3 ms·
Good point. If we're being imaginative, there's various side channels an attacker could use to carefully target their attack, such as seeing a new MAC or DHCP l
by c7DJTLrn 3y ago
Good point. If we're being imaginative, there's various side channels an attacker could use to carefully target their attack, such as seeing a new MAC or DHCP lease on the local network.
- deleted 3y ago[deleted]
- xg15 3y agoTrue. Also depends on what the target is. I.e., if the attacker wants to impersonate machines that are only avaliable on the local network, then it's probably reasonable to conclude that a machine which was never seen on that LAN before also hasn't yet connected to the impersonated host. However, that isn't true for "public" SSH endpoints, such as github, gitlab etc - e.g. if the attacker is impersonating the wifi if the nearest Starbucks to snoop on all the hipster solo-devs there, he'll probably be unable to impersonate github, because even people who use that wifi for the first time have probably connected to github before, on a different network.