I’m new to security, and I’m wondering how man-in-the-middle and eavesdropping attacks between web servers work, rather than between personal devices and servers.
Most questions I see here about man-in-the-middle attacks seem to involve a personal Web browser communicating with a server over an insecure Internet connection. If they’re using unencrypted HTTP over something like public wi-fi, then it’s really easy to intercept and read their communications from packets that they broadcast on the same network, as Firesheep shows.
But how would an attacker perform an attack on the connection between two public Internet servers communicating over unencrypted HTTP?
I know that if HTTP messages aren’t encrypted, man-in-the-middle and eavesdropping attacks can occur. But I’m wondering about actual risk, feasibility, and practicality of such an attack.
Let’s say that there are two servers, A and B.
Server A is a VPS or something, from Rackspace or Linode, under your control.
Server B is another organization’s public web server that is not under your control.
Server B does not support HTTPS; it requires HTTP and session cookies.
Server A needs to intermittently connect to server B on server B’s website: logging in, doing things, logging out.
Server A’s IP address might or might not be public—it’s exposed to server B, in any case. Server B’s IP address is public.
How would an attacker eavesdrop or intercept this connection if they had the resources of an individual? It’s not like the VPS uses a public local network to which individuals could connect.
The big thing I can think of is that an attacker might launch a DNS-spoofing attack against the DNS servers of the VPS company that hosts server A. So you’d have to trust that the VPS company’s DNS servers won’t get compromised, right? Is this required trust recursive to servers outside the organization, all the way to the root server? What kind of resources would an attacker need to attack these servers?
Are there any other methods that a man-in-the-middle or eavesdropping attack might occur between these two servers? What resources would those also require?
There are some other questions about man-in-the-middle attack techniques other than wi-fi interception—although they are broader than this question, which is specifically about unencrypted HTTP between two hosted servers. These other questions include: