0

I've recently read about Diffie-Hellman Man-in-the-Middle attack when a third party can intercept messages and thus construt two different symetric keys with both sides. However I still don't understand how the intercepting how the messages works. Does the third party can "catch" messages and throw them away? perhaps this is a general networking question, rather than security, but I hope I could find the answer here.

To be technical: if A sends some message M to B, I understand how he can read it, maybe alter and to send M' to B, but how does he prevent from he original M to be sent to B?

1 Answer 1

0

Lets look at a client server example like a website. The client (browser) communicates with a server (web site). The "Man-in-the-Middle" (MitM) in this case convinces the client that he is the server, so the client thinks it is talking to the website. The "MitM" also convinces the website he is the client. Communication is then completely controlled by the "Man-in-the-Middle".

For a low tech example think about a King communicating with a General centuries ago, by having a messenger carry letters between them. It is not just that the messenger can read the messages, but lets say the messenger can forge the King and General's handwriting. The messenger can then pretend to be the King to the General, and the General to the King. Controlling all communication.

This can happen in many ways (in fact any non-in-person communication should have some measures to prevent MitM attacks), so it is not a "general" networking question.

But for one simplified real example that includes networking: if we are both at a coffee shop, I (armed with some software and a wifi adapter) can pretend to be a wifi access point (AP), and display it as "Cafe X - Guest Wifi (Free)", in hopes someone will connect. If you take the bait, then I can act as the MitM for all your communication -- intercepting and injecting packets.

3
  • Thank you for this detailed answer. Maybe I wasn't very clear (edited the post) but I wanted to focus on the technical idea of intercepting messages. If A sends some message M to B, I understand how he can read it, maybe alter and to send M' to B, but how does he prevents from he original M to be sent to B?
    – chendoy
    Commented May 5, 2020 at 19:31
  • @user112112 I can try an rewrite my answer to clarify, but I was trying to explain that in the case of MitM attack, A is not sending a message M to B. A is sending a message M to C (the MitM) and C is sending M (or M') to B. Focusing on the technical details, it would help to understand the use case. If the one I mentioned about wifi APs is of interest, I can try and get more technical about that.
    – iraleigh
    Commented May 5, 2020 at 19:40
  • I get it now. I misunderstood MitM. Thank you.
    – chendoy
    Commented May 5, 2020 at 19:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .