I have recently understood how SSL handshake works.I understand that once the handshake is done, everything is shared by secret key between server and client. I want to know what happens if Man in the middle attack occurs during the handshake? Though there is nothing attacker can get from that. By MITM attack, I mean this - he can get access to any upstream server and stop packets from going to a particular website. This would cause disruption of authentication right. This problem is not just specific to SSL handshake as it can happen anytime when MITM stops packets going to a particular destination.So my question is that what practices are followed to stop these kind of attacks?

  • If you detect a mitm attacker you just kill the connection and log an error? – SEJPM Jun 30 '16 at 14:15
  • Thanks for the response. That's fine in ssl case. But in a normal case,what if you are trying to connect with some web server and MITM attempts to stop packets every time? – AV94 Jun 30 '16 at 14:19
  • 1
    If the browser can't connect to a server it will just show the user a window that says so and a server would eventually retry after some time – SEJPM Jun 30 '16 at 14:21
  • This sounds more like a DOS attack than an a mitm – Limit Jun 30 '16 at 15:05
up vote 2 down vote accepted

Typically, controls are put in place to prevent "access to any upstream server". This includes:

  • Proper device hardening for routers and switches
  • Properly configured DNS servers
  • Network monitoring solutions to detect MiTM attacks on the local LAN
  • Certificate Authorities (CAs) to verify that the correct cert is used in the SSL handshake with the server

You'll have to clarify what you mean by "stop packets from going to a particular website". How would someone perform a MiTM if the attack if the packets are stopped. Do you mean redirected to a malicious site that the MiTM attacker owns? In that case, the CAs and the cert itself are the mitigating controls for this type of attack (think cert warnings by the browser).

  • MITM in general redirects to a different website he owns as you said. By "stop packets from going to a particular website", I meant this - someone who can access a router can configure it in a way such that packets going to a destination are destroyed. I know that he will not get any gain by doing that. But, I just wonder if that can be a possibility as he can disrupt the normal network traffic. "stop packets..." might not qualify as a MITM attack, I just said that because a third person is interrupting network traffic. – AV94 Jun 30 '16 at 15:04
  • 1
    In that case, it's referred to as "availability impact by a malicious actor". And the same mitigating controls mentioned in the answer apply. Protect the network and devices within your scope with configuration hardening, long complex passwords, and enable monitoring. – HashHazard Jun 30 '16 at 15:09

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.