Beware the man in the middle attack

Image courtesy of Charis Tsevis at Flickr.com

MITMA is an attack where a user gets between the sender and receiver of information and sniffs any information being sent. In some cases, users may be sending unencrypted data, which means the man-in-the-middle (MITM) can obtain any unencrypted information. The attacker secretly intercepts and relays messages between two parties who believe they are communicating directly with each other. The attack is a type of eavesdropping in which the entire conversation is controlled by the attacker. Sometimes referred to as a session hijacking attack, MITM has a strong chance of success when the attacker can impersonate each party to the satisfaction of the other. Man-in-the-middle attack is also known as a bucket brigade attack, or sometimes Janus attack in cryptography. One way that an attacker can pull-off a MITM attack in a place where public Wi-Fi is available is to create a fake Wi-Fi hotspot, which uplinks to the public place´s Wi-Fi. Then, the attacker can use a tool to intercept SSL connections. To protect against a MITM attack, the client should check that the server's certificate. This can be done by way of certificate pinning.

MITM attack could involve distributing malware that provides the attacker with access to a user’s Web browser and the data it sends and receives during transactions and conversations. Once the attacker has control, he can redirect users to a fake site that looks like the site the user is expecting to reach. Online banking and e-commerce sites are frequently the target of MITM attacks so that the attacker can capture login credentials and other sensitive data.

Don Burns found this clear illustration of a MITM attack:

There are 3 characters in this story: Mike, Rob, and Alex. Mike wants to communicate with Rob. Meanwhile, Alex (attacker) inhibit the conversation to eavesdrop and carry on a false conversation with Rob, behalf on Mike. First, Mike asks Rob for his public key. If Rob provides his key to Mike, Alex intercepts, and this is how “man-in-the-middle attack” begins. Alex then sends a forged message to Mike that claims to be from Rob, but including Alex’s public key. Mike easily believes that the received key does belong to Rob, when actually that’s not true. Mike innocently encrypts his message with Alex’s key and sends the converted message back to Rob.

In another common MITM attack, the attacker uses a Wi-Fi router to intercept user’s communication. This technique can be work out by exploiting a router with some malicious programs to intercept user’s sessions on the router. Here, the attacker first configures his laptop as a Wi-Fi hotspot, choosing a name commonly used in a public area, such as an airport or coffee shop. Once user connects to that malicious router to reach websites such as online banking sites or commerce sites, attacker then logs user’s credentials for later use.

An attacker can also exploit vulnerabilities in a wireless router’s security configuration caused by weak or default passwords. For example, a malicious router, also called an evil twin, can be setup in a public place like a café or hotel to intercept information traveling through the router. Other ways that attackers often carry out man-in-the-middle attacks include Address Resolution Protocol (ARP) spoofing, domain name system (DNS) spoofing, Spanning Tree Protocol (STP) mangling, port stealing, Dynamic Host Configuration Protocol (DHCP) spoofing, traffic tunneling and route mangling. When we need to pass information along to someone, different things help us verify with whom we’re speaking. To verify the identity, you can follow some of this precautions:

Image courtesy of Sarah at Flickr.com

SSL creates this virtual trust and establish a secure communication between devices. The idea behind SSL is to protect the communication between the sender and receiver in order to prevent eavesdropping. To achieve this, the parties must be able to validate that the remote party to which they are connected is the intended party. After this validation, the parties create a key that’s used to encrypt all data between them for the session.

Web and non-web applications use certificate validation to establish trust. Unfortunately, some applications skip validation and end up as easy targets for MITM attacks. The primary reason validation is skipped is that the host does not have a signed certificate from a trusted CA. These service credentials are typically used to authenticate the user but could also be used to validate the service. We can use the certificate to create a fingerprint and package this along with both a random and fixed magic number and then encrypt this package with the user’s password. The encrypted file is sent to the server, which can use the stored password to decrypt the file, validate the magic number and check the fingerprint against its certificate. If the fingerprint matches, the server increments the random number and sends that to the client along with the peer certificate’s fingerprint.

