Questions tagged [man-in-the-middle]
A man-in-the-middle attack (MiTM) is an attack against a communication protocol where the attacker relays and modifies messages in transit. The parties believe they are talking to each other directly, but in fact both are talking to each other via the attacker in the middle.
1,349
questions
23
votes
1
answer
4k
views
Did a Huawei modem just try to do a Man-In-The-Middle attack on me?
I have a replica of Huawei B535-333 LTE modem. While I was working from home on my computer I randomly got a security alert saying that certificate for connection with outlook.office365.com was issued ...
- 333
0
votes
1
answer
59
views
Modern VPNs and average MITM attacks
I am trying to untangle a number of concepts (all of which i am unfamiliar with) in this question, but they all point to a seemingly basic question;
With modern tunneling protocols, SSL ciphers and ...
- 133
0
votes
0
answers
49
views
MITM with forwarding between 2 hosts in the same network
I have 3 hosts in the same network, let's say their IP addresses end with:
.10 (Host A)
.11 (Host B)
.12 (Host C)
I want to sniff packets between A and C through host B, so that host B acts as MITM.
...
0
votes
0
answers
74
views
Man in the Middle Attack for OAuth 2's Authorize endpoint
We all know that the /authorize endpoint is a standard endpoint of OAuth 2. Below is how it's commonly called:
GET /oauth2/authorize?client_id={client_id}&redirect_uri={redirect_uri}&...
- 1
3
votes
2
answers
2k
views
Understanding TLS Protections Against DNS Spoofing and Fake Websites
What protections does TLS use in the above scenario?
In the picture, the client asks the attacker for the address of Google.com, but the attacker gives them a different ip address which redirects to a ...
- 31
0
votes
2
answers
93
views
Website returns different certificate on my home network to mobile hotspot
This is a "should I be worried" question. I access a website on my laptop via my home network/router. My Edge browser gives me a "Your connection isn't private" warning page and ...
- 101
0
votes
0
answers
46
views
Bettercap filtering ARP Spoof
I want to see only monitored device's visited websites not the methods and the redirects how can I filter or can I?
0
votes
0
answers
44
views
Securing an internal tcp proxy
I am developing a TCP-Proxy in C#/.NET using dotNetty (Port of Netty). The proxy is translating messages between two different systems. It will be hosted on a server in the company network, so it is ...
- 101
0
votes
1
answer
281
views
Can China decrypt SSL as soon as people using their ISP?
While these VPNs can work inside of China, I wonder how private and secure they are since China is known for its great firewall, like most technically advanced countries. Are these methods working? ...
- 127
0
votes
1
answer
216
views
What is the difference between a VPN and a Tor Socks proxy on public wifi?
I seek protection against MITM & snooping of VPN or Tor proxy traffic on public WiFi.
So, what are the different security impacts of each of these 2 solutions:
Using a VPN (like Proton VPN) to ...
- 1
0
votes
1
answer
114
views
Evading authenticated diffie hellman with MITM
I understand that in a non-authenticated Diffie-Hellman setup, a man-in-the-middle attack can occur. Now i'm curious about the feasibility of the following scenario:
Let's assume a situation where www....
0
votes
0
answers
62
views
Could a trusted CA pretend to be me and run a MITM? [duplicate]
Sorry for the basic question, I'm still wrapping my head around the ins and outs of SSL and asymmetric encryption. In order to better test my understanding, I was considering the following thought ...
0
votes
1
answer
93
views
Is Certificate Pinning safe and worthwhile for an API server that will only accept requests from an android application?
I have hosted an api on an AWS Windows server, imported ssl certificates from a known CA, and made https mandatory.
Then built a client app that is an executable, then pinned the public key hash for ...
- 103
1
vote
0
answers
43
views
MS-CHAPv2 Auth protocol downgrade
I'm researching about PPP (Point to Point protocol) and it's security aspects.
While exploring PPP Authentication I've noticed possibility for security downgrade attack. Generally authentication ...
- 11
0
votes
0
answers
206
views
Every time I log into Facebook, the SMS based 2FA code appears to get intercepted (UK)
Historically, whenever I logged in I got a standard looking text from "Facebook" stating my login code.
As of this morning, when I attempt to log in, I get a fake looking text from a random ...
0
votes
1
answer
153
views
can a VPN provider do DNS poisoning?
I was wondering if we push our DNS over the VPN and basically let them do DNS resolution, is it possible to perform DNS poisoning and man in the middle attack on us?
I know browsers check certificates ...
0
votes
2
answers
126
views
What prevents certificate authorities from issuing fraudulent TLS certificates?
