3

OK, so there are two things here: being able to read the content of the requests and responses, and then being able to modify them. The former may depend on the latter, I'm not sure.

But basically, the question is this: What vantage point would one need in order to carry out an MITM attack? In other words, would an attacker just need to be in range of the unencrypted WLAN over which the target connection is taking place? (Firesheep clearly demonstrates that such a level of access enables one to intercept and read requests, but does it also allow one to modify requests and responses before they reach their destinations?) Would you actually need to have access to the LAN router? Would you need to be an ISP or internet backbone? What level of privileged access is required by an attacker, if any?

Improve this question
0

3 Answers 3

Reset to default
3

To perform a MiTM attack the attacker needs to be able to intercept traffic. Some attacks require intercepting traffic only in one direction while other require intercepting traffic in both directions.

There are three situations in which an attacker can intercept traffic between a source and a destination:

  1. The attacker is on the route between the source and the destination. This could occur if the source machine connects via the attacker's access point (e.g. via AP spoofing) or if the attacker owns a router on the "legitimate" route (e.g. the attacker is an ISP).
  2. The attacker fools the source to think that the attacker's machine is the destination. Examples of this are DNS spoofing and phishing.
  3. The attacker has invasive access to the physical media connecting one machine on the route to another. This is generally the situation in cable networks which is why the DOCSIS standard includes BPI/SEC to protect communications at the MAC level.
  4. (Edited to add:) The attacker can access packets on the source machine or on the destination machine. An example of this is a Man-in-the-Browser attack.
Improve this answer
0
1

Firesheep is not a MitM. It just reads the auth cookie.

For MitM, you just need to be between the client and server. If you run an open WAP, you could "allow" people to connect to it and "proxy" their connection.

Improve this answer
2
  • So you have to be an authorized link in the chain of the networking infrastructure used for the targeted connection, then? You know about ex-parrot.com/pete/upside-down-ternet.html ?
    – wwaawaw
    Sep 14, 2012 at 4:21
  • Sorry, I guess I was looking for a little bit more detail. I asked a more thorough version on crypto.SE.C, but I'm now thinking that it may have been an actually less appropriate site for the Q. crypto.stackexchange.com/questions/3796/… If you have priveleges perhaps you'd like to migrate it over.
    – wwaawaw
    Sep 14, 2012 at 4:50
1

The question essentially boils down to how secure the network is and what you consider is allowable in your model.

"Non-authorized" users can still try to hack the network, using many different techniques - this is the very broad field of network security. From ARP spoofing to DNS poisoning to session hijacking to WPAD attacks, the list goes on and on. It's not a matter of cryptography per se, rather of faulty/vulnerable network infrastructure. Whether this falls under the definition of "without controlling the router or being one of the relay points through which Alice's traffic is explicitly routed through" is subjective. But by exploiting such vulnerabilities, Mal can become an active attacker and be in a position to mount the MITM attack.

Improve this answer
1
  • Basically there are attacks that allow one to add themselves to the routed path.
    – ewanm89
    Sep 14, 2012 at 10:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .