How to know if I'm under a MITM attack

Question

If I am connected in a public WiFi, is there any way to know whether I am under attack or not while browsing sites using SSL?

For example, if I visit facebook.com and the URL starts with "https://", does it mean that I am 100% secure? What methods can be used to verify this?

Answer 1

Yes, if you see HTTPS:// in your browser window, haven't accepted any certificate warnings and you are visiting trustworthy website like a bank, your data back and forth would remain private.

If you HTTPS session were being attacked you should get a certificate warning. This might happen a) due to a fake certificate from an attacker, or b) sometimes just due to a "captive portal" trying to proxy every https connection (still not cool).

This assuming that

• You didn't previously accept an SSL warning.
• The attacker doesn't have their own custom Certificate Authority root cert installed and trusted by your browser.
• The HTTPS site isn't including any mixed-content (content from HTTP sites included by HTTPS page).
• Your computer doesn't have other programs that are calling over the network in plain-text that can be compromise your workstation. Example, browse to a plaintext site with IE, and an attacker may insert a browser exploit into another connection to compromise your computer. (super rare for public wifi)

Personally, I do banking from coffeeshop wireless, confident that may data is protected. It is pretty similar to using banking applications on mobile phones.

Answer 2

First, you can never be 100% sure about anything security, it's all on a scale.

As for SSL, that just means your traffic from the site to your browser is encrypted it does not mean that you are ever secure, it is just a tool -employed properly and it does a great job (not perfect, but great).

Now as for MiTM attacks... well... unless you are the network administrator actively monitoring network traffic, it is very difficult (and sometimes next to impossible) to detect a MiTM attack.

That being said, you could always try a few things. First, run BlackSheep. It is a detection tool for FireSheep. Or use a VPN.

Personally, I just would not connect to an open WiFi, just use your cell to to anything important(ish).

Oh and also, Facebook is not entirely SSL (their profile images for instance are still unencrypted) so you are not even fully encrypted there...