The importance of email and server encryption security

Clinton’s Email Controversy

Image courtesy of Mike Mozart at Flickr.com

Recently, former United States Secretary of State Hillary Clinton addressed her use of a personal email address and private email server while in office. A Salt Lake City computer security firm, determined that access to the server she used, was not encrypted or authenticated with a digital certificate, and in this conditions, someone could easily intercept communications because they are not being encrypted. Even worst, long term is a possibility if hackers obtained Clinton’s compromised credentials and used them to continue accessing her email archive. During that three month window during which Clinton’s email server lacked encryption, she visited countries and places such as Japan, Indonesia, South Korea, China, Egypt, Israel, the Palestinian Authority, Belgium, Switzerland, Turkey and Mexico. Some of this countries are known to operate and monitor network communications. “It’s highly unlikely that a person of that importance isn’t being targeted by people who want to gain access to the computational devices in her possession,” said John Kindervag, an analyst at Forrester Research. This is why it is important to have digital certificates in official communications. Clinton's use of a personal email account, tied to the private server at her family's New York home, has become one of the most potent scandals dogging her presidential campaign. It prompted questions about whether she was trying to skirt transparency laws, whether her actions had contributed to breaches of national security, and whether she and her aides understood the technical risks of the arrangement. The private server also allowed people to remotely access and configure it, a feature that poses a serious security threat if improperly configured.

The server that Hillary Clinton used to conduct official business as secretary of state lacked one of the most basic and important security features. The server setup, which consisted of two computers running antivirus programs, lacked a digital certificate to authenticate and encrypt its email communications. Website operators install digital certificates on their servers to authenticate their sites. The certificates pair with cryptographic keys and allow Web browsers to start secure browsing sessions, which scramble transmitted data in a way that makes it more difficult for third parties to intercept. Don Burns informs that you can recognize a website whose owner has installed a security certificate, by seeing a lock icon near your browser's address bar, and the Web address contains the "https" prefix. The Hillary Clinton email controversy has thrust email security into the spotlight. However, is protecting the servers enough, or is it necessary to start encrypting emails too?

Man in the Middle

Securing mail servers with Digital Certificates is important, because without one there is no way to identify that the mail server you are connecting to is actually the correct mail server and emails sent between your browser or email client and the server are not encrypted and could be intercepted. Without a certificate, you are open to a man-in-the-middle (MITM) attack. But it is important to know that a server certificate will protect your emails in transit to and from your server, and nothing to protect your emails as they pass through other servers, or protect emails a rest in the email systems.

Email Encryption

Image courtesy of Intel Free Press at Flickr.com

Encryption can be difficult for users, which is why there are automatic processes for employees and executives by using encryption appliances and services, routing emails through a gateway appliance that has been configured to ensure compliance with regulatory and security policies.

Email encryption protects the content from being read by other entities than the intended recipients. Most emails are currently transmitted without being encrypted. There are some available tools, which allows persons other than the designated recipients, to read the email contents. This encryption can rely on public-key cryptography, in which users can each publish a public key that others can use to encrypt messages to them, while keeping secret a private key they can use to decrypt such messages or to digitally encrypt and sign messages they send.

Most full featured email clients (like Apple Mail, Microsoft Outlook and Mozilla Thunderbird) provide native support for S/MIME secure email (digital signing and message encryption using certificates). Other encryption options include PGP and GNU Privacy Guard.

In addition to encryption, you can add digital signatures to your emails, to ensure authentication and data integrity. This means not only can you protect your emails from falling into the wrong hands, prove that your email actually came from you. The digital signature is applied with your private key and verified with your public key, which are unique to you. In plain words, the purpose of email authentication is to validate the identities of the participants. The results of such validation can then be used in email filtering, and can clue recipients in about what kind of reaction or reply a message deserves.