Questions tagged [man-in-the-middle]

A man-in-the-middle attack (MiTM) is an attack against a communication protocol where the attacker relays and modifies messages in transit. The parties believe they are talking to each other directly, but in fact both are talking to each other via the attacker in the middle.

Filter by
Sorted by
Tagged with
409
votes
14answers
65k views

How is it possible that people observing an HTTPS connection being established wouldn't know how to decrypt it?

I've often heard it said that if you're logging in to a website - a bank, GMail, whatever - via HTTPS, that the information you transmit is safe from snooping by 3rd parties. I've always been a little ...
98
votes
4answers
139k views

How does SSLstrip work?

I've been reading up on SSLstrip and I'm not 100% sure on my understanding of how it works. A lot of documentation seems to indicate that it simply replaces occurrences of "https" with "http" in ...
58
votes
3answers
9k views

Is it common practice for companies to MITM HTTPS traffic?

My company has just introduced a new VPN policy whereby once connected all traffic is routed the company network. This is to allow for improved monitoring of data theft. It would appear that this ...
100
votes
5answers
32k views

How can my employer be a man-in-the-middle when I connect to Gmail? [duplicate]

I'm trying to understand SSL/TLS. What follows are a description of a scenario and a few assumptions which I hope you can confirm or refute. Question How can my employer be a man-in-the-middle when ...
32
votes
3answers
7k views

For an HTTPS web application, is it worthwhile to encrypt the password before POSTing it, to keep a MITM attacker from harversting it?

Our application has recently gone through penetration testing. The test found one critical security breach, which is essentially: The problem: Attacker sets up a WiFi spot. User enters our site (...
15
votes
3answers
19k views

My school wifi asks to 'trust' a certificate on iPhones. Does this allow them to view SSL traffic?

There is a lot of confusion around this on here, so I am making this post to be sure to understand it correctly. My school uses Aruba networks wifi, and after I type my Active Directory username and ...
22
votes
6answers
17k views

Is it possible for corporation to intercept and decrypt SSL/TLS traffic? [duplicate]

I found there are some companies claim that they offer service that can eliminate SSL/TLS blind spot, such as Blue Coat and Gigamon. Are they talking about some way of decipher the https content (...
45
votes
6answers
83k views

Can I detect a MITM attack?

Based on this question here: Are "man in the middle" attacks extremely rare? Is it possible to detect man-in-the-middle attacks, and if so, how would one go about it? In addition, what if ...
22
votes
8answers
47k views

Tracking down a rogue access point

Over the course of about a month we have received multiple reports of a rogue access point attempting to intercept traffic. I suspect an attacker is using a wifi pineapple, or similar hardware device....
22
votes
4answers
9k views

Options when defending against SSLstrip?

I'm wondering, does anyone have any suggestions to defend against SSLstrip particularly?
27
votes
4answers
2k views

Can a nation-state adversary perform a MITM attack by compelling a CA to issue them with fake certs?

As I understand it, with any encryption system based on a trust chain / CAs (eg SSL, TLS, S/MIME), it would be possible for a nation-state adversary (such as the NSA) to compel the CA to issue them ...
10
votes
3answers
12k views

Can attackers steal SSL certificate from server and use it for MITM attacks?

I'm writing an iOS app for private use to act as a client for a PHP server. To secure the connection I'm using a self-signed SSL certificate. Since the server is self-hosted, on the first connection ...
12
votes
1answer
3k views

How well is the SSL/TLS handshake protected against modifications?

The SSL/TLS handshake is protected against downgrade attempts by the Finished message, a signed and authenticated hash of the master secret and all previous handshake messages. Consider a client that ...
136
votes
8answers
22k views

Are "man in the middle" attacks extremely rare?

In "Some thoughts on the iPhone contact list controversy and app security", cdixon blog Chris Dixon makes a statement about web security Many commentators have suggested that a primary security ...
16
votes
2answers
31k views

Are VPNS vulnerable to active man in the middle attacks?

I know that with SSL/TLS, man in the middle attacks are not possible. For example if Alice and Bob are trying to communicate and Trudy is trying to perform a man in the middle attack, then when Alice ...
15
votes
1answer
2k views

Kaspersky Antivirus "secure connection scan" as broken as Superfish?

