0

The more I read about impersonating web sites the more I get confused. Does an attacker need the private key of the server in order to impersonate a website or does having the private key simply give him the ability to decrypt the communications?

When I think of impersonating a website I think of a collision attack, where an md5 hash has been broken and a fake cert can then be used in order to effectively impersonate a website using a new key pair.

When I think of a MiTM attack I think of an attack where the person in the middle gets the private key of the server and forwards traffic back and forth between the client and the server, allowing the attacker to decrypt and view all communications. This to me, is not "impersonating a web site". Can someone please clarify my confusion here?

Improve this question

5 Answers 5

Reset to default
2

Generally the main use for MitM at the moment is for the attacker to impersonate the website to the victim.

The aim being, usually, to get hold of the victim's credentials in order to impersonate them, authenticate correctly to the website and make off with the contents of their bank account, data store, intellectual property etc.

This is done, typically, the way you state in your final paragraph. As far as the victim is concerned, they see their website. This is impersonation.

I'm not sure your collision attack is a likely scenario for impersonation, however faked certs are certainly an avenue to attack.

Improve this answer
1
  • I suppose I am thinking of a collision attack against MD5 where someone could fake an SSL cert own their own site, then perform some kind of DNS poison attack to re-direct victims to the rouge site - This type of attack does not have anyone in the middle. How practical was this back when MD5 was mainstream?
    – user53029
    Oct 2, 2014 at 21:45
1

It depends.

With some ciphers, it is possible to passively eavesdrop the communication once you have the private key. It may be done even for connections wiretapped before you obtained a copy of the private key used.

However, for another class of ciphers, those providing forward secrecy (PFS), the client and server generate a new ephemeral key for the session. Thus, the attacker would need to perform a man-in-the-middle attack to be able to decrypt it.

You should have your client/server prefer PFS ciphers when available, as that prevents that kind of attacks (most defaults do that, but you need recent software to support PFS).

The usage of PFS has been discussed a lot in the context of NSA logging the full traffic, as they would be able to decrypt communications not using PFS if they got hold of the private key.

Improve this answer
7
  • So which attack would you say would be more difficult to perform and detect? A MiTM collision attack or a MiTM attack against another known vulnerability in the TLS stack?
    – user53029
    Oct 2, 2014 at 22:11
  • @user53029: What do you mean by a MiTM collision attack? You usually perform a MiTM against SSL using either a crafted SSL certificate (taken from the legit server, signed by a rogue CA, locally installing a fake CA as trustable…) or deceiving the user (hoping they bypass the security warning, using a legitimate certificate for a similar-named domain…). A MiTM actually breaking SSL is much scarce, not due to attack complexity, but because it requires a big vulnerability (eg. apple goto, or openssl CVE-2014-0224) which will be quickly fixed once found (for a regularly updated system, of course)
    – Ángel
    Oct 3, 2014 at 9:07
  • I am referring to a collision attack against the hash whereby the attacker breaks the hash and can now forge SSL certificates which would then allow him to perform a MiTM attack. Thanks!
    – user53029
    Oct 3, 2014 at 11:13
  • as opposed to an attack like you describe actually exploiting a huge vulnerability in something like openssl. So the question was which attack would be more difficult to perform and/or detect, the attacker that exploited collision vulnerabilities to get to MiTM or the attacker that exploited a bug in openssl/cipers, etc.. to get MiTM? Does that make sense?
    – user53029
    Oct 3, 2014 at 11:17
  • It's hard to say. A "collision attack" as you describe require generating a hash collision, the problem is not just a creating a new certificate with the same hash as a legit one (single/second pre-image resistance), but also general collision resistance (create two certificates with same hash, get a normal one signed by a CA, the other impersonating a CA). Cryptographic hash functions should be very resistant for this, although as the state of the art advances, all will eventually fail. This is an arms race. It only depends on whether hash functions get replaced before being vulnerable.
    – Ángel
    Oct 5, 2014 at 19:47
1

A man-in-the-middle attack, by definition, involves impersonation.

