8 ms·

The author includes a surprising response from "Provider B" to the HackerOne report. > Provider B: Reported on 2024-05-21 through their HackerOne program. Got

The author includes a surprising response from "Provider B" to the HackerOne report. > Provider B: Reported on 2024-05-21 through their HackerOne program. Got a prompt triage response, stating that attacks requiring MITM (or physical access to a user's device) are outside the scope of the program. Sent back a response explaining that MITM or physical access was not required for sniffing. Awaiting response. I think Provider B morally should require HTTPS, but it really surprises me that the author would say "MITM or physical access is not required for sniffing." Is that true? Isn't HTTP sniffing an example of a MITM attack, by definition? Am I using the words "MITM" or "sniffing" differently from the author? I'm familiar with the following attacks, all of which I'd call "MITM": 1. Public unencrypted (or weakly WEP encrypted) wifi, with clients connecting to HTTP websites. Other clients on the same wifi network can read the unencrypted HTTP packets over the air. 2. Public encrypted wifi, where the attacker controls the wifi network (or runs a proxy wifi with the same/similar SSID,) tricking the client into connecting to the attacker over non-TLS HTTP. 3. ISP-level attacks where the ISP reads the packets between you and the HTTP website. Aren't all of these MITM attacks, or at the very least "physical access" attacks? How could anyone possibly perform HTTP sniffing without MITM or physical access??

Aachen 2y ago
Definition question. I can see your reasoning and I can see the author's, where they define MITM as requiring an active component being in the middle to actually tamper with it and not just some far-off device receiving backscatter with a high-gain antenna, or a read-only mirror port on a switch or whatever is technically not "in the middle" but in a cul-de-sac. I'm not sure I've got a strong opinion, claiming one or the other is the only correct definition might just be nitpicking They may have chosen this wording ("it's not MITM") to get the team into action rather than dismissing the risk Edit: another legitimate-sounding question downvoted in this thread without further comment (since I'm the only comment still after it got downvoted). Can people maybe just explain what's wrong with a post when it's not a personal attack, not off topic, not answered in the article, or any other obvious downvote reason? Everyone would appreciate the author learning from the problem if there is one
thaumasiotes 2y ago
> Public unencrypted (or weakly WEP encrypted) wifi, with clients connecting to HTTP websites. Other clients on the same wifi network can read the unencrypted HTTP packets over the air. That's sniffing. The other two are MITM. The sniffer isn't in the middle of anything; you never speak to him.
- Brian_K_White 2y ago
  You have to mitm in order to evesdrop on an encrypted channel. If you do nothing but evesdrop, isn't it still mitm? You had to actively replace & spoof the two endpoints, but that is just a technicality required by the encryption, in the end you still only evesdropped, yet it was still called mitm. So, mere evesdropping is mitm. So, how is evesdropping on unencrypted traffic or wifi traffic meaningfully different than evesdropping by decrypt & reencrypt? I don't think the term mitm includes a requirement that you aren't talking to who you thought you were talking to, because generally you do still talk to who you thought you were, just not directly. The traffic may be modified along the way rather than merely copied, or one or the other endpoint may be wholly faked rather than merely relayed, but they also may not be, the attacker may simply relay everything verbatim in both directions, IE pure evesdropping, and the attack would still be called mitm. Then again, I guess a keylogger is evesdropping and not called mitm.
  - danparsonson 2y ago
    > You have to mitm in order to evesdrop on an encrypted channel. OK but we're talking about evesdropping HTTP, which is unencrypted.
    - Brian_K_White 2y ago
