1

I have recently understood how SSL handshake works.I understand that once the handshake is done, everything is shared by secret key between server and client. I want to know what happens if Man in the middle attack occurs during the handshake? Though there is nothing attacker can get from that. By MITM attack, I mean this - he can get access to any upstream server and stop packets from going to a particular website. This would cause disruption of authentication right. This problem is not just specific to SSL handshake as it can happen anytime when MITM stops packets going to a particular destination.So my question is that what practices are followed to stop these kind of attacks?

Improve this question
4
  • If you detect a mitm attacker you just kill the connection and log an error?
    – SEJPM
    Jun 30, 2016 at 14:15
  • Thanks for the response. That's fine in ssl case. But in a normal case,what if you are trying to connect with some web server and MITM attempts to stop packets every time?
    – AV94
    Jun 30, 2016 at 14:19
  • 1
    If the browser can't connect to a server it will just show the user a window that says so and a server would eventually retry after some time
    – SEJPM
    Jun 30, 2016 at 14:21
  • This sounds more like a DOS attack than an a mitm
    – Limit
    Jun 30, 2016 at 15:05

1 Answer 1

Reset to default
2

Typically, controls are put in place to prevent "access to any upstream server". This includes:

  • Proper device hardening for routers and switches
  • Properly configured DNS servers
  • Network monitoring solutions to detect MiTM attacks on the local LAN
  • Certificate Authorities (CAs) to verify that the correct cert is used in the SSL handshake with the server

You'll have to clarify what you mean by "stop packets from going to a particular website". How would someone perform a MiTM if the attack if the packets are stopped. Do you mean redirected to a malicious site that the MiTM attacker owns? In that case, the CAs and the cert itself are the mitigating controls for this type of attack (think cert warnings by the browser).

Improve this answer
2
  • MITM in general redirects to a different website he owns as you said. By "stop packets from going to a particular website", I meant this - someone who can access a router can configure it in a way such that packets going to a destination are destroyed. I know that he will not get any gain by doing that. But, I just wonder if that can be a possibility as he can disrupt the normal network traffic. "stop packets..." might not qualify as a MITM attack, I just said that because a third person is interrupting network traffic.
    – AV94
    Jun 30, 2016 at 15:04
  • 1
    In that case, it's referred to as "availability impact by a malicious actor". And the same mitigating controls mentioned in the answer apply. Protect the network and devices within your scope with configuration hardening, long complex passwords, and enable monitoring.
    – HashHazard
    Jun 30, 2016 at 15:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .