21

Let's assume an ecommerce site works over HTTP, rather than HTTPS.

What are the practical dangers here? How could an attacker exploit this?

Whenever I read about dangers of unencrypted traffic, it is somehow magically assumed that the attacker has managed to somehow slip into a point between me and the endpoint (establish a MITM).

I get that the owner of the Wi-Fi hotspot could be snatching my data. Or it could be some malicious worker at my ISP.

However, assuming I'm sitting behind my own router and I trust my ISP, how could one set up a MITM attack that'd allow to exploit the lack of encryption?

10
  • 4
    By cutting the wire to your router and setting up an mitm? – yeah_well Jan 12 at 10:22
  • 6
  • 3
    @yeah_well do people often break into your house to install a MitM between your computer and your router on the off chance you use an unencrypted website? – Tim Jan 12 at 22:10
  • 9
    Why do you trust your ISP to be free of malicious actors? – Seth R Jan 12 at 22:12
  • 18
    In my student days, I had friends who worked at ISPs, and they told me stories. Do not trust your ISP. They are usually not malicious, but all kinds of people work there, and there're all human: Some are interns who don't know better, some are bored, some dream of catching evil-doers, and some are just nosy. We all like to imagine that there are fool-proof safeguards in place to prevent ISP employees from looking at your data, but why should they do that? It makes their work harder and does not bring additional revenue. – Heinzi Jan 13 at 9:02
63

You can trust your ISP, but your data will not pass through just your ISP's routers. On a simple level, the internet works by passing data from one router to another, repeatedly moving each packet closer to its destination, until it is hopefully delivered. This means that your connection passes through several routers before finally reaching the site you are connecting to.

Now, as an example, right now, there are 10 routers sitting between me and stackexchange.com. Of these, apparently only the first two or three belong to my ISP. The rest either belong to some internet backbone provider, the server's ISP, or any other upstream ISP that exists between my ISP and the server's ISP. So now, instead of having to trust one ISP, you have to trust at least two ISPs and the internet backbone providers. Now that's a lot of people to trust. If any one of these has a rogue employee with access to install malware on the routers, or any of these routers are misconfigured or using outdated firmware with known vulnerabilities, an attacker can perform a Man in the Middle attack and harvest your credit card details, passwords, PII etc. as well as inject ads and/or malware and perform any other malicious action they can think of.

And that doesn't even take into account state sponsored attackers and mass surveillance. A state sponsored actor that is interested in getting access to plaintext HTTP traffic doesn't even require a rogue employee or exploitable router vulnerability. They can serve the ISP a subpoena or they can silently tap right into the fiber-optic cables. If the traffic they are targeting doesn't pass through their jurisdiction, they have the resources to perform attacks like BGP hijacking to redirect the traffic through their own jurisdiction.*


*In at least one incident, a non-state sponsored attacker also managed to perform this by hacking an ISP

10
  • 17
    Let's also not forget local malware. As can be demonstrated with Wireshark, for example, encrypted HTTPS traffic is also not readable to local software, while unencrypted HTTP very much is. This means that malware can grab data otherwise inaccessible by reading files or keylogging, like your passwords if you use a password manager (and hence don't type them). Also, malicious VPN apps on android for example, can capture a lot of your data without even needing to bypass the sandbox, that way. For instance, look at HTTP Canary. – user9123 Jan 12 at 22:17
  • 9
  • 2
    @user9123 note that Wireshark on Windows requires you to install a kernel-mode driver and those can do anything (including grabbing the unencrypted text out of the browser process before it gets encrypted) – user253751 Jan 13 at 15:09
  • 1
    If you're on the same Ethernet LAN the traffic passes through, you can also spy on un-encrypted connections using ARP poisoning. (Basically, subverting the automatic route discovery used by Ethernet switches to detour the traffic you're interested in through your machine) Ettercap makes that so easy that I played around with it as a teenager. – ssokolow Jan 14 at 13:12
  • 1
    @user9123: While https might make it harder for local malware to capture data, it doesn't make it impossible, depending on the sophistication of the malware. E.g., nothing stops the malware from using MITM with its own certificate or just replacing your browser with a corrupted browser. – Brian Jan 14 at 15:27
15

I trust my ISP

There's the start of your problem. ISPs performing MITM attacks to modify cleartext http traffic, adding in their own trackers, additional or replacement ads, overage and nonpayment warnings, etc. has become the norm. And aside from being outright malicious in themselves, these things can all introduce new vulnerabilities into the sites you're visiting.