There have been reports of attacks against certificate authorities resulting in the issuance of fraudulent TLS certificates for sites such as google.com, yahoo.com, and skype.com. These attacks seem ...
- 21
0
votes
1
answer
83
views
Suitable method of encryption for user-hosted chat platforms
I am considering how to make my chat application a bit more secure. It has a similar structure to IRC, multiple users can join each server, and servers can be hosted by anyone. I have been using TLS ...
- 103
1
vote
2
answers
371
views
How does the MITM attack work when a client does not check the hostname vs the certificate? [duplicate]
One of the Paho MQTT client SSL options allows checking whether "a certificate matches the given host name.". If I enable this option then I cannot establish a TLS connection to MQTT using ...
- 13
2
votes
1
answer
415
views
CSRF: Signed Double Submit Cookie & 'Referer' validation vs MITM and vulnerable subdomains
I have been researching various techniques for preventing CSRF attacks, such as SOP, SameSite, Secure, Referer validation, and CSRF Tokens, and their potential bypasses. During my research, I ...
- 129
2
votes
4
answers
166
views
Using FIX over TLS, is there a need to sign FIX mesages?
We have 2 servers communicating, server A (a server that I own), and server B (server on the internet that I trust). I get some info from server B, which are FIX messages (https://en.wikipedia.org/...
1
vote
0
answers
94
views
Malicious Mass Email Attack Occurred, Do I Still Have Problem?
I'm using Apache Airflow and I was troubleshooting built-in smtp setup. A mass email occurred on "[email protected]". It was used as a "From:" email in a mass email attack.
...
2
votes
1
answer
86
views
TLS and MiTM Attacks Relevancy over Public Cloud (SDN) internal networks
Edit:
To clarify, this question is all about whether we should insist on implementing TLS for internal communications over public cloud tenants as a man-in-the-middle risk reduction control, given the ...
0
votes
1
answer
116
views
How to safely share data between 2 SPAs?
Let's say I have 2 SPAs (single page applications), SPA A and SPA B.
I want to share data between the 2 applications for an end-to-end flow.
How can I safely share data such that it would not be ...
- 113
0
votes
0
answers
78
views
Is it safe to use the iOS Account Manager for Google Accounts?
I am only using Google for contacts on my iPhone. For the rest of the Google services, I am using the dedicated Google apps. I know that the connnection from Google apps to Google servers is secure ...
- 1
14
votes
1
answer
3k
views
SSL issue captures Facebook app send out traffic
I tried to capture the send-out traffic of the Android app (Google Drive, Facebook, etc.). This is my security thesis.
I succeed capture send-out traffic on the Google Drive app with Mitmproxy but ...
- 243
0
votes
1
answer
65
views
Misuse of trusted certificate authority [duplicate]
Currently I'm working with mitmproxy and intercepting some HTTPs traffic using it. Before I could use it in my browser, I had to trust the certificate via my OS settings. After that, the certificate ...
- 41
0
votes
2
answers
183
views
Protection against user session attacks (hijack, replay, tampering, CSRF, XSS...)
We develop a website in JAMStack, all URLs are static HTML page, and each interaction with the server are made by a fetch call on our REST API (micro-services).
When a user sign in, we want to ...
- 157
0
votes
0
answers
60
views
How can Trudy attack the protocol where both Alice and Bob complete authentication and Trudy gets the session key?
I'm studying up protocols, authentication and attacks for a class I'm taking, but I've encountered a question that I just cannot figure out.
If Alice and Bob have the below protocol and the session ...
0
votes
0
answers
139
views
ESP8266 MiTM interception of TLS1.2 and certificate pinning
I am trying to intercept traffic to and fro an embedded device using an ESP8266 (ESP-WROOM-S2). I have set up my computer as a wifi hotspot, and re-routed all hotspot traffic to run through mitmproxy. ...
0
votes
0
answers
123
views
google tag manager server side tracking/ possible MitM attack gtm-cloud-image
I recently stumbled across the gtm-cloud-image. It's a Node.js server intended to be deployed in the domain space of a client's website. It will load a script from https[://]www[.]googletagmanager[.]...
- 101
0
votes
0
answers
73
views
Why encrypted internet connections can't be censored or blocked by a country willing to do it? [duplicate]
Is it possible for a country to restrict any encrypted internet connection to some computer outside of the country, or if absolutely necessary just use a mitm(man-in-the-middle) to guarantee they can ...
0
votes
3
answers
185
views
How to make Firefox warn about unknown certificate issuer?
Assume a corporate computer that has intrinsic software installed. It's a mitm setup that replaces the web page's certificate to one signed with a intrinsic software vendor's certificate that is ...