The basic idea is something like this:

  1. Alice wants to have a conversation with Bob.
  2. Mallory tricks Alice into sending the first message to him instead of Bob (exactly how can vary greatly).
  3. Mallory contacts Bob, pretending to be Alice, and passes on Alice's message.
  4. Bob replies to Mallory, thinking he is Alice, and Mallory forwards the reply to Alice (while pretending to be Bob).
  5. The conversation can go on and on, with Mallory as the Man in the Middle.

Sometimes, the purpose of this impersonation is solely to monitor communications. Mallory may just want to read the messages, before passing them on. Other times, Mallory may modify the the messages in order to manipulate Alice and/or Bob into doing something he wants.

Here is an SSL/TLS example of a MITM attack:

  1. A customer tries to connect to his banks website.
  2. An attacker however manages to hijack the connection (how doesn't matter), and presents his forged SSL certificate impersonating the bank's website.
  3. The attacker connects to the actual banks website, and sends the customers HTTP requests.
  4. The attacker forwards the HTTP responses to the customer.
  5. Since sees the banks website, and unsuspectingly provides his username and password.
  6. The bank sends a one time password to the customer's cellphone.
  7. The customer sends this one time password to the attacker (thinking he is talking to the bank)
  8. The attacker can do what he wants with the customer's account.

If the attacker only impersonated the bank, without actually getting in the middle, he wouldn't be able to get past the one time password.

Improve this answer
1

The answer to your question is: no. MiTM is done to steal information that the user THINKS they are sending to a legitimate site. HOW it accomplishes this usually involves "impersonating" whatever party you're trying to send your data to, and sometimes involves traffic decryption (although most of the time, decryption isn't feasible without some sort of downgrade attack), but the intent of the attack is to steal information.

Improve this answer
3
  • But that stolen information would be encrypted. So if you set yourself up in the middle, what good is the information you steal unless you can decrypt it?
    – user53029
    Oct 3, 2014 at 11:20
  • So give me a scenario where I would want to impersonate a website to steal information without decrypting the traffic? Again what good is that? What is the use case here?
    – user53029
    Oct 3, 2014 at 11:33
  • 1
    @user53029 Encoding and encrypting are different. All websites ENCODE their pages (because all files are encoded), but many don't encrypt them. If I wanted to steal your information via MiTM, I would use SSLStrip, a tool which basically stops you from using SSL (which is the encryption used by most logins) by redirecting your traffic from port 443 (HTTPS) to port 80(HTTP). Then all of your information would be in the clear, no decryption required :).
    – KnightOfNi
    Oct 3, 2014 at 11:44
1

I think you're putting two encryption forms together and getting confused. First you need to look at encryption in two ways encrypting data and encrypting a tunnel.

Encryption of data is done at the endpoint before the information is send over the wire. This can be done using Symmetric or Asymmetric encryption. Symmetric encryption is an exchange of the same keys to encrypt and decrypt data. Asymmetric encryption uses a Private/Public key pair to encrypt and decrypt data.

Encrypting of a tunnel does not encrypt at the data level. It provide a secure tunnel for data to travel over. Plain text can be send over an encrypted tunnel (such as SSL) and to a prying attacker they cannot see the data because of the encrypted tunnel. This is what we refer to as PKI or most commonly SSL certificates.

Both of these forms can be used separately or together.

If you use both methods, and attacker must first break the tunnel. Various methods exist as your posts have discussed, but more to your point of MITM attacks, placing a malicious host between the user and the server can allow and attacker to capture data.

If this data is not encrypted and only in plain text an attacker has all they need and can see passwords/username/etc send via plain text.

If however the data is encrypted itself, the attacker can capture the encrypted data, but in order for them too gain access to the information, they would need the keys to that encryption.

Finally back your question as to MITM attacks used to impersonate sites -- No, MITM by there design are for eavesdropping without detection on users. Impersonation attacks are normally in the form of an attacker impersonating a user, or an attacker posing as a legitimate site.

Technics such as XSS or CSRF are not MITM attacks per say, and are more an exploitation of trust between a site and it's users. In these instances, they are either presented to the user in the form of client side scripts which come from legitimate sites an attacker has compromised, or presented to servers where an attacker has compromised a legitimate user.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .