4

I got this question at a job interview, but I did not know the answer. I think they expected some shell command or packages, which can help react to the attack. Assume that, you are a system admin and you work for the Nokia Networks. This server store customers details and communicate with them when a customer want to report a problem or bug through the global and 2 internal networks. The attackers are using DNS-poison and they can also start the attack from the internal network, but these details were not specified. I know it could be a linux question, but actually it is connecting to the IT security too.

closed as too broad by M'vy, apsillers, Jens Erat, schroeder, RoraΖ Mar 23 '15 at 15:53

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    It depends who you are, who you are working for, what is on the server and maybe other parameters as well (company policy, regulation, ...). To me this is an open question. – M'vy Mar 23 '15 at 14:48
  • 1
    You can edit your question to be more specific: what is the function of the system being attacked? what is the potential harm of attacking this system (to customers, employees, etc.)? what are the requirements of this system (e.g. uptime)? what kinds of network resources does this server need to communicate with that are being attacked by the MITM (e.g., internal corporate resources, customer interaction)? how is the MITM attack being implemented (DNS poisoning, ARP poisoning, control of a hub), or if that's unknown, how did you detect it? – apsillers Mar 23 '15 at 14:58
3

If you notice that someone is actively man-in-the-middling a server the first thing you should do is inform your incident response/security team.

They should decide on mitigating controls, that's their task. It's highly dependable on what technology is being MiTM and in what way. It also depends largely on where the MiTM is occuring. Aside from re-adjusting routes to go across another network, there's not much you can do.

2

Keep in mind the context here - since it's an interview question, the goal is to assess your understanding of the terminology and concepts. They were probably not interested in some specific tool, or an exact command you would be running (although you might get kudos for knowing something like that).

As mentioned in comments, there are MANY specifics that could influence the answer, so don't bother with those. The point is to demonstrate you understand what a MITM attack is, potential ways it could be detected, and how relates to the job you were interviewing for.

For example, your answer could have been: "Well, a MITM attack involves a malicious user redirecting legitimate traffic through a machine they control. If I noticed this while working on a server, I was probably monitoring network traffic and saw something odd in the traffic patterns or in the ARP table. It's also possible I was reviewing the logs for a web server/application and I noticed abnormal activity from a single machine."

  • You're definitely right, but it was a Linux system admin test and I had to answer with commands the first questions. Anyway, you guys are right, because they didn't specify this question, thus hard to determine the right answer. – ampika Mar 23 '15 at 15:43
  • How would you detect arp patterns if you just got access to the machine? A lot of it will be a best guess situation. – munchkin Mar 24 '15 at 3:37
  • @munchkin The stated assumption is that you are a sysadmin working for the company. By extension, it would be assumed that a sysadmin would know the correct gateway for the subnet, and if you saw an incorrect gateway in ARP tables (i.e. for a DHCP client) you could assume something weird was happening. – jlehtinen Mar 24 '15 at 19:39

Not the answer you're looking for? Browse other questions tagged or ask your own question.