Man in the Middle Attack

From Computing and Software Wiki

Revision as of 03:08, 13 April 2009

Man in the Middle Example

Man in the Middle Attacks (sometimes MITM) are attacks where the attacker intercepts communication between two parties, forwarding the communication as if the attacker were not present. The name is derived from the popular game Man in the Middle. It is also referred to as a fire-brigade or bucket brigade attack based on the method for putting out a fire. Lastly it is referred to as a Janus attack in reference to the roman two-headed god of gates.^[1]

Generic Example

Alice sends a communication to Bob, which is intercepted by an attacker, and then forwarded on to Bob. Bob then replies to Alice which is also intercepted by the attacker, and then forwarded to Alice.

Specific MITM Attacks

Historically, several different man in the middle attacks have been described. Perhaps the earliest reference was a paper showing the possibility of IP spoofing in BSD Linux.^[2] A more recent and famous example is The Mitnick attack, a man in the middle attack taking advantage of the structure of IP to establish the trusted connections.
Another common man in the middle attack is IP Spoofing, where victims have all their web traffic re-routed through the attacker.^[3]

IP Spoofing Diagram ^[4]

Recently, there has been alot of press about MITM attacks defeating even SSL security. This is an especially distressing issue as this is the major form of security used on the web today. One researcher intercepted 200 requests for SSL encrypted pages over 20 hours, including 114 Yahoo! credentials, 50 Gmail credentials and 16 credit-card numbers.^[5,6]

MITM Attack Examples

LAN

• ARP Poisoining
• DNS Spoofing
• STP Mangling
• Port Stealing

Local to Remote

• ARP Poisoining
• DNS Spoofing
• DHCP Spoofing
• ICMP Redirection
• IRDP Spoofing
• Route Mangling

Remote

• DNS Poisoning
• Traffic
• Route Mangling

Wireless

• Access Point Reassociation

Active MITM Attacks ^[7]

Recently a new class of MITM attacks have been occurring with two important differences;

• It is initiated by the attacker
• The target is controlled by the attacker rather than limited to the victim's communications

While active attacks can happen in several ways one of the simplest to imagine is through IFrame injection. The attacker would modify the requested page to include an IFrame with a source of the attacker's choice.

Attack Flow

1. The victim browses to a page of their choice

2. The attacker intercepts the response and injects the IFrame into it

3. The user's browser automatically renders the IFrame sending the victim's credentials to the attacker. The attacker now has the victim's credentials and can continue with traditional hacking methods.

There are many different scenarios and types of active attacks that make browsing even sites traditionally thought safe dangerous.

Attacking Tools ^[8,9]

• Dsniff: A collection of tools for network auditing and penetration testing
• Ettercap: A suite of tools for MITM attacks over LAN.
• PacketCreator: A tool that uses ARP cache poisoning for network testing.
• Cain and Abel: A password recovery tool for Microsoft operating systems.
• Juggernaut: A network sniffer that can be used to hijack TCP sessions.

Defences

The two major issues with MITM attacks are endpoint verification, confirming you are speaking with the desired target and channel security, confirming that the medium of communication has not been infiltrated.

Beyond Computing

See Also

• Bots & Botnets
  
• Information security awareness
  
• Network firewall
  
• Network stack (dode) - attack patterns on each layer & how to defend it
  
• Operating Systems Security
  
• Personal Data Protection and Privacy
  
• Phishing
  

External Links

• CWE-300: Channel Accessible by Non-Endpoint (aka 'Man-in-the-Middle')
• Answers.Com Man in the Middle Attack
• Man in the Middle Attack - A Brief

References

1. http://en.wikipedia.org/wiki/Man-in-the-middle_attack
2. A Weakness in the 4.2BSD Unix TCP/IP Software, Robert T. Morris, AT&T Bell Laboratories, February 1985
   
3. http://www.csl.sri.com/users/ddean/papers/spoofing.pdf
4. http://www.contentverification.com/man-in-the-middle
5. http://www.sans.org/reading_room/whitepapers/threats/ssl_maninthemiddle_attacks_480?show=480.php&cat=threats
6. http://www.securityfocus.com/brief/910
7. http://blog.watchfire.com/wfblog/2009/02/active-man-in-the-middle-attacks.html
8. http://www.thenetworkadministrator.com/2005tophackingtools.htm
9. http://www.owasp.org/index.php/Man-in-the-middle_attack

--Heifetj 10:24, 12 April 2009 (EDT)