3

Yes. Of course using https everywhere is best. But sometimes that's not an option. In those cases, I'd like to make an informed decision. Is there any information about their prevalence? Or would that all be hidden anyway so no one knows? Does it depend on the site visited?

To be clear: I'm not referring to an attack on my wifi connection. Nor any other kind of attack. I'm asking specifically about connecting to a major ISP (let's assume U.S.) and visiting a site or connecting to my hosted web site. I'm also not asking about the government being the mitm, just anybody else.

  • To clarify: you're asking how common MITM attacks against the internet backbone are? You seem to exclude attacks between your computer and your ISP, so presumably the attack surface left is the backbone and the datacenter. – David Jul 9 '14 at 23:54
  • I'm facing an issue at the moment, my connections are being regularly reset. Often websites certificates are being reset. There is only me on this network. There are no outgoing connections from this computer that aren't accounted for. The router traffic seems legit. The connection is an encrypted DOCSIS 3.0 protocol. I don't see how these problems could come from anywhere else but the ISP side. – Owl Jul 29 '18 at 11:01
3

MITM attacks by ISPs are rare, but still do happen.

  • Some mobile ISP rewrite images to be more compressed, some also compress HTML and Javascript if transferred over HTTP
  • Some ISP DNSs respond to unknown domains and redirect to their search engine
  • Iran's national ISP used hacked Diginotar certificates to MITM SSL connections to Google
  • If the ISP is your employer, they might have put a SSL MITM CA to your work PC and are inspecting SSL traffic
  • 1
    Not to mention rogue administrators... – user2497 Jul 4 '17 at 9:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.