      So what? My point was the encryption doesn't matter, it's just the reason you have to impersonate in order to merely evesdrop sometimes.
      - danparsonson 2y ago
HL33tibCe7 2y ago
MITM generally refers to someone who can intercept and modify traffic, i.e. they sit “in the middle”, between you and your recipient, reading/modifying/relaying traffic. “Passive eavesdropper” is often used to describe what you talk about. Someone on an unencrypted WiFi network sniffing your traffic isn’t really “in the middle” at all, after all.
- Control8894 2y ago
  I disagree. So does Wikipedia ("where the attacker secretly relays and possibly alters the communications between two parties who believe that they are directly communicating with each other, as the attacker has inserted themselves between the two parties ... for example, an attacker within range of an Wi-Fi access point hosting a network without encryption could insert themselves as a man in the middle") and so I believe do most people. "Active MITM" would be how you describe someone who does modify traffic. And an attacker in each of the scenarios GP mentioned can modify traffic. (For ISP/attacker-controlled networks it's trivial; for other networks you just need to ARP spoof)
  - dTP90pN 2y ago
    There's no "relaying" when the the attacker just captures unencrypted WiFi packets from the air, or more traditionally, splits some light out of the fiber line.
    - Control8894 2y ago
      > for example, an attacker within range of an Wi-Fi access point hosting a network without encryption The monkey in the middle doesn't get to "relay" anything either, but he can sure see it going over his head.
    - Brian_K_White 2y ago
      I hate to agree but they are right. Endpoint-spoofing and relaying between two spoofed endpoinbts is just one of the possible forms of mitm attack that just happens to be required if you happen need to open and re-pack encryption in order to evesdrop, or if you need to modify the data. Spoofing the two endpoints to decrypt and re-encrypt, just so that you can evesdrop without modifying the data (other than the encryption) is certainly still "mitm". Yet all the man in the middle did was evesdrop. Becoming two endpoints in the middle was only an implimentetion detail required because of the encryption. If you are admin of one of the mail servers along the way between sender and recipient and and can read all the plain smtp messages that pass through your hands like postcards without having to decrypt or spoof endpoints, that is still mitm. So listening to wifi is no less. There is nothing substantive that makes it any different. For endpoint-spoofing to be required for mitm, you would have to say that mitm only applies to modifying the data, which I don't think is so. Several purely evesdropping applications are still called mitm.
tsimionescu 2y ago
I don't think people would consider 1 or 3 to be MITM. MITM requires someone who is, well, in the middle: you connect to the MITM, and they connect to your destination. 2 is clearly a MITM. Also, while 1 is arguably a case of "physical access", I don't think 3 is. If you have a tap in an ISP, you don't have "physical access" to any of the endpoints of the HTTP connection. Otherwise, you could say you have "physical access" to literally every machine on the internet, since there is some physical path between you and that machine. For another example, Kubernetes started as IPv4-only, and there are still plenty of plugins that have IPv4-only features.
CGamesPlay 2y ago
At the end of the day it doesn't matter how you define "MITM". HTTPS means that even if I control a network hop in between the two endpoints, I can't get the key. Provider B says "we are OK with any hop on your route gaining access to your keys" (e.g. via owning a wifi router and giving customers access, or via being a customer and sniffing other customer's traffic, or the industrial-level equivalents of this).
joveian 2y ago
Consider: 4. Someone else logs unencrypted traffic for whatever reason and the attacker gets access to the log later. MITM means that you need to be in the middle at the time of the attack and so is more limited than an attack that works on logs.

