MX record Man In The Middle Attack?

Question

In theory it should be possible to change a MX record of site A (aspmx.exampleA.com) to site B (aspmx.exampleB.com) and send the mail back to site A (aspmx.exampleA.com) So you can intercept all the mails, without having to worry about SSl/HTTPS and cracking the users passwords.

EDIT: What about servers with TLS enabled? See https://www.rfc-editor.org/rfc/rfc3207#section-6

A man-in-the-middle attack can be launched by deleting the "250 STARTTLS" response from the server. (...) In order to defend against such attacks both clients and servers MUST be able to be configured to require successful TLS negotiation of an appropriate cipher suite for selected hosts before messages can be successfully transferred.

Answer 1

DNS poisoning and MiTM are not necessarily the same thing. You can poison DNS without then fowarding the traffic on to the real source. E-mail is a stateless transaction, you would just need to receive the transmission, in most cases there is no immediate reply. Now, of course if you forward the message to the real recipient they will respond and you can then capture the next reply back to the poisoned target.

In a basic setup this should work. Obviously this won't defeat messages encrypted with PGP or equivalent since those are at a higher layer. I need to check back after some research, but I think that there are some peer-to-peer trust protocols or similar which would detect that a rogue was in place, but those are not basic/standard.

Edit: Actually this could work both on the SMTP and POP/IMAP side. Obviously doesn't work if IP addresses are used without name resolution.

Answer 2

Yes I believe the TS was asking and mixing about DNS cache poisoning and MiTM to sniff email messages. Web Design Hero is correct. Poisoning and MiTM are two different things. Just to add up, this is my explanation of things since these are two different attack types and there are many techniques to this.

With DNS cache poisoning, there are two (2) options you can consider:

1. You can choose to exploit a flaw in the DNS server to access the records OR
2. You can choose to access the DNS records in a different method (using MiTM) without the need to exploit a flaw in the DNS system. What you are up to are the credentials you need to access the DNS records.

Cache poisoning works when you fill-up invalid entries to the DNS in order that subsequent DNS requests will be resolved to the malicious DNS entries once a refresh has occurred. It means if you have sample.com as your domain, and you have:

    sample.com.        IN      MX  10   mail.sample.com.

The attacker can do:

    sample.com.        IN      MX  10   mail.smple.com.

Upon refresh, this will be propagated to other name servers acting authoritatively whether primary or secondary etc. for your domain. The malicious host of course mail.smple.com can relay every copy of the message to the real MX mail.sample.com so everything will look okay. The detection of course is harder because obviously you do not need to check every DNS records in your name server every day not unless you will do a reconfiguration or you had something suspicious.

With MiTM, you are dealing with the network layer. The attacker needs to patch himself with the network in order to conduct the attack. It means you do not specifically need to launch an attack with the name server, you just need to associate yourself with the network to sniff. This usually works as part of the internal network, by spoofing the IP of the gateway you can start listening traffic by conducting ARP poisoning, broadcasting to the internal network that you are the legitimate gateway and forwarding the traffic to you before it reaches the other end although it can also work public IP via a BGP MiTM. It can actually defeat transport layer security like SSL/TLS not because it breaks them but because the traffic can be routed to a different port.