4
  • 2
    OP acknowledged that the ISP can MITM the connection, but is interested in other MITM possibilities. For the sake of the question, we assume that the ISP can be trusted. It's not helpful then to point out that the ISP cannot be trusted. – Sjoerd Jan 13 at 11:53
  • 10
    @Sjoerd It's perfectly fine to frame-challenge an assumption if that assumption is clearly a bad one. For example I could post a question that says "Is it safe to attach a spare copy of my key on my front door, assuming that I trust every member of the public who might walk past?". Sure, in that case it is safe, but only because of a poor assumption. Also, this answer raises the point that even if you consider things like trackers and ads to be "safe" (i.e. covered by the assumption), there can be indirect security consequences. It's a worthy answer on that basis alone. – Jon Bentley Jan 13 at 12:21
  • Heck my workplace does MITM of all traffic, all the time. Its not just ISPs. – Criggie Jan 13 at 22:00
  • 2
    @Criggie: Your workplace is probably doing something a little different, also including issuing fake certificates from a custom root CA added to client devices, and just inspecting/logging/filtering what's accessed rather than adding dubious js into pages. – R.. GitHub STOP HELPING ICE Jan 14 at 0:29
4

There are lots of opportunities to get in the middle after the traffic leaves your home router.

The two big opportunities that come to mind are:

  • governments routing traffic from the ISP through their infrastructure (widespread or targetted surveillance)
  • MITM on the server side

But MITM is not the only threat. Traffic can be logged by the various routers and infrastructure, so while they might not get all traffic, they can see and log things like passwords, metadata, etc.

1
  • 2
    Can you expand on what you mean by "MITM on the server side"? – trallgorm Jan 12 at 19:47
2

Normal copper wires which are sending digital signals are acting similar to antennas. If one knows let us say, your Monitor refresh rate and resolution one can even sniff what is on your screen from the outside using a directional antenna. Same applies to network wires. Those cables are shielded but sniffing from over the ground without digging or cutting the wire is possible. This does not apply to fiber optics of course.

Here is a Youtube tutorial on how to spy on an Acer 29" monitor with a DVI input:
https://www.youtube.com/watch?v=wWbLMDlV-9M

I was not able to find a tutorial on how to do this with LAN cables. But your local network is never out of scope.

Accordingly to the post software recommendations on tracing commands you have to type on Linux or Unix:

traceroute stackexchange.com -T

to get the route to a homepage, here: stackexchange. You could determine the security of a connection, e.g. what countries your traffic pass and who is involved in transfer. Also consider MD5 checking or similar checksumming in case you transmit code and important data.

You don't need encryption in any case but for passwords, RSA keys, auth cookies, credit card data etc. of your ecommerce site it is recommended. Also protection of privacy might be required somehow in some regions such as the European Union. There you have to apply the legal text of the General Data Protection Regulation (GDPR).

1

I would also point out that with HTTPS encryption is not the only thing you get, you also get the validation of the target server. So when you load https://gmail.com, your browser will check the provided certificate whether it is signed by a known Certificate Authority. If that is the case then and there is no other problem with the certificate, then you will get the green lock in your browser in the address line, and no warning.

Now when an attacker tries to phish your gmail password and tricks you into loading https://gma1l.com (note the 1 as i) or manages to do a DNS attack and the https://gmail.com will actually take you to a malicious site, then the last line of defence is the certificate validation. If the cert is fake, then the browser will throw you a warning, which is very suspicious in case of a well-known service like gmail.

If you don't use HTTPS at all, then you lose all these defence mechanisms.

1
  • Bear in mind that HTTP/2 removes the intrinsic connection between encryption and the https:// URL scheme, supporting an Opportunistic Encryption (OE) option which uses the same encryption with an http:// URL and doesn't raise certificate errors if you use a self-signed cert. The intent is allow connections that otherwise wouldn't have encryption to gain it to complement the switch to HTTPS where feasible and, in doing so, to make NSA-scale passive surveillance prohibitively expensive. – ssokolow Jan 14 at 13:07
1

Easiest way to answer this without techno lingo or knowledge in the field.

If you're not using HTTPS, and only HTTP.

If the server the website is on is compromised, there can be an app listening to the network activity

Therefore any form submissions, including that of credit cards can be easily logged by the app, since it's not encrypted these fields will have labels and values making it very easy for the app to parse and send the "important" information to whatever destination they choose.

As for the last part of your question which is referred to "network sniffing". If you've ever done a domain trace you'll notice half a dozen or more different networks you ultimately connect to. If any other those are compromised like I mentioned above, again information will be received easily identifiable.

