I have noticed a large amount of server-side HTTP client libraries accept untrusted TLS communication by default. For example, from the documentation for node's request:

strictSSL - If true, requires SSL certificates be valid.

This is false unless set, in other words, untrusted SSL certs are accepted by default. I'm not specifically picking on request, it's by no means alone when it comes to this behaviour.

What are obvious attack vectors for server-to-server communication (typically a REST API) using untrusted SSL certs?

Eg, DNS cache poisoning could be used to replace the real endpoint with an attacker's replacement that uses a self-signed cert.

Are there others?

closed as off-topic by Matthew, Mark Buffalo, Ohnana, Xander, RoraΖ Feb 24 '16 at 14:15

  • This question does not appear to be about Information security within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

  • I've asked for this to be closed - per discussion with @steffanulrich below, the question is too broad. I have now re-asked the question more specifically in a separate thread. – mikemaccana Feb 24 '16 at 10:35
  • 3
    I'm voting to close this question as off-topic because the OP asked for it to be closed – Matthew Feb 24 '16 at 11:06

When a client doesn't check the SSL certificate of the server that it is connecting to, this opens the door for a Man In the Middle (MITM) attack. As the name implies, this type of attack is pulled off by someone between the client and the server. In practice, there are a number of scenarios where this can take place. See How does a Man In the Middle attack happen in reality for more info.

  • Sure: the fake wifi hotspot is obvious. But that's a client-specific attack. I'm asking for server-to-server MITM attack vectors. – mikemaccana Feb 22 '16 at 20:20
  • @mikemaccana: in server-to-server scenarios one of the physical servers is the logical client to the other one (client: initiate connection, server: accept connection). So MITM still applies here. – Steffen Ullrich Feb 23 '16 at 5:23
  • @SteffenUllrich I'm asking about specific MITM attacks - that's why I mention one example of a MITM attack in the question. However I things like a rogue WiFi access point is an unlikely route of attack, hence asking this question. – mikemaccana Feb 23 '16 at 15:35
  • @mikemaccana: ARP spoofing and most of the typical MITM attacks apply to any computer-to-computer scenarios including server to server. – Steffen Ullrich Feb 23 '16 at 17:14
  • @SteffenUllrich For an ARP spoofing attack you'd generally have to compromise a host in the same datacenter as the server, right? I was looking for commonly exploited server-based MITM attacks rather than a general 'all MITM attacks apply' answer because clearly some, like wireless networks or VLANS shared with unknown parties are less likely to happen in server environments. I thought that was evident from the question but perhaps not, maybe I should just delete the question and be more specific. – mikemaccana Feb 23 '16 at 17:58

Not the answer you're looking for? Browse other questions tagged or ask your own question.