Vulnerability Development mailing list archives
RE: Secure Yahoo logins
From: "Kayne Ian (Softlab)" <Ian.Kayne () softlab co uk>
Date: Thu, 29 Aug 2002 09:20:43 +0100
->
segment) or some sort of DNS diversion which would probably require you to have control of the necessary DNS servers. At that
DNS Cache poisoning is probably the easiest way of doing that to unsecured DNS servers. Ian Kayne Technical Specialist - IT Solutions Softlab Ltd - A BMW Company
-----Original Message----- From: Steve Bremer [mailto:steveb () nebcoinc com] Sent: 28 August 2002 17:34 To: nick () ethicsdesign com Cc: vuln-dev () securityfocus com Subject: Re: Secure Yahoo logins If you can perform a mitm attack, there is no doubt you can read the traffic since you'll actually be decrypting it. However, performing the mitm attack is the problem here. With the exception of the recent browser flaws, it's not necessarily an easy attack. You would have to find a way to get their browser to go to your machine in the first place. This would require some sort of ARP spoofing (in which case you would need to be on their local network segment) or some sort of DNS diversion which would probably require you to have control of the necessary DNS servers. At that point, you'd also have to deal with the warning the user would receive about an unsigned certificate being used (although this may not be difficult since many people click through the warnings). There may be other (easier) methods as well, but I'm not aware of them. Please enlighten me if I'm wrong. Steve On 28 Aug 2002 at 1:36, Nick Jacobsen wrote:I just love this... You are telling me that I can't sniffinformationfrom an SSL session using a mitm attack? the whole pointis that youare in the middle... i.e. client connects to you and you coneect to server, therefore the SSL session with the server is between you and the server, not the client and the server... you simply pass everything on to the client as well, acting as the remote server... Try using ettercap, then tell me I am wrong... Nick J. Ethics Design nick () ethicsdesign com ethics () netzero net ----- Original Message ----- From: "David Thiel" <lx () redundancy redundancy org> To: "Nick Jacobsen" <nick () ethicsdesign com> Cc: <vuln-dev () securityfocus com> Sent: Tuesday, August 27, 2002 9:06 PM Subject: Re: Secure Yahoo loginsOn Tue, Aug 27, 2002 at 08:36:40PM -0700, Nick Jacobsen wrote:it supports SSH(Secure Telnet)SSH is not even remotely like "Secure Telnet".and SSL(HTTPS) decryption and sniffing, asOnly if you have the server's keypair.I guess my main point is that if you are having yourusers log inusing "secure log in" for the express reason of makingit so theirpasswordcannotbe sniffed, it is pointless, as anyone can STILL sniff it!There's a higher difficulty level involved with MITM attacks, and measures can be taken to prevent and/or recognize suchattacks. SSLis not a panacea, but it's a useful layer of security. The fact that MITM attacks exist is not proper rationale for abandoning the use of encryption.
******************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you are not the intended recipient or the person responsible for delivering to the intended recipient, be advised that you have received this email in error and that any use of the information contained within this email or attachments is strictly prohibited. Internet communications are not secure and Softlab does not accept any legal responsibility for the content of this message. Any opinions expressed in the email are those of the individual and not necessarily those of the Company. If you have received this email in error, or if you are concerned with the content of this email please notify the IT helpdesk by telephone on +44 (0)121 788 5480. ********************************************************************
Current thread:
- Re: Secure Yahoo logins, (continued)
- Re: Secure Yahoo logins John Madden (Aug 27)
- Re: Secure Yahoo logins Roland Postle (Aug 28)
- Re: Secure Yahoo logins Nick Jacobsen (Aug 27)
- Re: Secure Yahoo logins David Thiel (Aug 27)
- Re: Secure Yahoo logins Nick Jacobsen (Aug 28)
- Re: Secure Yahoo logins David Thiel (Aug 28)
- Re: Secure Yahoo logins Steve Bremer (Aug 28)
- Re: Secure Yahoo logins David Thiel (Aug 27)
- Re: Secure Yahoo logins John Madden (Aug 27)
- Re: Secure Yahoo logins Alan McCaig (Aug 28)
- Re: Secure Yahoo logins Chris Caydes (Aug 28)
- Re: Secure Yahoo logins Chris Caydes (Aug 28)
- RE: Secure Yahoo logins Kayne Ian (Softlab) (Aug 29)
- Re: Secure Yahoo logins Muhammad Faisal Rauf Danka (Aug 29)