#ManInTheMiddle

[madcaptoys]

1975 Atlantic Records 45 RPM POP Abba SOS Man In The Middle

[magiaeninternet]

- 👩‍🦳: Yo, what if someone’s listening in on our conversation? Aw, sweetie, you’re being so paranoid sometimes!

#humour #tech #maninthemiddle

[vgperfection]

I came very close to being scammed today!

It is easy to feel complacent when you regularly get advance fee scams full of laughable spelling mistakes, broken English and hilariously badly faked documents. It’s easy to think “it will not happen to me!” when you watch channels on YouTube like Kitboga or Atomic Shrimp, who make entertainment out of making scammers look like fools. It is easy to think just because you’re generally vigilant to such things that you won’t get scammed. Well I’m here to remind you that it’s possible for someone with years of computer and IT industry experience to come close to getting scammed.

My name is Matt, I’m in my 40s, I’ve worked in IT or with computers since leaving university in my early 20s. I’m not a black hat hacker by any stretch, but I know what Kali Linux is, how to brute force a non salted hash or run a script to crack a WEP key. I use PGP, two-factor authentication, password managers and regularly annoy companies by insisting on better security than their usual clients do.

Today, I came within inches of being scammed. In fact, had a PDF document I opened contained a malicious payload (and I suppose I can’t discount the fact that it did and I just cannot detect it) I would have been “pwned”. As it stands, I ‘merely’ nearly lost thousands of Euros.

What was the attack I very nearly fell for? It was a simple “man in the middle” attack on e-mail. That universally used and almost completely insecure means of communication that we all still rely on.

My accountant had just finished up the books for the year end here in Ireland and sent me a final invoice for the amount due. He sent this by e-mail, which is not an uncommon thing to do.

A few moments later I get another e-mail from the same person, which I’ll reproduce here:-

There’s not really much here to set off any alarm bells. The sender’s name, e-mail address, return address, reply-to address etc were all normal. “error mistake” is kind of an unusual turn of phrase, but not outside the realms of possibility for something you might type if you were in a hurry.

Notice the fraudster also says “You can also find the same bank information on the attached invoice”. I foolishly opened this PDF and what they say is correct. The original PDF had been edited with the new bank account details, making for a pretty convincing scam. Again, in the PDF there are some small tell-tale signs, but nothing that you would notice from a cursory glance. There was some smudging around where the attacker copy pasted the new bank account information over the old, and the links to pay by credit/debit card had been taken out.

Monday morning the fraudster e-mailed me again, asking me politely if I’d got the previous e-mail. I replied to say I had and I would deal with it soon, but said no more to them as I was already suspicious. They then asked me to let them know as soon as I made payment, which set even more alarm bells ringing. Fraudsters will often try to get some sense of urgency going to try and make you send the payment without giving you time to be diligent. Again, let me emphasise that the attacker had full control of this e-mail account, it wasn’t a case of a spoof account where you can spot that the return address does not match. As far as anyone could tell, this was a legitimate e-mail from a company domain e-mail account.

Honestly, had this been for a smaller amount I would probably have paid it. The attacker already made me open a PDF document which as we know is dangerous. That makes me feel pretty silly, but at least I didn’t wire the money. Instead I took it upon myself to ring the accountants using the phone number on their website and check. They then were able to confirm that, indeed, their senior accountants e-mail had been hacked and they reported it to An Garda Síochána.

A clever, patient fraudster like this could have been watching the e-mail account for months, waiting for a juicy opportunity like this to come along.

I’m telling you this story because I think there are two important takeaways from this tale.

1) If you haven’t enabled two-factor authentication for your e-mail accounts yet, for Gods sake enable it!

2) Whenever adding a new payee, or updating an old one, always verify the new bank account information via another means, such as telephone.

I don’t care if friends, family, colleagues sigh or roll their eyes at you for being vigilant, because vigilance like this will save you the one time out of 100 that something like this actually turns out to be a scam, like it did for me today.

[ryadel]

Public Key Infrastructure (PKI) - Definitions and use cases

A Public Key Infrastructure (often abbreviated as PKI) is a set of processes and technological means that allow trusted third parties to verify and / or guarantee the identity of a user, as well as to associate a public key to a user: These public keys typically take the form of digital certificates. In this article we will try to provide a general overview of this type of infrastructure, starting with the definition and the main examples of use.

Definition

In recent years, the term PKI has been used to indicate both the Certification Authority (CA) and related agreements, and, more broadly, the use of public key cryptographic algorithms in electronic communications. However, the use of the term in the latter sense is incorrect, as a PKI does not necessarily require the use of public key algorithms. Furthermore, the PKI structure does not only concern the CA but a plurality of subjects and services connected to them, namely: - Certification Authority (CA), a public or private trusted third party authorized to issue a digital certificate through a certification procedure compliant with current regulations; - Registration Authority (RA), which is the system for registering and authenticating users who request the certificate; - Validation Authority (VA), which is the system that certifies the correspondence between the certificate issued and the issuing entity. - Security policies that defines the general principles; - Certificate Practice Statement (CPS), a document that illustrates the procedure for issuing, registering, suspending and revoking the certificate; A PKI infrastructure is hierarchically composed of several Certification Authorities at the top of which is a root CA that certifies all the others. The first step in building a PKI is therefore to create the root CA. At this point, however, a problem arises: if the root CA is the root of the tree, who signs its certificate? The answer is very simple: the CA signs its own certificate, issuing the key pair itself. From this it is clear the importance that the root CA has a good / excellent reputation, as there is no guarantor authority over it.

