0

Good afternoon experts,

I'd have a basic question about security but not having the knowledge it is a puzzle for me.
Let's say there is an application (I don't think it is relevant but it is a Java app) that sends requests to the server (Java also) and the server sends back the command in the response that has to be executed. Also let's say we are not on the Internet but on the intranet of a firm that is more secure.
Can somebody/something hijack the request of the client and send back a malicious one? How can it be prevented? Would HTTPS solve the problem?

What would you suggest to do to prevent any third-party to listen to the communication?

Thanks, V.

1

Encryption (https) is the best way to prevent a "man in the middle" attack that you're describing. It is possible to MITM encryption but it's rather difficult to pull off, even for seasoned veterans.

Assuming the communication as it stands now is in plain text (not encrypted) then yes, people can use a MITM attack to get the client to think they are the server, and the server to think they are the client. That would allow them to see traffic from both sides, hence man in the middle. The even easier method would be to simply "sniff" the traffic which means that the traffic isn't directed toward the attacker from either computer, but rather they simply take a copy of the traffic as it passes through the network. Sniffing is not as easily detectable as MITM but if the attacker attempts to spoof an the client IP that they were sniffing in order to send malicious traffic, that normally is much easier to detect.

The simple answer for prevention is encryption stops 99.9% of these issues. The long answer is convoluted and sounds very similar to a conspiracy theory, just know that no method of prevention is perfect. Eliminating low hanging fruit fends off most attackers out there, there's too much easily hackable stuff out there to spend time on one target... unless there's sufficient motivation.

1

In your example, an eavesdropper (E) will need to have access to the communications between the application (A) and the server (B). This may be done by compromising routers in your network, or by masquerading as a legitimate WiFi router. It's not easy, but not impossible in most networks.

Note that if E managed to compromise your equipment, they might also compromise the server and manipulate the application. In short, at this point you have bigger security problems than securing the communication between A and B and you should focus your resources in ensuring the integrity of your network.

But let's say that E manages to get in the network and wants to stay stealthy by not touching A or B. E just wants to listen to the communications between A and B. A and B could communicate securely by either: having the certificate of each other (A has the certificate of B and trusts that it's legitimate), or having the certificate of your company's certification authority in order to verify A and B's certificates (A gets B's certificate over an untrusted channel but A verifies that it's legitimate using A's trust in the certification authority). These certificates can then be used to secure the communications using TLS (HTTPS).

In this threat model, without securing the communications between A and B, E could observe the communications. If E wants to go a step further, it might also temper the data transiting between A and B, depending on E's access to the network.

TL;DR: Defense in depth is a good thing (TM). However, you should take care to evaluate your threats in order to focus your resources in securing the vulnerabilities with the most ROI for the attacker. As each firm is different from another, you should request an audit of your firm to know if it's a good idea to spend resources in securing the communication between A and B.

  • Thanks for the answer! I thought of something similar if somebody could get to the intranet then she/he could do bigger troubles. – Viktor Nov 5 '16 at 17:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.