a malicious one. If you have control over the DNS, you can do DNS poisoning to redirect the connection to the attacker as a MitM, too. That way, you can do almost anything you want, encrypted or not. – schroeder Jan 3 '16 at 4:14
  • I am looking for an answer that does not use a specific protocol. – gudenau Jan 3 '16 at 20:36
2

Unless mutual or 2-way authentication is being used, the server cannot confirm whether the client or an intermediary is its counterpart in the SSL communication. So your proposed attack scenario will succeed.

That said, modifying the code of a client in the fashion you suggest likely requires the attacker to have full access permissions to the client. At which point the attacker can copy the disk, install key loggers, etc... Basically, it is game over.

  • Good to know, I will look into this a little more. – gudenau Jan 3 '16 at 20:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.