I've read a lot about Superfish (and similar ad-ware) lately and I basically understand the vulnerability to MITM attacks. But I'm actually wondering if the "secure connection scan" by Kaspersky ...
15
votes
2answers
13k views

HSTS bypass with SSLstrip2 + DNS2proxy

I am trying to understand how to bypass HSTS protection. I've read about tools by LeonardoNve ( https://github.com/LeonardoNve/sslstrip2 and https://github.com/LeonardoNve/dns2proxy ). But I quite don'...
9
votes
3answers
8k views

arp spoofing protection on LAN

I am a network administrator in company. I read this article eject any wifi device from network with android Some of employers are using mobile phones and company`s wireless network. Theses employers ...
8
votes
1answer
2k views

Detect man-in-the-middle on server side for HTTPS

Background: We have a site which works over HTTPS (HTTP not supported, we use HSTS). It's deployed in 3rd party cloud, which restricts our control and log abilities over server hardware. We cannot ...
49
votes
2answers
71k views

Why is it possible to sniff an HTTPS / SSL request?

I'm new to the realm of HTTP requests and security and all that good stuff, but from what I've read, if you want your requests and responses encrypted, use HTTPS and SSL, and you'll be good. Someone ...
16
votes
3answers
9k views

Do client certificates provide protection against MITM?

I'm looking for a way to protect clients from a MITM attack without using a VPN, and ToR. My thought is that client certificates might do the job, but I'm not entirely sure since not too much server ...
8
votes
2answers
3k views

Can an SSH server fingerprint be spoofed?

If I simply connect to an SSH server, get its key fingerprint, and immediately disconnect, does the SSH protocol ensure that the server also had the private key in order to get that far into the ...
8
votes
4answers
6k views

Mitigating SSLStrip by only serving a site over HTTPS?

So I just learned about SSLStrip now--I feel like I'm so late to the game. What I want to know is: If your site only serves content over HTTPS and hard fails on HTTP requests, with no redirect, are ...
5
votes
3answers
6k views

Can ISP use MITM attack to "break" encrypted traffic?

Use connection of A and B as an example. Their communications were encrypted by Public Key Encryption. Before they exchange their public key, ISP MITM attacked. A got "B"'s public key (ISP generated) ...
3
votes
1answer
2k views

Who can carry out Man-in-the-Middle (MITM) attacks?

We seem to spend a lot of time guarding against Man-In-The-Middle (MITM) attacks without discussing who we are actually guarding against. This is important because if these individuals are unlikely ...
174
votes
4answers
23k views

Is there anything preventing the NSA from becoming a root CA?

There are now tons of Certification Authorities (CAs) that are trusted by default in major OS's, many of which are unrecognizable without online lookup or reference. While there have been attempts ...
24
votes
2answers
42k views

Specific risks of embedding an HTTPS iframe in an HTTP page

I need help listing the specific risks of embedding an HTTPS iframe that enables credit card checkout inside of an HTTP page. Are there security issues with embedding an HTTPS iframe on an HTTP page? ...
15
votes
2answers
15k views

How can I prevent a man-in-the-middle (MITM) attack on my Android app API?

I checked out the app Packet Capture. This app is able to decrypt my app APIs (SSL Enabled) data by mounting a MITM attack using the Android VPN service. This does not even require root. How can I ...
19
votes
4answers
13k views

How can I detect HTTPS inspection?

In my company I do use my computer for private things like online banking and personal email during lunch time. I've always thought that when Firefox shows me the green lock symbol that a valid HTTPS ...
16
votes
2answers
15k views

How safe is Tor from MITM/snooping attacks?

I am behind an HTTP proxy, and I frequently tunnel out via an ssh -D SOCKS proxy (I have access to a couple of outside servers which I can tunnel to) when the HTTP proxy causes problems1. Now, this ...
11
votes
3answers
20k views

How do I check that I have a direct SSL connection to a website?

I always thought that if I had an SSL connection there would be no MITM attacks. Now it appears that isn't true (see comments in this question Is it okay from a security perspective to read foreign (...
10
votes
2answers
3k views

How does HSTS stop MitM attacks?

I know that until a few years ago, someone could set up a fake wireless AP, and use something like SSLStrip to lure the victims into connecting to insecure versions of the major websites, such as ...
12
votes
3answers
6k views

Preventing a spoofing man in the middle attack?

I was humming along with my usual routine of listening to old Defcon videos trying to understand some of the basics of what's going on in the IT Security world, when I came across one explaining man ...
3
votes
1answer
1k views

Is it normal to receive working SMS verification code from strange number?

