4 ms·

> Man in the middle only involves encryption. This doesn't feel right to me, so I would like to explore it if you are willing to help me understand. I've grabb

> Man in the middle only involves encryption. This doesn't feel right to me, so I would like to explore it if you are willing to help me understand. I've grabbed a couple of sources below which appear to contradict your assertion, but I'll admit I'm not expert on this topic so if I'm misunderstanding things, I'd appreciate being put right. The Wikipedia article you linked to includes the following section: > A notable non-cryptographic MITM attack was perpetrated by a Belkin wireless network router in 2003. Periodically, it would take over an HTTP connection being routed through it: this would fail to pass the traffic on to destination, but instead itself responded as the intended server. The reply it sent, in place of the web page the user had requested, was an advertisement for another Belkin product. OWASP's definition uses plaintext HTTP as its primary example of a MITM attack: https://www.owasp.org/index.php/Man-in-the-middle_attack https://www.owasp.org/index.php/Man-in-the-middle_attack > For example, in an http transaction the target is the TCP connection between client and server. Using different techniques, the attacker splits the original TCP connection into 2 new connections, one between the client and the attacker and the other between the attacker and the server, as shown in figure 1. Once the TCP connection is intercepted, the attacker acts as a proxy, being able to read, insert and modify the data in the intercepted communication. > The MITM attack is very effective because of the nature of the http protocol and data transfer which are all ASCII based

gruez 8y ago
Yes, technically because it's conducted by someone in the middle of the transport path, you can call it man in the middle. The problem is that if you call all attacks that, what do you call the attack where asymmetric key exchange is being replicated by some attacker in the middle? Also, it's possible to pull this particular attack off without being in the "middle",. For example, by using DNS cache poisoning or arp spoofing
- joombaga 8y ago
  > The problem is that if you call all attacks that, what do you call the attack where asymmetric key exchange is being replicated by some attacker in the middle? You use a more exact term. I don't see the problem.
  - austincheney 8y ago
    I think you are missing the prior commentor's point. MITM already has a specific definition. It isn't as broad as you are attempting to redefine it. This concept is commonly understood by security people and commonly confused by software developers. I suspect the failure is that for software developers all parts of a network are in the middle between their application and their end user, so anything in that nebulous space corresponds with the words comprising MITM. That line of thinking is reductio ad nausium.
austincheney 8y ago
The OWASP definition is correct. The gist of a MITM is that each end of the transmission trusts that the malicious actor in the middle is the target destination. When this occurs at the application layer it is almost universally centered on encryption. Keep in mind that in TCP/OSI terms the web is an application riding the internet. Without encryption how do you trust that the destination is who they claim to be? MITM can occur on routers if the router is compromised by someone malicious or if it lacks integrity from the service provider. Routers are layer 3 devices that connect different networks. If a router is compromised so that traffic is sent to a different network with spoofed domains and content. One resolution is that form of attack is IPSEC. IPSEC is not often used across the public internet, because much of the public internet is still IPv4 and still reliant on NAT and PAT to compensate for a shortage of IP addresses. Even more rare than that is certificate spoofing. This is hard to execute, which is why public certificates are usually good for as long as a year, but it does occasionally happen. This is why there are certificate revocation procedures.
- joombaga 8y ago
  > The OWASP definition is correct. Okay. Your definition, with its additional encryption requirement, is at odds with the OWASP definition. > Without encryption how do you trust that the destination is who they claim to be? Signing? Or just ignorance? I agree that "trust" is a component, but it doesn't have to make sense. I can still fool you and the server to which you're connecting into thinking I'm the other party.
  - austincheney 8y ago
    > Okay. Your definition Not really. I did expound on this in the very comment you replied to. > I agree that "trust" is a component, but it doesn't have to make sense. Perhaps that is true if you are a hobbyist commenting on the internet. It does have to make sense in security management, though. The definitions of the terms are well understood in business and there are liabilities when associated terms are violated. That is why there are security certifications that are valued and recognized by the software industry, so that the people who do this for a living having a common shared understanding of the risks and penalties.

gruez 8y ago

Yes, technically because it's conducted by someone in the middle of the transport path, you can call it man in the middle. The problem is that if you call all attacks that, what do you call the attack where asymmetric key exchange is being replicated by some attacker in the middle? Also, it's possible to pull this particular attack off without being in the "middle",. For example, by using DNS cache poisoning or arp spoofing

joombaga 8y ago
> The problem is that if you call all attacks that, what do you call the attack where asymmetric key exchange is being replicated by some attacker in the middle? You use a more exact term. I don't see the problem.
- austincheney 8y ago
  I think you are missing the prior commentor's point. MITM already has a specific definition. It isn't as broad as you are attempting to redefine it. This concept is commonly understood by security people and commonly confused by software developers. I suspect the failure is that for software developers all parts of a network are in the middle between their application and their end user, so anything in that nebulous space corresponds with the words comprising MITM. That line of thinking is reductio ad nausium.

austincheney 8y ago

The OWASP definition is correct. The gist of a MITM is that each end of the transmission trusts that the malicious actor in the middle is the target destination. When this occurs at the application layer it is almost universally centered on encryption. Keep in mind that in TCP/OSI terms the web is an application riding the internet. Without encryption how do you trust that the destination is who they claim to be? MITM can occur on routers if the router is compromised by someone malicious or if it lacks integrity from the service provider. Routers are layer 3 devices that connect different networks. If a router is compromised so that traffic is sent to a different network with spoofed domains and content. One resolution is that form of attack is IPSEC. IPSEC is not often used across the public internet, because much of the public internet is still IPv4 and still reliant on NAT and PAT to compensate for a shortage of IP addresses. Even more rare than that is certificate spoofing. This is hard to execute, which is why public certificates are usually good for as long as a year, but it does occasionally happen. This is why there are certificate revocation procedures.

joombaga 8y ago
> The OWASP definition is correct. Okay. Your definition, with its additional encryption requirement, is at odds with the OWASP definition. > Without encryption how do you trust that the destination is who they claim to be? Signing? Or just ignorance? I agree that "trust" is a component, but it doesn't have to make sense. I can still fool you and the server to which you're connecting into thinking I'm the other party.
- austincheney 8y ago
  > Okay. Your definition Not really. I did expound on this in the very comment you replied to. > I agree that "trust" is a component, but it doesn't have to make sense. Perhaps that is true if you are a hobbyist commenting on the internet. It does have to make sense in security management, though. The definitions of the terms are well understood in business and there are liabilities when associated terms are violated. That is why there are security certifications that are valued and recognized by the software industry, so that the people who do this for a living having a common shared understanding of the risks and penalties.