If a 3rd party who is malicious manages to get a hold of a SSL private key for domain (ex: xyz.com), but does not have access to the domain registrar or DNS for the domain, how can the 3rd party utilize the SSL private key? Would they be able to man in middle? What are potential attack vectors?
The attacker can use the private key to either mount an active man in the middle attack or decrypt passively sniffed traffic if RSA key exchange was used. The exact possibilities of an active man in the middle attack depends on the abilities and location of the attacker in the network. Some examples:
- If the attacker is inside the local network of the victim he might try to use ARP spoofing or DHCP spoofing to either incorporate the router or the DNS server used by the victim.
- At the ISP level the attacker could reroute DNS requests to a DNS server under his own control and this way direct the victim to its own fake system which uses the stolen certificate and key.
- Similar attacks could be done if the attacker is near the original server or near the authoritative name server for the domain with the compromised certificate.
- An attacker at a different ISP could also bring itself in the path to the original server or the authoritative DNS server by rerouting traffic using BGP spoofing.
For more information see the related questions What can an attacker do with a stolen SSL private key? What should the web admin do? and Can an attacker reuse stolen SSL private key to recreate that domain on his server.