Here is a sample SMS that usually I trust: The sender is in a text format and there is an information saying the sender does not support replies. When I tried to login, I received verification code ...
74
votes
1answer
16k views

How can Kazakhstan perform MITM attacks on all HTTPS traffic?

There is now MITM on HTTPS traffic in Kazakhstan. But for MITM to work, other than installing the certificate, there has to be someone proxying the request, right? Will that role be played by the ...
17
votes
3answers
66k views

How to spoof a cell phone tower (cell site, base station) -- homemade IMSI-Catcher

An answer to a recent question has given me an idea for a school project (security CS program). Also, an active attacker (with a fake base station) can potentially force a mobile phone to use ...
10
votes
4answers
4k views

Man-in-the-middle scenario for TLS

Consider the following scenario: You want to securely communicate with a.com and you only trust the VeriSign root certificate. a.com presents a certificate signed by VeriSign with CN=a.com, so you ...
21
votes
4answers
3k views

Credit card forms on HTTP pages a MITM risk?

The other day, there was a web developer mailing list thread about a fundraiser page. One person noted that the page with the credit card form was HTTP, not HTTPS. In response, one person said that ...
12
votes
3answers
6k views

How can end-users detect malicious attempts at SSL spoofing when the network already has an authorized SSL proxy?

I'm working on one client's network where they have enabled HTTPS authority spoofing on their proxy. This allows them to effectively perform a man-in-the-middle attack to decipher all outgoing ...
20
votes
7answers
7k views

Is encryption still applied if you ignore the SSL certificate warning for self-signed certs?

Would encryption still be applied on communication with devices using self-signed certificates if you ignore the warning and proceed without installing the certificate? Would you need to install it to ...
11
votes
3answers
34k views

Is it secure to be using LDAP, or is LDAPS the only secure option?

I am currently using an LDAP setup. I am wondering if it is secure from Man-in-the-middle attacks or other vulnerabilities?
3
votes
2answers
6k views

Arp Spoofing Causing Dropped Connections

I have had a lecture today based on Arp Spoofing. However, i can not get it to work. Scenario: My laptop - running kali Target laptop (housemate - with permission) - running windows 8 Commands ...
2
votes
2answers
3k views

How is intercepting my own HTTPS traffic possible?

I have a slight misunderstanding in the way TLS works. I know that I can use Burpsuite Proxy to intercept HTTPS traffic coming from my browser. How is this possible when the server is going to see the ...
11
votes
2answers
2k views

How might the U.K. Government's proposed internet surveillance equipment "bypass" encryption?

http://www.channel4.com/news/black-boxes-to-monitor-all-internet-and-phone-data http://rt.com/news/uk-privacy-internet-freedom-186/ 'Black boxes' will be installed by internet services providers ...
6
votes
2answers
948 views

Should the Keygen element be used to create a certificate for mutual auth TLS? What alternatives are there?

I'm interested in using mutual auth TLS to improve the security of my javascript based webservices . I've looked at the Keygen element and given all its issues, not sure if this can even be used for ...
5
votes
6answers
3k views

How to "demonstrate" man-in-the-middle attack?

I'm TAing a particular course on system security. A specific example is transitting the password in plain text when developing a web application (as part of a class project). Over the years a bunch ...
0
votes
2answers
183 views

Protect SSL connections from MITM for users with modified clients

I'm working on a web app that uses SSL. I'm afraid that some people might access the app via a network that uses a proxy to intersect and inspect the SSL traffic [MITM]. Some people might access the ...
12
votes
5answers
22k views

If I accept a certificate in order to use my company’s Wi-Fi, am I vulnerable to MITM attacks?

In order to get my personal phone onto the Wi-Fi network at my workplace, I have to accept a certificate: If I accept this certificate, will I be vulnerable to man-in-the-middle attacks? For example, ...
4
votes
2answers
1k views

Who other than my ISP can perform man-in-the-middle attacks?

I've heard that not using https is dangerous because of man-in-the-middle attacks. Now, if I connect to a server from my home computer, I assume traffic passes through my ISP, so they could eavesdrop ...
2
votes
1answer
8k views

Is Diffie–Hellman key exchange protocol vulnerable to man in the middle attack?

Diffie–Hellman key exchange protocol vulnerable to man in the middle attack? If yes, then what type of MITM is that? I believe that is a replay attack or a relay attack, not sure though.

1
2 3 4 5