1. 網路安全管理－
期末報告
MITM 中間人攻擊
指導教授：梁明章教授
學生　　：王經維

2. 大綱
何謂MITM
Public Key加密下之MITM實例
可能的攻擊方式
Session hijacking
防護方法
參考文獻

3. 何謂MITM
A man-in-the-middle attack (MITM) is an attack in which an attacker is able to read, insert and modify at will messages between two parties without either party knowing that the link between them has been compromised.
The attacker must be able to observe and intercept messages going between the two victims.

4. 何謂MITM (續)

5. 何謂MITM (續)
The MITM attack can work against public-key cryptography and is also particularly applicable to the original Diffie-Hellman key exchange protocol, when used without authentication.

6. Public Key加密下之MITM實例

7. Public Key加密下之MITM實例(續)

8. 可能的攻擊方式
Eavesdropping, including traffic analysis and possibly a known-plaintext attack
Chosen-ciphertext attack(CCA) , depending on what the receiver does with a message that it decrypts
Substitution attack. A man-in-the-middle attack, where the attacker replaces the public keys of the sender and receiver by his/her own public key is sometimes referred to as a bucket brigade attack.

9. 可能的攻擊方式(續) Replay attacks DoS attack.
Phishing attacks. attacks, where victims are duped into entering their details into a website that imitates a genuine site (e.g., an online bank). By acting as a go-between to the genuine website, the proxy website allows the victims to log in and conduct business as usual without raising suspicion

10. 可能的攻擊方式(續)

11. Session hijacking
Replay attacks－Session hijacking

12. Session hijacking (續)

13. Session hijacking (續)

14. 防護方法 Public key infrastructures
Other criteria, such as voice recognition or other biometrics

15. 防護方法(續) Off-the-Record Messaging for instant messenging
Off-the-Record Messaging, commonly referred to as OTR, is a cryptographic protocol that provides strong encryption for instant messaging conversations. OTR uses a combination of the AES symmetric-key algorithm, the Diffie-Hellman key exchange, and the SHA-1 hash function. In addition to authentication and encryption, OTR provides perfect forward secrecy and deniable encryption.

16. 防護方法(續)

17. 參考文獻

18. The End…
Thanks for your Attention!