I have recently understood how SSL handshake works.I understand that once the handshake is done, everything is shared by secret key between server and client. I want to know what happens if Man in the middle attack occurs during the handshake? Though there is nothing attacker can get from that. By MITM attack, I mean this - he can get access to any upstream server and stop packets from going to a particular website. This would cause disruption of authentication right. This problem is not just specific to SSL handshake as it can happen anytime when MITM stops packets going to a particular destination.So my question is that what practices are followed to stop these kind of attacks?
Typically, controls are put in place to prevent
"access to any upstream server". This includes:
- Proper device hardening for routers and switches
- Properly configured DNS servers
- Network monitoring solutions to detect MiTM attacks on the local LAN
- Certificate Authorities (CAs) to verify that the correct cert is used in the SSL handshake with the server
You'll have to clarify what you mean by
"stop packets from going to a particular website". How would someone perform a MiTM if the attack if the packets are stopped. Do you mean redirected to a malicious site that the MiTM attacker owns? In that case, the CAs and the cert itself are the mitigating controls for this type of attack (think cert warnings by the browser).