Information Assurance Day Course Man-in-the-middle Attacks

Outline Introduction The Exercise The Concept of MITM Networking Overview How to become the MITM What can you do with that? The Exercise Jasager Demo

Introduction – MITM User Attacker Service The concept is relatively simple. If you sit in between a user and the service they're trying to use, you are able to manipulate that interaction in any way you want. This manipulation may be hard to detect for the user, and can be leveraged to gain access to that user's sensitive data or even compromise that user's computer.

Introduction – Networking There are many ways that the network can be exploited to start intercepting traffic from a user. There are many components involved in networking, and they are generally represented like so in the OSI model: Explain the attacks at different layers. * Physical – hubs, tabs (show off our ninja star tap!) * Data Link/Network – ARP spoofing * Presentation/Application – DNS spoofing & poisoning, redirects, SSL weaknesses http://en.wikipedia.org/OSI_model

Introduction – Becoming the MITM We've already discussed some of the attacks, but the easiest and most common ways include ARP spoofing and physically inserting yourself in the middle. The second one is interesting because it doesn't necessarily require any sort of technical exploitation. Think about “free wifi” for a moment... Restaurants Hotels Airports

Introduction – Post-Exploitation So, specifically, what can you do when you control all of a user's traffic? Inject whatever you want into the pages they view. Advertisements = $$$$ Malware Sniff all data to/from that user. Blackmail Steal credentials Redirect their traffic wherever you want.

Jasager Demo