How does one take advantage of unencrypted traffic?

Question

Let's assume an ecommerce site works over HTTP, rather than HTTPS.

What are the practical dangers here? How could an attacker exploit this?

Whenever I read about dangers of unencrypted traffic, it is somehow magically assumed that the attacker has managed to somehow slip into a point between me and the endpoint (establish a MITM).

I get that the owner of the Wi-Fi hotspot could be snatching my data. Or it could be some malicious worker at my ISP.

However, assuming I'm sitting behind my own router and I trust my ISP, how could one set up a MITM attack that'd allow to exploit the lack of encryption?

Answer 1

You can trust your ISP, but your data will not pass through just your ISP's routers. On a simple level, the internet works by passing data from one router to another, repeatedly moving each packet closer to its destination, until it is hopefully delivered. This means that your connection passes through several routers before finally reaching the site you are connecting to.

Now, as an example, right now, there are 10 routers sitting between me and stackexchange.com. Of these, apparently only the first two or three belong to my ISP. The rest either belong to some internet backbone provider, the server's ISP, or any other upstream ISPs that exists between my ISP and the server's ISP. So now, instead of having to trust one ISP, you have to trust at least two ISPs and the internet backbone providers. Now that's a lot of people to trust. If any one of these has a rogue employee with access to install malware on the routers, or any of these routers are misconfigured or using outdated firmware with known vulnerabilities, an attacker can perform a man in the middle attack and harvest your credit card details, passwords, PII etc. as well as inject ads and/or malware and perform any other malicious action they can think of.

And that doesn't even take into account state sponsored attackers and mass surveillance. A state sponsored actor that is interested in getting access to plaintext HTTP traffic doesn't even require a rogue employee or exploitable router vulnerability. They can serve the ISP a subpoena or they can silently tap right into the fiber-optic cables. If the traffic they are targeting doesn't pass through their jurisdiction, they have the resources to perform attacks like BGP hijacking to redirect the traffic through their own jurisdiction.*

---

^{*In at least one incident, a non-state sponsored attacker also managed to perform this by hacking an ISP}

Answer 2

I trust my ISP

There's the start of your problem. ISPs performing MITM attacks to modify cleartext http traffic, adding in their own trackers, additional or replacement ads, overage and nonpayment warnings, etc. has become the norm. And aside from being outright malicious in themselves, these things can all introduce new vulnerabilities into the sites you're visiting.

Answer 3

There are lots of opportunities to get in the middle after the traffic leaves your home router.

The two big opportunities that come to mind are:

• governments routing traffic from the ISP through their infrastructure (widespread or targetted surveillance)
• MITM on the server side

But MITM is not the only threat. Traffic can be logged by the various routers and infrastructure, so while they might not get all traffic, they can see and log things like passwords, metadata, etc.

Answer 4

Normal copper wires which are sending digital signals are acting similar to antennas. If one knows let us say, your Monitor refresh rate and resolution one can even sniff what is on your screen from the outside using a directional antenna. Same applies to network wires. Those cables are shielded but sniffing from over the ground without digging or cutting the wire is possible. This does not apply to fiber optics of course.

Here is a Youtube tutorial on how to spy on an Acer 29" monitor with a DVI input:
https://www.youtube.com/watch?v=wWbLMDlV-9M

I was not able to find a tutorial on how to do this with LAN cables. But your local network is never out of scope.

Accordingly to the post software recommendations on tracing commands you have to type on Linux or Unix:

traceroute stackexchange.com -T

to get the route to a homepage, here: stackexchange. You could determine the security of a connection, e.g. what countries your traffic pass and who is involved in transfer. Also consider MD5 checking or similar checksumming in case you transmit code and important data.

You don't need encryption in any case but for passwords, RSA keys, auth cookies, credit card data etc. of your ecommerce site it is recommended. Also protection of privacy might be required somehow in some regions such as the European Union. There you have to apply the legal text of the General Data Protection Regulation (GDPR).

Answer 5

I would also point out that with HTTPS encryption is not the only thing you get, you also get the validation of the target server. So when you load https://gmail.com, your browser will check the provided certificate whether it is signed by a known Certificate Authority. If that is the case then and there is no other problem with the certificate, then you will get the green lock in your browser in the address line, and no warning.

Now when an attacker tries to phish your gmail password and tricks you into loading https://gma1l.com (note the 1 as i) or manages to do a DNS attack and the https://gmail.com will actually take you to a malicious site, then the last line of defence is the certificate validation. If the cert is fake, then the browser will throw you a warning, which is very suspicious in case of a well-known service like gmail.

If you don't use HTTPS at all, then you lose all these defence mechanisms.

Answer 6

Easiest way to answer this without techno lingo or knowledge in the field.

If you're not using HTTPS, and only HTTP.

