While I was watching HT RCS Galileo Presentation I came across a term or concept which I'm not familiar with it: "injection proxy".

Could somebody explain this type of attack?


An injection proxy is a man-in-the-middle application that actively monitors traffic and injects (malicious) content based on predefined rules.

This is roughly the attack scenario outlined in the video:

You are a government entity and accessing the traffic of an ISP that you know is used by a criminal suspect A. You want to gain access to A's computer but you only have their e-mail address. So you set up a rule in the interface of your injection proxy that injects malware (possibly delivered through a 0-day browser exploit) into the traffic handled by the ISP as soon as A's e-mail address occurs in a HTTP request to their webmail provider. That is, as soon as A logs in on their webmail, your injection proxy takes action and injects malicious content into the returned HTTP response which silently installs a backdoor on their machine. This of course won't work as easily if A uses TLS when browsing since you can't easily inject content into HTTPS traffic.

A paper on details about HackingTeam's "Injection Proxy Appliance" can also be found on Wikileaks:

IPA (Injection proxy appliance) is a offensive security device developed by HT for performing remote installation of Remote Control System, by using man in the middle attack techniques and by using proprietary streamline injection mechanism.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for?Browse other questions tagged or ask your own question.