Aachen 2y ago

Definition question. I can see your reasoning and I can see the author's, where they define MITM as requiring an active component being in the middle to actually tamper with it and not just some far-off device receiving backscatter with a high-gain antenna, or a read-only mirror port on a switch or whatever is technically not "in the middle" but in a cul-de-sac. I'm not sure I've got a strong opinion, claiming one or the other is the only correct definition might just be nitpicking They may have chosen this wording ("it's not MITM") to get the team into action rather than dismissing the risk Edit: another legitimate-sounding question downvoted in this thread without further comment (since I'm the only comment still after it got downvoted). Can people maybe just explain what's wrong with a post when it's not a personal attack, not off topic, not answered in the article, or any other obvious downvote reason? Everyone would appreciate the author learning from the problem if there is one

thaumasiotes 2y ago

> Public unencrypted (or weakly WEP encrypted) wifi, with clients connecting to HTTP websites. Other clients on the same wifi network can read the unencrypted HTTP packets over the air. That's sniffing. The other two are MITM. The sniffer isn't in the middle of anything; you never speak to him.

Brian_K_White 2y ago
You have to mitm in order to evesdrop on an encrypted channel. If you do nothing but evesdrop, isn't it still mitm? You had to actively replace & spoof the two endpoints, but that is just a technicality required by the encryption, in the end you still only evesdropped, yet it was still called mitm. So, mere evesdropping is mitm. So, how is evesdropping on unencrypted traffic or wifi traffic meaningfully different than evesdropping by decrypt & reencrypt? I don't think the term mitm includes a requirement that you aren't talking to who you thought you were talking to, because generally you do still talk to who you thought you were, just not directly. The traffic may be modified along the way rather than merely copied, or one or the other endpoint may be wholly faked rather than merely relayed, but they also may not be, the attacker may simply relay everything verbatim in both directions, IE pure evesdropping, and the attack would still be called mitm. Then again, I guess a keylogger is evesdropping and not called mitm.
- danparsonson 2y ago
  > You have to mitm in order to evesdrop on an encrypted channel. OK but we're talking about evesdropping HTTP, which is unencrypted.
  - Brian_K_White 2y ago
    So what? My point was the encryption doesn't matter, it's just the reason you have to impersonate in order to merely evesdrop sometimes.
    - danparsonson 2y ago

HL33tibCe7 2y ago

MITM generally refers to someone who can intercept and modify traffic, i.e. they sit “in the middle”, between you and your recipient, reading/modifying/relaying traffic. “Passive eavesdropper” is often used to describe what you talk about. Someone on an unencrypted WiFi network sniffing your traffic isn’t really “in the middle” at all, after all.

Control8894 2y ago
I disagree. So does Wikipedia ("where the attacker secretly relays and possibly alters the communications between two parties who believe that they are directly communicating with each other, as the attacker has inserted themselves between the two parties ... for example, an attacker within range of an Wi-Fi access point hosting a network without encryption could insert themselves as a man in the middle") and so I believe do most people. "Active MITM" would be how you describe someone who does modify traffic. And an attacker in each of the scenarios GP mentioned can modify traffic. (For ISP/attacker-controlled networks it's trivial; for other networks you just need to ARP spoof)
- dTP90pN 2y ago
  There's no "relaying" when the the attacker just captures unencrypted WiFi packets from the air, or more traditionally, splits some light out of the fiber line.
  - Control8894 2y ago
    > for example, an attacker within range of an Wi-Fi access point hosting a network without encryption The monkey in the middle doesn't get to "relay" anything either, but he can sure see it going over his head.
  - Brian_K_White 2y ago
    I hate to agree but they are right. Endpoint-spoofing and relaying between two spoofed endpoinbts is just one of the possible forms of mitm attack that just happens to be required if you happen need to open and re-pack encryption in order to evesdrop, or if you need to modify the data. Spoofing the two endpoints to decrypt and re-encrypt, just so that you can evesdrop without modifying the data (other than the encryption) is certainly still "mitm". Yet all the man in the middle did was evesdrop. Becoming two endpoints in the middle was only an implimentetion detail required because of the encryption. If you are admin of one of the mail servers along the way between sender and recipient and and can read all the plain smtp messages that pass through your hands like postcards without having to decrypt or spoof endpoints, that is still mitm. So listening to wifi is no less. There is nothing substantive that makes it any different. For endpoint-spoofing to be required for mitm, you would have to say that mitm only applies to modifying the data, which I don't think is so. Several purely evesdropping applications are still called mitm.

tsimionescu 2y ago

I don't think people would consider 1 or 3 to be MITM. MITM requires someone who is, well, in the middle: you connect to the MITM, and they connect to your destination. 2 is clearly a MITM. Also, while 1 is arguably a case of "physical access", I don't think 3 is. If you have a tap in an ISP, you don't have "physical access" to any of the endpoints of the HTTP connection. Otherwise, you could say you have "physical access" to literally every machine on the internet, since there is some physical path between you and that machine. For another example, Kubernetes started as IPv4-only, and there are still plenty of plugins that have IPv4-only features.

CGamesPlay 2y ago

At the end of the day it doesn't matter how you define "MITM". HTTPS means that even if I control a network hop in between the two endpoints, I can't get the key. Provider B says "we are OK with any hop on your route gaining access to your keys" (e.g. via owning a wifi router and giving customers access, or via being a customer and sniffing other customer's traffic, or the industrial-level equivalents of this).

joveian 2y ago

Consider: 4. Someone else logs unencrypted traffic for whatever reason and the attacker gets access to the log later. MITM means that you need to be in the middle at the time of the attack and so is more limited than an attack that works on logs.