2

Okay, suppose that I have 2 computers: Computer A and Computer B, connected with this setup:

A->switch->router->internet
          /
B->router/

and the closest router to computer B is configured to block connections from Computer As switch.

If computer A is desperately trying to attack computer B, sniffing packets, MiTM attacks, etc., how much bigger/smaller attack surface does it have than the usual

Computer A ->router->internet
           /
Computer B/
|improve this question
  • You are not providing us with enough details to answer your question thoroughly. We would need to know the addressing configuration of the two routers, and any firewall rules. In the question and GdD's comment you state that A's router and B's router are blocked from communicating. If this is the case, then computer B is offline and you might want to consider an OOB approach. – David Houde Mar 22 '14 at 11:27
  • @DavidHoude What other config details do you need other than the firewall status? EDIT: also by computers A router I meant the switch not the router connecting to the internet sorry about that. – user36976 Mar 22 '14 at 11:32
1

It depends on what type of MitM attack you want to do.

arp spoofing or any type of attack which relies upon Layer 2 will not work across routing domains.

However, you can perform other attacks such as modifying a host file, DNS spoofing, or other attacks at the network level. You could attack the router itself so all traffic is directed to you, etc. You could trick the victim into installing malware which will redirect all requests to your server first.

If your specific host is being blocked at any point, you can use another machine or compromise another machine to try to find a valid path to your victim.

|improve this answer
1

The basic rule is that on the same ethernet network, IP address spoofing is possible, usually by performing ARP spoofing.

In your second scenario, computer B is completely vulnerable to computer A. Well, unless there is protection at a higher layer, e.g. using SSL.

In this scenario, computer B is NOT vulnerable to computer A:

Computer A --> Router -\
                        >- Internet
Computer B --> Router -/

Of course, this assumes that both the routers are trusted.

In your first scenario, computer B is still vulnerable. Although it is on a separate ethernet network, the problem is that B's router is on the same ethernet network as A. So although A can't directly spoof B, it can spoof B's router, which still allows A to MITM.

|improve this answer
  • In your scenario you have 2 routers pointing to the internet isn't that impossible to do on a single phone line? At least on my tests when tried that the 2 routers were fighting who gets connected(one connects, second connects kicks the first out etc) – user36976 Mar 22 '14 at 15:50
  • 1
    @Nick - ok, then in your first scenario, swap round computers A and B - so the hostile computer is separated by an extra router. – paj28 Mar 22 '14 at 15:54
  • What will that do differently than a switch as it is now? – user36976 Mar 22 '14 at 15:56
  • 1
    @Nick - A router stops ARP spoofing, while a switch doesn't. This link may help: irongeek.com/i.php?page=security/arpspoof – paj28 Mar 22 '14 at 15:59
0

Computer A needs to control a device which handles Computer B's traffic on order to perform a MiTM attack. In your top scenario there's a bigger attack surface because there are 2 routers that computer A can attempt to compromise.

|improve this answer
  • as said above Computer As switch(router)s local IP is firewalled off computer Bs router. – user36976 Mar 22 '14 at 10:30
  • You were asking about attack surface. Even if router B blocks connections from router A it still is part of the attack surface, after all who's to say it does not have an exploitable vulnerability? – GdD Mar 22 '14 at 15:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.