0

I have tried to perform a mitm attack on one of my pc's which has Eset antivirus installed.

I tried to intercept http/https data by forwarding port 80 & 443 with iptables. Then I used arpspoof command along with mitmproxy for the attack. I also used a on-the-fly ssl certificate with mitmproxy. Once I put everything in place and started the attack, the antivirus on my target pc immediately detected and blocked the attack.

The message I got is the following: Network event blocked - Duplicate IP addresses on network A computer on the network is sending malicious traffic. This can be an attempt to attack your computer. Well yes I redirected the traffic.

So I would like to know, how the antivirus actually was able to detect the attack?

  • 1
    What kind of MITM? – Arminius Mar 25 '17 at 0:17
  • 1
    You didn't mention through what method, tool, or technique you were using to perform it, or what you were trying to evade detection, but I'd imagine if your attack is known about and has expected behaviors, uses a recognizable piece of software, or has some other kind of marker to be a signal an AV vendor can work to create a defense for it. – dreamist Mar 25 '17 at 0:20
  • Still not enough information to know what you were doing: Did it complain about the plain text connection (port 80, http) or only about the encrypted connection (port 443, https)? What exactly was the message you got? Did you just redirect the traffic or did you try to actively man in the middle https - this would be easy to detect since the CA signing the certificate is an untrusted one. – Steffen Ullrich Mar 25 '17 at 8:14
3

Most likely your attempt was detected due to the arp-spoofing attack. This attack send several arp packets in a very short period of time, containing an already-in-use IP address. When a anti-virus (or IPS/IDS) see a machine with this behavior it automatically classify it as malicious and, depending on the software, it may blacklist the IP.

To understand the anatomy of a arp spoofing attack, check this page or this video that details the attack.

  • 1
    It is also possible it detected an issue with an SSL cert, but ARP spoofing is much easier to detect, as it is very noisy – jrtapsell Sep 24 '17 at 22:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.