76

How does that work? They seem use an In-the-middle SSL Bump proxy. First, it works as a transparent proxy, meaning it will silently redirect all HTTPS traffic to SSL Bump proxy servers. You have to install and accept the proxy's Certificate Authority cert to make this work. Once done, each SSL connection is made from your host to the SSL Bump Proxy with ...


41

... change the public key in the certificate and send it to client. Digital signature is same, all the properties except public key are same. So how can browser understand the difference? The browser checks that the signature of the certificates fits the certificate. Since the public key is included in the signature and the public key is changed, the ...


25

At the end of the TLS negotiation (the "Finished" message), the client and the server take a hash of the entire conversation they've had so far, and they compare it. If it differs - as it would if someone performed a MitM attack on the certificate - then the connection is dropped. To quote RFC 5246: The Finished message is the first one protected with ...


24

Certificates don’t exist in isolation. To be trustworthy, a certificate must be signed by an issuer; these issuers are called Certificate Authorities. Each browser (or operating system) maintains their own list of a few hundred trusted CAs (called Root CAs) that it already knows and trusts; and your employer or school may have their own private issuing root ...


3

How to protect confidentiality and integrity? Limit who you trust; encrypt everything. Obviously, don't install any CA certificate imposed by the ISP. Consider removing certificates that are controlled by parties you do not trust. At a minimum, make sure HTTPS is used for everything; you could even block traffic to port 80 and other HTTP ports to ensure ...


2

Browsers will alert the user if they are presented with a self-signed certificate which they don't trust. The browser user or system administrator should preempts this scenario and add the self-signed certificate to the browser's trust-anchor store beforehand. That way, the user won't see a warning. Done this way, users can be informed that if they ever ...


2

Browsers will only accept an invalid certificate - and self-signed is one form of "invalid" - when the user acknowledges the risk and overrides the browser. The specific steps for doing so vary from browser to browser, but they're usually onerous by design - they want the decision to bypass security to be hard, not easy.


2

The Tor Project hosts some bootstrapping servers called directory servers. They contain a list (a directory) with information about all Tor relays currently online. This info about each relay includes the public key. The directory is signed with one of the directory keys[1]. Those keys are distributed along with your copy of the Tor client[2]. Therefore, ...


2

In general, SSL/TLS does offer MITM protection. It encrypts data before it leaves your computer that only the endpoint can decrypt and vice versa. A MITM attack is ineffective against encrypted TLS connections because even if you intercept the public keys that the endpoints exchange, it still does not know their private keys. As for a Tor, it is not ...


1

Yes, ISPs can and do intercept traffic of users. Plaintext communication, such as plain HTTP or FTP, can be intercepted, analyzed and modified by the ISP without anybody knowing. This is why you should never used plaintext communication if it is in any way possible. Encrypted communication, such as HTTPS, FTPS, SFTP, etc., can also be intercepted, but the ...


1

"It breaks cause you dont forward the packets" Basically in an ARP spoof attack you tell the victim you are the router and to the router that you are the victim.So all the traffic basically flows through you.But you need to enable ip_forwarding to actually transmit packets from your device to the router,that is why it "BREAKS" the internet for the victim,...


1

Compromised Email Accounts Unfortunately it is clear that your mail systems have been compromised. That's the biggest take away here. If your emails are never reaching the customer then at some point in time someone gained (and probably still have) access to at least the alice@mycompany.com email, if not your entire email system. There's an important ...


1

I don't think that there is a standard way that this type of fraud is perpetrated, but I can tell you what I have seen and what I do when this happens to us, when about once every two months we get "change my bank account" emails sent to suppliers "from" our mail systems. Our first thought is that the scenario didn't happen and that we have fraudulent staff ...


1

This problem comes from the configuration of unite.nike.com, which is the domain used to login users. The server replies with a 403 Forbidden response, so the AJAX request fails, and the site displays the "An error occurred" message. This domain is protected by Akamai, and it seems to have a very strict security configuration to detect MitM / bots: I can't ...


Only top voted, non community-wiki answers of a minimum length are eligible