0

Can a MITM attack on popular sites such as Facebook.com Google.com be done by intercepting the DNS requests? Will the user notice something?

For instance:

Loading https://fb.com

The client requests IP (not through SSL by default) and the client gets the IP from the attacker's server. Will the attacker then by able to perform a MITM?

I suppose because the client typed "fb.com" in its browser that it will only accept a public key from a certificate that has "fb.com" in it. The attacker will be able to send the traffic through his server (redirect through DNS), but not make sense of it (because he won't be able to make the client accept his public key).

Am I wrong in this?

1

You can do ARP spoofing to make victim send DNS queries to you (the attacker). You can then reply with DNS type A records having an IP address that you control. The SSL certificate validation, will however fail because you will not be able to impersonate as Facebook when doing SSL key establishment.

  • Could you please verify which part of the validation will fail? Is it because the domain you type into your browser needs to be the same domains that is specified on the certificate? – user3231622 Aug 19 '15 at 15:30
  • 1
    Yes. This is also called Server Name Identification (SNI). The certificate for "facebook.com" will not work for any other domain. – sandyp Aug 19 '15 at 16:39
3

Suppose Victim A has your standard off-the-shelf Linksys wireless router which, by default, doesn't have encryption enabled on the wireless network which it broadcasts. Suppose Victim A never changed the default administration password either to gain access into the router's web interface to change settings (usually admin, admin).

These two situations are extremely common. All that Attacker A needs to do is setup a rogue DNS and web server on his laptop that has been connected to Victim A's wireless network, add forwarder addresses into his rogue DNS server (such as Google's public DNS of 8.8.8.8 and 8.8.4.4) so that all other domains Victim A tries to visit are still resolvable to their corresponding public IP address, then add a forward lookup zone for fb.com and facebook.com. Each of these 2 zones will need an A record for the root domain and an A record for www both of which point to Attacker A's local IP address of 192.168.1.1. Attacker A then logs in to the router's web interface (the default gateway address - usually 192.168.1.1 for Linksys). From there, Attacker A changes the ISP DNS settings on the WAN interface from the settings obtained via DHCP from the ISP to his laptop's local LAN address (say for example 192.168.1.101).

Now, on Attacker A's local web server, he takes Facebook's CSS stylesheets and login form with wget or any other website mirror tool, then injects some PHP into the downloaded page that saves a text file to his local web server's root directory that records any username and password submitted via the form. Bear in mind that this form looks exactly like Facebook's login form. From there, the attacker forwards this information to the real Facebook site and logs the user in so the user never even knows what happened.

When Victim A visits fb.com, facebook.com, www.fb.com, or www.facebook.com, the IP address with resolve as Attacker A's laptop LAN address of 192.168.1.101 given Victim A's DNS cache has been cleared after a period of time.

As mentioned, the only downside is that if Victim A has https://facebook.com bookmarked, the process will look extremely (ph)ishy as Victim A will get an invalid certificate warning. Also keep in mind that the attacker doesn't have to stick around for this entire process if he sets up a rogue DNS and web server on a public IP, forwards ports 53 and 80 on his firewall, and sets Victim A's router DNS address to Attacker A's public IP.

0

Yes, you can "say" you know fb.com's IP, but give them your own. - I forget what the attack is called at the moment :)

You can pretend to be Facebook in that you have a webpage that looks like Facebook's (and use something like SSLStrip to stop automatic redirects to HTTPS), but if the client FORCES use of SSL, you can't spoof Facebook's certificate. Is that what you're asking?

  • I was wondering if your force using SSL (i.e. you type fb.com), but someone is able to give you the wrong IP for the fb.com server, if a MITM attack is possible? – user3231622 Aug 18 '15 at 20:34
  • It'll throw up a cert warning. If the user chooses to ignore it (and they usually will), you should be good. – KnightOfNi Aug 18 '15 at 21:37
  • Also, if you have the equipment, the best way to learn about this is to try it yourself... – KnightOfNi Aug 18 '15 at 21:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.