- 101
0
votes
1
answer
325
views
Why installing a root certificate on the client opens a door for MitM attack?
Most internet communication is now end-end encrypted using TLS. In the TLS process, the TLS server sends a PKI certificate to the user which then gets authenticated using the CA's root certificate ...
- 3
2
votes
1
answer
215
views
How to decrypt Emotet's TLS traffic by MITMProxy
I have a question about Emotet's TLS traffic:
Using MITMProxy, I have successfully decrypted TLS traffic with Emotet's C2 server and can read the contents of the traffic.
https://mitmproxy.org
...
- 21
4
votes
1
answer
460
views
Some ISP inject malware/ads into my website in the middle of transit
I host my website by my own using droplet/VPS service and node.js server. My wesbite uses SSL Cert/HTTPS from LetsEncrypt, VPS service from DigitalOcean, domain registered from local vendor (RumahWeb) ...
- 143
1
vote
1
answer
214
views
methods to encrypt data on top of HTTPS (can't do ssl pinning, prevent MITM attacks)
When SSL pinning is not available, for example when using a free TLS certificate from a CDN provider (Cloudflare - does not support HTTP public key pinning, what can be used to encrypt sensitive ...
- 223
1
vote
0
answers
38
views
Apple Magic Keyboards in Public Spaces Man-in-the-middle
Let's imagine that I leave a Mac with wireless peripherals in a public space like a co-working space that might end up with other wireless devices nearby or physical access (say, at nighttime). My ...
- 11
0
votes
0
answers
52
views
ARP Spoofing succeeded only partially
I have done arp spoofing to my phone using scapy and detected duplicate ips in the arp protocol with wireshark.
However, access to websites using chrome app was blocked, but youtube and onedrive apps ...
0
votes
2
answers
119
views
Can a self signed TLS/DTLS digital certificate be forged?
I have quite minimal understanding in cryptography. I was very much hoping to understand whether a self signed certificate's fingerprint be copied/reverse engineered on another certificate. Many VoIP ...
- 1
1
vote
1
answer
106
views
Security concern with hosting a chrome extension on a public server
We have chrome extension that is for internal use by our clients. It is force-installed via enterprise policy. So far, we have it published on the Chrome WebStore but we need to move off of it due to ...
- 111
12
votes
3
answers
6k
views
How do we know that our SSL certificates are to be trusted?
On Linux, the /etc/ssl/certs folder includes all the necessary public keys for Certificate Authorities. If I have not misunderstood something, this makes it possible to verify public keys received ...
- 175
2
votes
0
answers
152
views
Public Key Certificate Pinning alternatives
In the domain of mobile application, certificate pinning topic is still relevant. I am trying to get opinions on best alternatives, because certificate pinning needs the storage of public keys within ...
- 121
2
votes
2
answers
116
views
Can VPN change my data packets?
I don't know the details of VPN, I always imagine that's a middle point between me and server(internet).
And VPN point always receive my(and from server's) data packets.
So the thing I want to know is ...
- 21
0
votes
1
answer
1k
views
Connecting to company VPN issues a failed certificate verification
As one can see on the screenshot below, connecting to the company VPN via FortiClient issues a X509 verify certificate failed.
I have informed the CIO who is the security person as well but it is not ...
- 101
3
votes
2
answers
2k
views
Is NordVPN changing my security cerificates? Could this be a MiTM attack?
I noticed that when it comes to some websites (e.g. Twitter), the security certificate is changed when I log in and out of NordVPN - the SHA-1 digest is visibly different.
Keep in mind that not only I ...
- 175
1
vote
1
answer
70
views
Microsoft Teams encryption verification
This link suggests that MS Teams calls are encrypted and can be verified by reading out the 20-digit security codes found on the endpoint computers.
To protect against a man-in-the-middle attack ...
- 163
1
vote
1
answer
80
views
Double ARP error, mitm
I've had an error where my mobile hotspot is getting arp requests from a nearby router. The phone was previously owned by the owner of that said router.
I've come to notice this by Strange network ...
- 11
1
vote
1
answer
201
views
Extremely strange and concerning SSL issues. MITM attack?
While not particularly knowledgeable on public key infrastructure, I've noticed strange issues with SSL and TLS lately that I'm unable to diagnose. As these issues have currently left me dumbfounded I'...
- 11
5
votes
3
answers
4k
views
Man in the middle Attack, possible even with CA certificate and assymetric encryption
So I read something about SSL/TLS and I always don't understand two things.
First, why so many of the comments are still saying that just because the attacker doesn't have the private key, a MiM ...
- 53