4 ms·
In most cases ARP spoofing [0] is probably a lot easier, and gives you all the traffic, instead of just one connection. And if we're talking something like a CG
by lawl 5y ago
In most cases ARP spoofing [0] is probably a lot easier, and gives you all the traffic, instead of just one connection. And if we're talking something like a CGN where ARP spoofing isn't possible, how would you know when to try to hijack a connection if you can't already see the signaling traffic. And if you can already see the signaling traffic, you probably have easier means to MITM.
And even if you managed to get past all that. Don't they layer encryption and authentication on top anyways? I know WebRTC uses DTLS and the certificates are exchanged through the signaling channel. So unless you can MITM the signaling channel already (which probably itself uses TLS), it won't get you anything.
In short, I don't think it's particularly interesting.
[0]: https://en.wikipedia.org/wiki/ARP_spoofing https://en.wikipedia.org/wiki/ARP_spoofing
- alduin32 5y agoOf course, but ARP spoofing doesn't have the same requirements (being on the same L2 domain), and it can be easily defended against at the switch level. But indeed, this attack requires us to know when (and where) to start sending probes. > And even if you managed to get past all that. Don't they layer encryption and authentication on top anyways? That's true of most network-level MITM attacks, it doesn't mean they are useless, as the layered encryption and authentication is not always properly implemented.