Unauthorized access, Men in the Middle (MITM)

By: Balvinder Singh & Priya Nain Unauthorized Access: Man-in-the-Middle Attacks (MITM)

In this type of attack, the attacker attempts to insert himself in the middle of a communication for purposes of intercepting client’s data and could potentially modify them before discarding them or sending them out to the real destination. The attacker makes independent connections with the victims and relays messages between them, making them believe that they are talking directly to Each other over a private connection, when in fact the entire conversation is Controlled by the attacker. Man-in-the-middle attacks

Attacker inserting himself in the middle of a communication Server Client Attacker

Name Origin , The name "Man-in-the-Middle" is derived from the basketball scenario where two players intend to pass a ball to each other while one player between them tries to seize it. MITM attacks are sometimes referred to as "bucket brigade attacks" or "fire brigade attacks." MITM attack is also known as: Bucket-brigade attack Fire brigade attack Session hijacking TCP hijacking TCP session hijacking Monkey-in-the-middle attack

Man-in-the-middle attacks take two common forms Eavesdropping , is an attacker simply listens to a set of transmissions to And from different hosts even though the attacker's computer isn't party to the transaction. Many relate this type of attack to a leak, in which sensitive information could be disclosed to a third party without the legitimate users Knowledge. Manipulation, attacks build on the capability of eavesdropping by taking This unauthorized receipt of a data stream and changing its contents to suit a certain purpose of the attacker-perhaps spoofing an IP address, changing a MAC address to emulate another host, or some other type of modification.

Security Breach Example To ensure no prosecution, hackers contacted bank president and gave two options: 2003 group of hackers were "testing" security of various banks and noticed that one was extremely vulnerable Within a couple of hours, they transferred over $10 million dollars from the bank to a private account Due to bank's poor network security, attackers tracks were difficult to find Sign proposal indicating that hacker's were forming a security assessment at bank's request for $5 million dollars and hackers would then return the other $5 million. Bank could prosecute, but attackers would deny everything and notify media on bank's poor security

What choice do you think the bank president choose? Bank Manager made a signed aggrement And gave $5 Millions to Hackers on the behalf of security assesment

Man in the Middle Scenario All laptop users connect to a public network Wireless connection can easily be compromised or impersonated Wired connections might also be compromised Internet

Rules of Thumb – Don’ts … Someone might be listening to the requests Don’t browse sensitive sites Don’t supply sensitive information Someone might be altering the responses Don’t trust any information given on web sites Don’t execute downloaded code

Rules of Thumb – What Can You Do? This leaves us with: Browse Non-Sensitive sites Share personal information only over secure networks Non-sensitive sites Boring Sensitive sites Interesting Internet

Passive Man in the Middle Attacks Victim browses to a website Attacker views the request and forwards to server Attacker views the response and forwards to victim Server returns a response Other servers are not affected

Active Man in the Middle Attack The attacker actively directs the victim to an “interesting” site The IFrame could be invisible Victim browses to a “boring” site Attack transfers the request to the server Attacker adds an IFRAME referencing an “interesting” site Server returns a response Automatic request sent to the interesting server Other servers are not affected My Weather Channel My Bank Site My Bank Site

Secure Connections Login Mechanism

Session Fixation Cookie is being saved on victim’s computer Attacker redirects victim to the site of interest Attacker returns a page with a cookie generated by server A while later, victim connects to the site (with the pre-provided cookie) Attacker uses the same cookie to connect to the server Server authenticates attacker as victim Result Now server authenticate attacker as victim/client, now attacker has same privileges as our victim have.

Attack strategy – Spoofing Spoofing is the creation of TCP/IP packets using somebody else's IP address. Routers use the "destination IP" address in order to forward packets through The Internet, but ignore the "source IP" address. That address is only used by the destination machine when it responds back to the source. An example from cryptography is the Man in the middle Attack, in which an attacker spoofs Alice into believing the attacker is Bob, and spoofs Bob into believing the attacker is Alice, thus gaining access to all messages in both directions without the trouble of Any cryptanalytic effort.

E-Mail address Spoofing Types of Spoofing URL Spoofing and Phishing Referrer Spoofing

URL spoofing and phishing , Another kind of spoofing is "webpage spoofing” also known as Phishing. In this attack, a legitimate web page such as a bank's site is reproduced in "look and feel" on another server under control of the attacker. The main intent is to fool the users into thinking that they are connected to a trusted site, for instance to harvest usernames and passwords. Referrer spoofing , Some websites, especially pay sites, allow access to their materials only from certain approved (login-) pages. This is enforced by checking the referrer header of the HTTP request.

The sender information shown in E-Mails (the "From" field) can be spoofed easily. This technique is commonly used by spammers to hide the origin of their e-mails and leads to problems such as misdirected Bounces. Like attacker send a message to user by changing its ‘From' field and user Think that message is received by an trusted person and he may reply to that Message and our data may be misused. E-mail address spoofing

Defending against Spoofing Spoofing is difficult to defend against due to the attacks being mostly passive by nature. What you get is a webpage that is different than what you are expecting. In very targeted attacks it is very possible that you may never know that attackers have been entered into your system By using virtual proxy generator By using login mechanism

Unauthorized access, Men in the Middle (MITM)

More Related Content

What's hot (17)

Viewers also liked (20)

Similar to Unauthorized access, Men in the Middle (MITM) (20)

Recently uploaded (20)

Unauthorized access, Men in the Middle (MITM)