1 / 14

Measures to prevent MITM attack and their effectiveness

Measures to prevent MITM attack and their effectiveness. CSCI 5931 Web Security Submitted By Pradeep Rath Date : 23 rd March 2004. Introduction. Definition : When two users are communicating remotely through internet, exchange public keys to start a reliable and secure

akamu
Télécharger la présentation

Measures to prevent MITM attack and their effectiveness

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Measures to prevent MITM attack and their effectiveness CSCI 5931 Web Security Submitted By Pradeep Rath Date : 23rd March 2004

  2. Introduction Definition: When two users are communicating remotely through internet, exchange public keys to start a reliable and secure communication. During this process if somehow both the keys are intercepted on its route by someone, he can send on the messages to both the parties involved in communication but with his own faked public keys.

  3. Digital Certificates • Digital certificates are an electronic file • Used to uniquely identify a person or a website (server). • Digital certificates are issued by certificate authority such as Verisign, thwate… • They validate the public key used by the server in transaction and key exchange.

  4. How does it work?

  5. Is it completely foolproof? • It is not completely foolproof. • Ways to work around the system: • Using a chain of certificates. Anyone with a valid CA-signed certificate for any domain can generate a valid CA- signed certificate for any other domain.

  6. How Does this Work ? • Whenever this is a chain of certificates. • Browser is supposed to check the common name CN field of the leaf certificate is the same as the domain he is connected to. • [Issuer: Verisign / Subject: Verisign] -> [Issuer: Verisign / Subject: Intermediate CA] -> [Issuer: Intermediate CA / Subject: www.thoughtcrime.org]

  7. Contd… • The browser performs a check for validity by checking the intermediate CA certificate and then the intermediate CA is signed by the Root CA (Verisign). • The next check required is to check that all intermediate certificates have valid CA Basic Constraints.

  8. Contd… • The problem lies in the browser some browser do not check the valid CA basic constraints, which means • Anybody with a valid CA signed certificate could generate a valid certificate for any other domain. • [CERT - Issuer: Verisign / Subject: Verisign] -> [CERT - Issuer: Verisign / Subject: www.thoughtcrime.org] -> [CERT - Issuer: www.thoughtcrime.org / Subject: www.amazon.com]

  9. Contd… • Here the browser accepts the certificate chain to be a valid amazon.com certificate. • So anybody with standard tools for connection hijacking can combine this flaw into a successful MITM. • Affected browser is Internet explorer whereas netscape and mozilla are unaffected.

  10. Other Techniques • There is another way MITM can be achieved that is by DNS spoofing. • As there is no way for server to authenticate the client, after the client is made to believe that the attacker is the server, the attacker could perform MITM. • When a attacker uses DNS spoofing he assumes that the browser is not configured to issue warnings against use of a fake certificate.

  11. Contd… • DNS spoofing is a simple redirection mechanism and can be done using tools like Dsniff. • If the attacker could get the user to trust the fake certificate and install it into the list of trusted CA’s all further communications are compromised .

  12. Solutions. • The MITM attacks rely upon spoofing ARP and DNS. • Sites should use static ARP tables when possible, • Servers and site should migrate to DNSSEC as soon as practicable. • Deploy an intrusion detection device. • Use proper and better configured versions of a browser.

  13. References • Mike Benham IE SSL Vulnerability. • http://www.hut.fi/~tkoponen/vaihe2/ssl-mitm.html • Discussion of verisign's Technical Brief: "Building an E-Commerce Trust Infrastructure: SSL Server Certificates and Online Payment Services"

  14. Thank You! Any Questions ?

More Related