For your own network, or public network like at a coffee shop. If anyone can obtain access to the "admin" of the router they can easily monitor the traffic, and once again the same rules apply for any system compromised.

0

If you don't use encryption, you have two issues: MITM (where the rogue agent is actually between the two endpoints, and can not only intercept, but also change things on the way), and eavesdropping (where you passively listen to traffic and can learn a lot of things — you can even do that from a distance in some cases).

Places/ways this can happen (I won't consider the case where your computer is compromised, because in that case even encryption may not help):

  • You use Wi-Fi, and didn't set up encryption. Uncommon at home/work nowadays, but I'm sure that still happens. Also, of course, all the public Wi-Fi hotspots you may use (and you will use one some day or another).

  • Your router could have been compromised. You forgot to change the default password, or used a password that is too easy. A firmware update was compromised. There's a backdoor. There's an unpatched vulnerability.

  • The wire or fibre from your place to your ISP goes through cabinets in the streets, some of which are a bit too easy to get into. Depending on the exact technology used, either eavesdropping or MITM may be easy to perform at any of those points. Wiretapping is still a thing. You've probably heard stories of people hijacking someone's Internet access by moving a wire. Similar issue, except you probably won't even notice if your Internet connection still works...

  • Any of the routers or switches of any of the ISPs between you and the site could have been compromised. A rogue employee, a compromised firmware update, a vulnerability... Or it could even be an officially sanctioned or required measure (mostly in dictatorial states, but things can change fast).

  • Long-distance links could be tapped.

  • Fun story: a couple decades ago, a ISP I worked for was approached by some shady government instance which wanted to install boxes on our network to "measure e-mail traffic". "Just connect them to a switch port in mirror mode". Yeah, sure. No thanks.

Some measures need to target you quite specifically. Others can be done at places were lots of trafic will go through. Others can be done by just casting a wide net (e.g. infection of all routers of model X with unpatched firmware version Y) and waiting for data to come in (like phishing campaigns).

0

Your question, and the currently top-ranked answer, seem to have the implicit assumption that in order to execute a MITM attack, the attacker needs to be in the middle of the network path. So if you trust the path, what's the problem?

Sure, you could be a target of state-sponsored surveillance, or a criminal mastermind could go through the work of obtaining a job at an ISP, gaining sufficient seniority, reputation, and trust to gain access to the routers, then attempt to slip in some malicious configuration that intercepts traffic all while circumventing the ISP's internal security measures and hoping none of their peers notices the exploit because that would certainly subject the attacker to investigation and criminal charges. But I think these are relatively unlikely scenarios.

More likely, I think, is an attack by someone who does not have any privileged access to the network infrastructure, but instead someone who is attempting to remain anonymous, attacking you from a cyber cafe while wearing a ski mask.

So, a likely attack isn't someone with physical access to your network path, but rather an attack on the protocols that determine the network path, so the attacker can bring the data to them, where there aren't things like employment records, security cameras, audit logs, or do-gooder coworkers that might report a security breach.

Those protocols include for example BGP and DNS, which (surprise!) neither one was designed with security in mind in the least, and each have a rich history of exploitation.

And while acknowledging I said it was not so important, do keep in mind that you're not trusting just the ISPs that your traffic goes through, but also every ISP that your DNS traffic goes through, and also any ISP peered with any of those other ISPs that would accept a BGP advertisement for an IP address you care about, which is ostensibly a least-privilege set, but in practice ISPs are really bad at this.

So really, the number of people that could decide to intercept your traffic by abusing their privileged access to the network probably number at least 10,000. In fact it's amazing the internet works at all, but the reason why is the same reason most people don't get murdered even though anyone could do it at any time: most people aren't jerks, and jail time is sufficient deterrent for most of the rest.

So then, why does encryption matter? Maybe it's not so important. Despite the claims of "trust us, it's encrypted!" which for some reason appear on the pages of every website attempting to profit from the collection of sensitive or personal information, it's not encryption that you need, but authentication.

HTTPS with encryption but no authentication wouldn't be secure at all, and this is why your browser throws up a full-screen modal warning when it can't authenticate the server but only an easily missed "not secure" by the address when the traffic isn't encrypted.

0

MITM is not the only problem here, simply leaking sensitive data could be just as bad. Consider this:

  • If I want to steal your credit card number which you exchange with a website over HTTPS, I must break into either your computer or the server hosting the website.

  • If the same exchange happens over HTTP, I could break into a couple dozens of systems along the network route from you to the website, make a TCP dump, and see your data just as clear.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.