5 ms·

> using unprotected channels It's not man in the middle. I have seen this mistake a lot lately. Man in the middle only involves encryption. Otherwise it is

> using unprotected channels It's not man in the middle. I have seen this mistake a lot lately. Man in the middle only involves encryption. Otherwise it is just injection or redirection. It is not a man in the middle attack merely because something happened in the middle of a transmission. There is always stuff that happens in the middle of transmission if you want to get technical about packet switching ARP resolution. Specifically man in the middle deals with intercepting a certificate or key request in the middle of a transmission so that the encrypted tunnel is between one end point and the attacker. The attacker then establishes a second encrypted tunnel between themselves and the other end point. Wikipedia page - https://en.wikipedia.org/wiki/Man-in-the-middle_attack https://en.wikipedia.org/wiki/Man-in-the-middle_attack I am certain about this because I had to study it in order to pass the CISSP exam (first time go back when it was a 250 question paper test).

ggggtez 8y ago
What are you talking about... It is man in the middle. This attack is a lot older than encryption, so if you think encryption is required then you've made a big mistake. It refers to literally a person intercepting your message before (or instead of) it reaching the intended audience.
- austincheney 8y ago
  Older than encryption? Encryption has existed since before the Roman empire. > It refers to literally a person intercepting your message before (or instead of) it reaching the intended audience. Every time somebody has pointed that out they have extracted that definition from the term opposed to referencing the term from a definition. It is similar to answering a question with only a restatement of the question.
  - deadmetheny 8y ago
    MitM attacks have been around far longer than transport/network layer encryption has been commonly deployed, is what parent means. These days it's more commonly used to defeat encryption but there's plenty of attacks that don't really need it (e.g. ARP spoofing, etc etc)
    - austincheney 8y ago
      I am not sure what you are trying to say. Yes, agreed, there are many forms of attack beyond MITM such as ARP spoofing.
  - richrichardsson 8y ago
    I would be confident in saying MITM attacks have existed even longer than encryption. - A dispatches messenger towards B. - Bad actor intercepts messenger. - Bad actor detains/kills messenger. - Bad actor dresses up in messenger clothing. - Bad actor delivers message to B as if they were the original messenger, having read/altered the message in the meantime.
edejong 8y ago
Not going to down-vote just because you’re wrong, since you bring up a cogent argument. But it’s still wrong nevertheless. I’ve skimmed the linked Wikipedia article. Could you quote from that article that MITM requires intercepting a certificate or key request?
- austincheney 8y ago
  > As an attack that aims at circumventing mutual authentication, or lack thereof, an MITM attack can succeed only when the attacker can impersonate each endpoint to their satisfaction According to the Wikipedia definition a MITM attack must impersonate the end point to each end point. Altering the integrity of a communication or reading the contents thereof does not meet that definition. Also, every part of the Defense and Detection section of the article is specifically about encryption, particularly PKI keys and CA issued certificates. You never said how I am wrong.
Spare_account 8y ago
> Man in the middle only involves encryption. This doesn't feel right to me, so I would like to explore it if you are willing to help me understand. I've grabbed a couple of sources below which appear to contradict your assertion, but I'll admit I'm not expert on this topic so if I'm misunderstanding things, I'd appreciate being put right. The Wikipedia article you linked to includes the following section: > A notable non-cryptographic MITM attack was perpetrated by a Belkin wireless network router in 2003. Periodically, it would take over an HTTP connection being routed through it: this would fail to pass the traffic on to destination, but instead itself responded as the intended server. The reply it sent, in place of the web page the user had requested, was an advertisement for another Belkin product. OWASP's definition uses plaintext HTTP as its primary example of a MITM attack: https://www.owasp.org/index.php/Man-in-the-middle_attack https://www.owasp.org/index.php/Man-in-the-middle_attack > For example, in an http transaction the target is the TCP connection between client and server. Using different techniques, the attacker splits the original TCP connection into 2 new connections, one between the client and the attacker and the other between the attacker and the server, as shown in figure 1. Once the TCP connection is intercepted, the attacker acts as a proxy, being able to read, insert and modify the data in the intercepted communication. > The MITM attack is very effective because of the nature of the http protocol and data transfer which are all ASCII based
- gruez 8y ago
  Yes, technically because it's conducted by someone in the middle of the transport path, you can call it man in the middle. The problem is that if you call all attacks that, what do you call the attack where asymmetric key exchange is being replicated by some attacker in the middle? Also, it's possible to pull this particular attack off without being in the "middle",. For example, by using DNS cache poisoning or arp spoofing
  - joombaga 8y ago
    > The problem is that if you call all attacks that, what do you call the attack where asymmetric key exchange is being replicated by some attacker in the middle? You use a more exact term. I don't see the problem.

