12

In a conversation on twitter I warned a site about a security vulnerability. Specifically, the possibility of a MITM (Man in the Middle) attack used to compromise their registration form.

The response to my warning was that "We protect against man in the middle attacks. So still doesn't apply."

Is it possible to "protect" against a MITM attack without implementing SSL (I'm aware SSL isn't bulletproof either, but always thought it was the first step)?

Improve this question

3 Answers 3

Reset to default
12

They are doing post submission over SSL. This will provide protection against a passive MITM since the credentials would be encrypted on the post back, however, it does effectively nothing against an active attacker that is able to alter traffic since they could simply alter the postback URL and the user experience would not change.

A smart client could verify the integrity of the postback URL prior to credential submission (including inspecting the page for any javascript that may alter the URL) and avoid a MITM attack, but practically, for the average internet user, it is not secure. The site you were visiting really should switch to providing the login screen on a fully HTTPS page.

Improve this answer
3
  • "It's also worth noting that Moot isn't doing anything wrong, just the website you were visiting is embedding the login in an insecure manner." Normaly this would be true, except the website in this case is their website; the one used to register for their product (both the forum and comment system). They link to it directly from their home page.
    – David Murdoch
    Commented Apr 9, 2013 at 19:00
  • @DavidMurdoch - I suppose it is, then their twitter guy was wrong saying it was embedded in a third party site and yes, it is insecure to active attacks.
    – AJ Henderson
    Commented Apr 9, 2013 at 19:15
  • Voted yours as correct instead of Thomas' because he's already got 65k+ more rep than you. Both answers are equally helpful.
    – David Murdoch
    Commented Apr 9, 2013 at 23:25
10

To really protect against man-in-the-middle attacks, you have to:

  • apply some kind of integrity check on all exchanges between client and server;
  • enforce at least one-way authentication (the server must authenticate the client, or the client must authenticate the server).

Basically, doing what SSL does. In a Web context with plain HTTP, the client is stupid and won't do the necessary things. To make the client "intelligent", you have to include some code on the client side, i.e. Javascript -- but if you don't download that Javascript over HTTPS, you lose.

So my guess is that your interlocutor is misguided, or deliberately lies to you, or both.

Improve this answer
0

Man in the Middle is a hard problem to protect against. Its kind of like saying is there a way to stop time, or is there a lock that isn't pickable. My general answer is "no" there isn't a way to generically protect, carte blanche against MiTM attacks, period, nor is there even a good way to stop them.

The best way to always solve these problems is with a layered solution, to raise the bar against a MiTM attack. Otherwise any single point solution will always be bypassed and voila, you have a man in the middle.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .