1. Man-in-the-Middle Attacks
By: Eamon Callahan and Matthew Harris

2. Many Abbreviations
MiM
MItM
MitM
MITM
MIM

3. How It Works Attacker "eavesdrops" on conversation
Impersonates both parties, receives and forwards conversation
Goal is to gain information without any party knowing

5. How It Works

6. Types: Email Hijacking
Bad guys gain access to account
Read s without making changes
May eventually send an changing account number to pay to
Often aimed at businesses to steal client info
Prevention: KEEP YOUR SECURE

7. Types: DNS Spoofing
Technique in which the attacker (Chris) supplies false DNS (Domain Naming System) information to the victim host so that they are sent to a fake website at a different IP address than the one they are searching for. 

8. Types: WiFi Eavesdropping
Bad guys set up “Free Wifi” connection and monitor all traffic that goes through it
Can grab passwords, user IDs, account numbers, etc
Bad guys can use tools like WireShark and simply read packets as they are sent
Tools can even reassemble packets into viewable web pages
Prevention: DON’T USE UNSECURED WIFI POINTS FOR ANY IMPORTANT LOGIN

9. NSA and GSCHQ Impersonation of Google
September 2013 it was discovered as part of the latest NSA scandal that the agency (along with British counterpart GSCHQ) had the ability to and employed it to hack a target’s Internet router and covertly redirect targeted Google traffic using a fake security certificate so it could intercept the information in unencrypted format.
A program called Flying Pig was used to overcome the increase in use of SSL encryption by providers. The system appears to allow it to identify information related to use of the anonymity browser Tor (it has the option to query “Tor events”) and also allows spies to collect information about specific SSL encryption certificates.

10. BlueTooth Vulnerabilites
Devices accessed via Bluetooth
Android, iOS, Linux, Windows
Bluetooth used to propagate malware
Ransomware, BotNets, etc.
“These silent attacks are invisible to traditional security controls and procedures. Companies don't monitor these types of device-to-device connections in their environment, so they can't see these attacks or stop them”
no-user-action/article/688067/