ggggtez 8y ago

What are you talking about... It is man in the middle. This attack is a lot older than encryption, so if you think encryption is required then you've made a big mistake. It refers to literally a person intercepting your message before (or instead of) it reaching the intended audience.

austincheney 8y ago
Older than encryption? Encryption has existed since before the Roman empire. > It refers to literally a person intercepting your message before (or instead of) it reaching the intended audience. Every time somebody has pointed that out they have extracted that definition from the term opposed to referencing the term from a definition. It is similar to answering a question with only a restatement of the question.
- deadmetheny 8y ago
  MitM attacks have been around far longer than transport/network layer encryption has been commonly deployed, is what parent means. These days it's more commonly used to defeat encryption but there's plenty of attacks that don't really need it (e.g. ARP spoofing, etc etc)
  - austincheney 8y ago
    I am not sure what you are trying to say. Yes, agreed, there are many forms of attack beyond MITM such as ARP spoofing.
- richrichardsson 8y ago
  I would be confident in saying MITM attacks have existed even longer than encryption. - A dispatches messenger towards B. - Bad actor intercepts messenger. - Bad actor detains/kills messenger. - Bad actor dresses up in messenger clothing. - Bad actor delivers message to B as if they were the original messenger, having read/altered the message in the meantime.

edejong 8y ago

Not going to down-vote just because you’re wrong, since you bring up a cogent argument. But it’s still wrong nevertheless. I’ve skimmed the linked Wikipedia article. Could you quote from that article that MITM requires intercepting a certificate or key request?

austincheney 8y ago
> As an attack that aims at circumventing mutual authentication, or lack thereof, an MITM attack can succeed only when the attacker can impersonate each endpoint to their satisfaction According to the Wikipedia definition a MITM attack must impersonate the end point to each end point. Altering the integrity of a communication or reading the contents thereof does not meet that definition. Also, every part of the Defense and Detection section of the article is specifically about encryption, particularly PKI keys and CA issued certificates. You never said how I am wrong.

Spare_account 8y ago

> Man in the middle only involves encryption. This doesn't feel right to me, so I would like to explore it if you are willing to help me understand. I've grabbed a couple of sources below which appear to contradict your assertion, but I'll admit I'm not expert on this topic so if I'm misunderstanding things, I'd appreciate being put right. The Wikipedia article you linked to includes the following section: > A notable non-cryptographic MITM attack was perpetrated by a Belkin wireless network router in 2003. Periodically, it would take over an HTTP connection being routed through it: this would fail to pass the traffic on to destination, but instead itself responded as the intended server. The reply it sent, in place of the web page the user had requested, was an advertisement for another Belkin product. OWASP's definition uses plaintext HTTP as its primary example of a MITM attack: https://www.owasp.org/index.php/Man-in-the-middle_attack https://www.owasp.org/index.php/Man-in-the-middle_attack > For example, in an http transaction the target is the TCP connection between client and server. Using different techniques, the attacker splits the original TCP connection into 2 new connections, one between the client and the attacker and the other between the attacker and the server, as shown in figure 1. Once the TCP connection is intercepted, the attacker acts as a proxy, being able to read, insert and modify the data in the intercepted communication. > The MITM attack is very effective because of the nature of the http protocol and data transfer which are all ASCII based

gruez 8y ago
Yes, technically because it's conducted by someone in the middle of the transport path, you can call it man in the middle. The problem is that if you call all attacks that, what do you call the attack where asymmetric key exchange is being replicated by some attacker in the middle? Also, it's possible to pull this particular attack off without being in the "middle",. For example, by using DNS cache poisoning or arp spoofing
- joombaga 8y ago
  > The problem is that if you call all attacks that, what do you call the attack where asymmetric key exchange is being replicated by some attacker in the middle? You use a more exact term. I don't see the problem.