If the server the website is on is compromised, there can be an app listening to the network activity

Therefore any form submissions, including that of credit cards can be easily logged by the app, since it's not encrypted these fields will have labels and values making it very easy for the app to parse and send the "important" information to whatever destination they choose.

As for the last part of your question which is referred to "network sniffing". If you've ever done a domain trace you'll notice half a dozen or more different networks you ultimately connect to. If any other those are compromised like I mentioned above, again information will be received easily identifiable.

For your own network, or public network like at a coffee shop. If anyone can obtain access to the "admin" of the router they can easily monitor the traffic, and once again the same rules apply for any system compromised.

Answer 7

If you don't use encryption, you have two issues: MITM (where the rogue agent is actually between the two endpoints, and can not only intercept, but also change things on the way), and eavesdropping (where you passively listen to traffic and can learn a lot of things — you can even do that from a distance in some cases).

Places/ways this can happen (I won't consider the case where your computer is compromised, because in that case even encryption may not help):

• You use Wi-Fi, and didn't set up encryption. Uncommon at home/work nowadays, but I'm sure that still happens. Also, of course, all the public Wi-Fi hotspots you may use (and you will use one some day or another).

• Your router could have been compromised. You forgot to change the default password, or used a password that is too easy. A firmware update was compromised. There's a backdoor. There's an unpatched vulnerability.

• The wire or fibre from your place to your ISP goes through cabinets in the streets, some of which are a bit too easy to get into. Depending on the exact technology used, either eavesdropping or MITM may be easy to perform at any of those points. Wiretapping is still a thing. You've probably heard stories of people hijacking someone's Internet access by moving a wire. Similar issue, except you probably won't even notice if your Internet connection still works...

• Any of the routers or switches of any of the ISPs between you and the site could have been compromised. A rogue employee, a compromised firmware update, a vulnerability... Or it could even be an officially sanctioned or required measure (mostly in dictatorial states, but things can change fast).

• Long-distance links could be tapped.

• Fun story: a couple decades ago, a ISP I worked for was approached by some shady government instance which wanted to install boxes on our network to "measure e-mail traffic". "Just connect them to a switch port in mirror mode". Yeah, sure. No thanks.

Some measures need to target you quite specifically. Others can be done at places were lots of trafic will go through. Others can be done by just casting a wide net (e.g. infection of all routers of model X with unpatched firmware version Y) and waiting for data to come in (like phishing campaigns).

Answer 8

Your question, and the currently top-ranked answer, seem to have the implicit assumption that in order to execute a MITM attack, the attacker needs to be in the middle of the network path. So if you trust the path, what's the problem?

Sure, you could be a target of state-sponsored surveillance, or a criminal mastermind could go through the work of obtaining a job at an ISP, gaining sufficient seniority, reputation, and trust to gain access to the routers, then attempt to slip in some malicious configuration that intercepts traffic all while circumventing the ISP's internal security measures and hoping none of their peers notices the exploit because that would certainly subject the attacker to investigation and criminal charges. But I think these are relatively unlikely scenarios.

More likely, I think, is an attack by someone who does not have any privileged access to the network infrastructure, but instead someone who is attempting to remain anonymous, attacking you from a cyber cafe while wearing a ski mask.

So, a likely attack isn't someone with physical access to your network path, but rather an attack on the protocols that determine the network path, so the attacker can bring the data to them, where there aren't things like employment records, security cameras, audit logs, or do-gooder coworkers that might report a security breach.

Those protocols include for example BGP and DNS, which (surprise!) neither one was designed with security in mind in the least, and each have a rich history of exploitation.

And while acknowledging I said it was not so important, do keep in mind that you're not trusting just the ISPs that your traffic goes through, but also every ISP that your DNS traffic goes through, and also any ISP peered with any of those other ISPs that would accept a BGP advertisement for an IP address you care about, which is ostensibly a least-privilege set, but in practice ISPs are really bad at this.

So really, the number of people that could decide to intercept your traffic by abusing their privileged access to the network probably number at least 10,000. In fact it's amazing the internet works at all, but the reason why is the same reason most people don't get murdered even though anyone could do it at any time: most people aren't jerks, and jail time is sufficient deterrent for most of the rest.

So then, why does encryption matter? Maybe it's not so important. Despite the claims of "trust us, it's encrypted!" which for some reason appear on the pages of every website attempting to profit from the collection of sensitive or personal information, it's not encryption that you need, but authentication.

HTTPS with encryption but no authentication wouldn't be secure at all, and this is why your browser throws up a full-screen modal warning when it can't authenticate the server but only an easily missed "not secure" by the address when the traffic isn't encrypted.

Answer 9

MITM is not the only problem here, simply leaking sensitive data could be just as bad. Consider this:

• If I want to steal your credit card number which you exchange with a website over HTTPS, I must break into either your computer or the server hosting the website.

• If the same exchange happens over HTTP, I could break into a couple dozens of systems along the network route from you to the website, make a TCP dump, and see your data just as clear.