3 ms·
A "passive eavesdropper" has all the information they need to become an active man-in-the-middle. Observe the DNS query on its way out and send your own respons
by billpg 12y ago
A "passive eavesdropper" has all the information they need to become an active man-in-the-middle. Observe the DNS query on its way out and send your own response with your IP before the real response comes back. The client will then make its TCP connection to that injected IP.
- userbinator 12y agosend your own response with your IP before the real response comes back Being able to inject traffic is not "passive".
- billpg 12y agoThe DNS response doesn't have to come from the same channel as the original request. If you've got an ISP that doesn't check the source IP of what you're sending, your target's endpoint will see your fake response and treat it as the real one. Where we stand now, the only thing stopping an eavesdropper from becoming a man-in-the-middle is the will and resources of that eavesdropper.
- Karunamon 12y agoYup - but there's still a difference. Someone might just want to snoop on your traffic rather than mess with it.