Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

i'm interested in understand the mechanism of man-in-the-middle attack. I know that, in a lan scenario, in order to do a mitm, an attacker needs to change the route-table (arp-poisoning). But in a internet contest? Is possible to do a mitm?

share|improve this question

3 Answers 3

up vote 2 down vote accepted

This is indeed possible, and called "{BGP|IP|route|prefix} hijacking".

These attacks are however more complicated than a lan mitm, but not very stealth.

On April 8th, 2010, a chinese ISP announced A LOT of prefixes, and this was seen by bgp probes all over the world.

Wired has a good article describing it, and you can also read the wikipedia entry.

share|improve this answer

There are many types of MITM attacks. Each of them depends on the protocol the attacker wants to abuse or his position in relation to your topology/traffic. As you mentioned there are LAN based MITM attacks (ARP cache poisoning or DHCP spoofing). MITM attacks to the routing infrastructure (prefix injection on an RIP/EIGRP/OSPF enabled WAN). And attacks to the infrastructure outside your organization but which you depend on, i.e. BGP prefix hijacking, DNS spoofing, etc.

One classic example is the case when an attacker [ISP/Government/Bad Guy] modifies your DNS responses and makes all your HTTP/email traffic pass through one of his rogue proxies without you knowing.

share|improve this answer

Is it possible? Yes. Someone sitting in an ISP somewhere could place something near a router carrying your traffic and tap the data to intercept it.

There are government agencies that do this, supposedly, all the time. All you need is a cooperative carrier and/or access to a device somewhere between points A and B and Bob's your uncle...

I'd also add that it's possible...possible...for traffic to be intercepted somewhere by a black-hat hacker sniffing/redirecting traffic after gaining access to a particular equipment. I've not really heard of it, but then again it's not the kind of thing a company would advertise happening if they didn't have to. And it's also possible for employees to abuse their access privileges.

Unless you're a black-hat standing to gain financially or personally from doing this, though, or you're a particularly public target for being hacked, chances are you don't need to worry about it.

share|improve this answer
    
Actually, gov agencies have legal backdoors in SP gear. This is called "lawful interception" features. –  petrus Mar 29 '11 at 21:36
1  
And somehow not so sure they are always used in a lawful manner... –  Bart Silverstrim Mar 29 '11 at 22:00
    
It's what SSL and similar encryption protocols try to prevent. They have mechanisms that also prevent playback. i.e. if you capture all the encrypted data and repeated it to the server say, the server would balk at it and probably throw it away. –  Matt Mar 29 '11 at 22:43
    
As long as the certs aren't compromised, sure. All most of those protocols do are outsource your trust to a third party, and even then most users don't pay attention to who signed them. Self-signed certs are so common that users just click through them like any other pop up "do you agree" stuff...it's just noise for them. –  Bart Silverstrim Mar 30 '11 at 9:48

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.