2

I was surfing the web at 3 in the morning and I got a warning which seems to indicate a MITM attack. Does this mean the attacker was able to passive sniff my activity in real-time in order to launch the attack?

  • Did you get the SSL certificate warning message when browsing the HTTPS site ? – P4cK3tHuNt3R Jul 1 '15 at 6:27
  • Where did the warning come from? – Konrad Gajewski Jul 1 '15 at 11:03
  • Yes! I did get a certificate warning with the yellow badge and man in the hat.It was an https site! It came from my student loan page where I have to login to view my account. So did an attack happen in real time? – user7149 Jul 1 '15 at 17:05
1

I think Yes, it has to be in real time.

As I understand the attack, it poisons the cache of arp entries in your OS using arp replies, and due to ARP protocol standards, it updates the cache of the OS immediately even if the entries is not expired.

After the attack is finished, the OS updates the ARP cache after multiple 'futile' requests using the poisoned cache.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.