While I was watching HT RCS Galileo Presentation I came across a term or concept which I'm not familiar with it: "injection proxy".
Could somebody explain this type of attack?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
An injection proxy is a man-in-the-middle application that actively monitors traffic and injects (malicious) content based on predefined rules.
This is roughly the attack scenario outlined in the video:
You are a government entity and accessing the traffic of an ISP that you know is used by a criminal suspect A. You want to gain access to A's computer but you only have their e-mail address. So you set up a rule in the interface of your injection proxy that injects malware (possibly delivered through a 0-day browser exploit) into the traffic handled by the ISP as soon as A's e-mail address occurs in a HTTP request to their webmail provider. That is, as soon as A logs in on their webmail, your injection proxy takes action and injects malicious content into the returned HTTP response which silently installs a backdoor on their machine. This of course won't work as easily if A uses TLS when browsing since you can't easily inject content into HTTPS traffic.
A paper on details about HackingTeam's "Injection Proxy Appliance" can also be found on Wikileaks:
IPA (Injection proxy appliance) is a offensive security device developed by HT for performing remote installation of Remote Control System, by using man in the middle attack techniques and by using proprietary streamline injection mechanism.