SSL MITM attack vectors for server to server HTTPS using an untrusted certificate?

Question

I have noticed a large amount of server-side HTTP client libraries accept untrusted TLS communication by default.

What are obvious attack vectors for MITMing a server-to-server HTTPS communication that accepts untrusted SSL certs?

Eg, DNS cache poisoning could be used to replace the real endpoint with an attacker's replacement that uses a self-signed cert.

As @steffen-ullrich mentioned, someone could rent a server in the same datacenter and try ARP spoofing.

Are there others?

You can also try HTTPS stripping... some sites do not force a https connection, though some do try to "suggest it", by arp injecting someones machine (as you would need to on most MitM attacks) you can route their traffic via your self and redirect all 443 traffic to port 80, thus not encrypting the traffic and it being readable, this is perhaps the easiest of the lot. if this keeps within the scope of your question. if you are interested in keeping genuine certificates for the website without needed to spoof you can also create a proxy server. — TheHidden, Feb 24, 2016 at 11:11

SilverlightFox · Accepted Answer · 2016-02-24 12:09:10Z

1

Some vectors would include:

IP hijacking
ARP spoofing at the ISP where the requesting server is located
DNS poisoning
Any attack at the remote endpoint where the server is substituted, from ARP spoofing and private routing attacks all the way to physical replacement of the server

answered Feb 24, 2016 at 12:09

SilverlightFox

33.7k6 gold badges70 silver badges186 bronze badges

Add a comment |

1 Answer 1