How does someone become a man in the middle?

Question

As I understand it in order to commit a successful MiTM attack you need to be "sitting" somewhere along the traffic path. I assume this means being hooked up to one of the nodes inbetween the end points, physically splicing the wire connecting them, or intercepting air waves.

• Are my assumptions correct?
• Does an adversary's terminal need to be directly connected to the wire, node, within wifi range, or can someone in Kansas use an outside path to gain access to a path from LA to San Francisco?
  • Maybe it's more correct to ask if someone needs to be in proximity to the target path. Conversely, can he "use the internet" to mitm the path: isn't every node on the internet essentially connected to each other?

Answer 1

There are many, many ways you can become a MITM, virtually at all layers of the networking stack - not only the physical one. Being physically close to your target can help, but is by no means a necessity.

---

At the physical layer, the attacks you can get are very overt: splice a ethernet cable, use a optical tap, or capture radio signals.

A passive optical network, tap - photo by Roens

Some active attacks can have physical access as a precondition - many others do not.

---

At the data link layer, passive attacks are incredibly easy: just put your network card into promiscuous mode and you can see all traffic on your network segment. Even on a modern (switched) cabled network, MAC flooding will ensure you can see more than you ought to.

For active attacks on local networks, ARP spoofing is quite popular and easy to perform - it basically makes your computer pretend it's someone else - usually a gateway, so that you trick other devices to send traffic to you instead.

ARP spoofing - diagram by 0x55534C

Data link attacks work as long as you are connect to the same local network as your target.

---

Attacking the network layer is easy if you have physical access - you can just impersonate a router using any modern linux machine.

If you don't have physical access, ICMP redirect attacks are kind of obscure, but sometimes usable.

Of course, if you have enough money on your pocket you can do it NSA-style and intercept routers when they are shipped to their destination by (snail) mail - just tweak the firmware a bit and you're good to go.

Attacks at the network layer can be performed from any point in the (internet) network route between the two participants - although in practice these networks are usually well defended.

---

I'm not personally aware of any attacks at the transport layer.

---

At the application layer, attacks can be a bit more subtle.

DNS is a common target - you have DNS hijacking and DNS spoofing. Cache poisoning attacks against BIND in particular were very popular a couple of years back.

DHCP spoofing (pretending to be a DHCP server) is quite easy to perform. The end result is similar ARP spoofing, but less "noisy" on the network and possibly more reliable.

The broadest application layer attacks can be performed from anywhere in the internet.

Answer 2

TL;DR: Get the traffic routed through a system under your control and have MITM whereever you, the victim or the destination are.

A: Not quite.

First off, the internet is packet switched, so there might not be a single actual wire all packets go through.

To establish a MITM, that MITM must make sure the requests from the user get routed to him instead of the correct destination. There are several ways this can be done, for example:

• In the local network by ARP spoofing of the gateway and/or DNS server,
• In all networks on the route,
• By returning his IP instead of the correct one from the victims DNS server

After that is established, the MITM interacts with the actual destination on the victims behalf, modifying data in between as the MITM likes.

The easiest way to establish this is in fact within the local network because those are usually less well monitored and/or governed. Also, they regularly have more consumer devices with more security risks that can after being compromised be used to redirect DNS requests to a server under MITM-control.

Yet, as you can see from above: If you manage to set the DNS server of the victim to one under your control, you may very well do MITM from whereever you like.

The same is true for routing nodes/ISPs: You may advertise cheap routes to the destination using the BGP to get all traffic routed through your system. Yet this is usually not feasible and/or possible for consumer connections.

Answer 3

The adversary doesn't necessarily need to be physically located on the network route that they're hacking. They may have previously compromised a network device that is on the route, and thus be able to login to it and conduct their attack from any location.

Answer 4

Assume, you have a girlfriend, and you saved her number as GF in your phone. And in the same way, your girlfriend saved your number as BF in her phone.

Now an attacker X, manages to gain access to your phone, and change your GF number as his number. In the same way, he manages to gain access into her phone and changes your number as his number.

So the number saved as GF in your phone and number saved as BF in her phone is the phone number of X.

If you send a message to your GF, it will be received by X, he reads it and forwards it to your GF. Since X's number is saved as BF in her phone, she receives a message as From: BF, which is actually the attacker. She reads and reply, and he repeats the same.

Now X is the Man-In-The-Middle

Answer 5

You seem to have some confusion about how communications take place in Internet. I suggest you to read:

• Internet (Wikipedia)

But interesting to note, would be that the information you exchange over the network transit is small packets, through different nodes. The exact location of the nodes depends on many factors. But when Alice in LA use skype to chat with Bob in SF, her messages (in packet) may transit to Canada, Germany and back.

And more to your question, a MitM attack is achieved whenever Mallory managed to set herself as a relay between Alice and Bob. She receives Alice's message and send them further to Bob.

Mallory could be located anywhere in the world. Remember that packets travel to a lot of places. But she needs to make sure that all traffic from Alice to Bob would transit through her. For that she has to take control of a node through which either Alice or Bob's message has to transit. For example, directly Alice's computer, her ISP, or a public WiFi router.

You can get more details on the corresponding wikipedia article.