Use cases

The main purpose of PKIs is to provide users' public keys and, at the same time, guarantee their identity. Public keys, once released, are usually used to perform the following functions: - Encryption and/or authentication in email messages (e.g. using OpenPGP or S/MIME). - Encryption and/or authentication in standard documents (such as XML Signature or XML Encryption). - User authentication for applications (e.g. when logging into a system via smart card or authenticating a client via SSL/TLS). - Bootstrap procedures in secure communication protocols, such as the main protocols used for VPN and SSL connections. In both, the initial setup of a secure channel is done through public keys, while actual communications use faster secret key systems (aka Symmetric Key Cryptography).

Asymmetric Key Cryptography

Unlike symmetric encryption which uses a single key to encrypt and decrypt, asymmetric or public key encryption uses a pair of keys: a public key and a private key, respectively used to encrypt and decrypt. In such scenario, CAs are required to guarantee the association between a public key and the person who owns the corresponding private key. - Alice and Bob want to exchange signed and encrypted messages; for this purpose they both create their own key pair and publish the public ones on a keyserver; - Alice writes a message for Bob, signs it with her private key and encrypts it with Bob's public key, then she sends the message; - in reception Bob decrypts the message with his own private key and verifies the signature with the public key headed to Alice. At this point, Bob is able to determine two things: - the message was directed to him, as he managed to decrypt it with his own private key; - the message was encrypted with the private key that matches the public key he used to verify the signature. Man in the Middle If we look at the example we started earlier, we can easily see how Bob is unable to determine with certainty that the message really came from Alice; as a matter of fact, it's possible that a third party has managed to intercept the communication in which Bob obtains Alice's public key and has managed to replace it with his own, thus pretending to be Alice. If this happens, Bob has no way to discover the deception. This is a type of attack known as Man in the Middle, a term used to refer to all situations in which a third person stands between a communication between two subjects. To solve situations of this type, CAs are born that take care of verifying and guaranteeing the correspondence between key and owner, verifying the user's identity when he requests a certificate and then signing a digital certificate that certifies the user's identity. . In this way, the Man in the Middle no longer has a way to pretend to be Alice, as he is unable to reproduce the CA's signature. The Italian legislation, in implementation of the European Directive 1999/93 / EC, has identified in the CNIPA, now known as the Agency for Digital Italy, the public body that accredits the main certifying entities (eg Infocert, Aruba, Poste Italiane, etc.): in addition to accrediting the certifiers, AgID also controls their work and issues regulations in accordance with the current applicable legislation.

Conclusions

That's it for now: we hope this article will help those interested in understanding the structure and functioning of PKIs. The contents shown in this article delve into some specific aspects of more general topics such as data encryption and cyber security. For more information on these topics, we recommend reading our article on in-transit and at-rest data encryption.   Read the full article

[maestromedia]

The man in the middle, #memyselfandi sandwiched between China 🇨🇳 & Monaco 🇲🇨, that's talking about the goal machine himself, the gentleman par excellence @ighalojude & the money maker, fun man himself @elderson_echiejile. Met the extraordinary gentlemen last night at the @yomicasual new humongous store opening that was very star-studded, you would have thought it was a special car mart at the event. Both men were nice and had no airs. Salute to them #maestromediablog #maestrolifestyl #redcarpet #odionighalo #eldersonechiejile #supereagle #maninthemiddle (at Lekki Peninsula, Lagos) https://www.instagram.com/p/B6GWLOwlD8F/?igshid=uuocp0lxobf3

[groopemultimedia-blog]

BLOG WEEKLY: Man-in-the-middle & Session Hijacking . Article Link http://bit.ly/2KgeGJh . E-Commerce and cloud computing has enabled more companies to do online transactions and the rise in online data, which by large as also simultaneously increase security risk and vulnerabilities. Protecting these transactions and sensitivity information is vital to not only the end-users but also the company itself. “Symantec found that 31 percent of e-commerce applications were vulnerable to cookie manipulation and session hijacking”,(Lin, 2005) . READ MORE http://bit.ly/2KgeGJh #GroopeMultimediaResearch #GroopeMultimedia #CodingIsLife #Technology #DNS #FTP #HTTP #HyperTextTransferProtocol #ManInTheMiddle #MitM #SessionHijacking #TCP #TELNET #TransmissionControlProtocol #UDP #UserDatagramProtocol (at Montego Bay, Jamaica) https://www.instagram.com/p/B4xDTKphVTo/?igshid=1xpo06gvcs0py

[akashchugh-blog]

Spoofing and "Man in Middle" attack in Kali Linux - Using Ettercap

http://www.techtrick.in/description/4599-spoofing-and-man-in-middle-attack-in-kali-linuxusing-ettercap

[vpnanswers]

[pentesttoolz]

Pyrdp - RDP Man-In-The-Middle And Library For Python3

Pyrdp - RDP Man-In-The-Middle And Library For #Python3 With The Ability To Watch Connections Live Or After The Fact #RDP #MITM

[sc name=”ad_1″]

PyRDP is a Python 3 Remote Desktop Protocol (RDP) Man-in-the-Middle (MITM) and library. It features a few tools:

RDP Man-in-the-Middle

Logs credentials used when connecting

Steals data copied to the clipboard

Saves a copy of the files transferred over the network

Saves replays of connections so you can look at them later

Run console commands or PowerShellpayloads automatically on…

[jetc]

I am the law! #rushhour #philippines #travelphilippines #urbanphotography #maninthemiddle #trafficenforcer #cops #nightphotgraphy #myphilippines https://www.instagram.com/p/BrDBX0yHsMb/?utm_source=ig_tumblr_share&igshid=12dmx0zsluwih

[ct3ch]

Sennheiser's headphone software could allow attackers to intercept data

Sennheiser’s headphone software could allow attackers to intercept data

Sennheiser’s HeadSetup and HeadSetup Pro software poses a cybersecurity risk, according to a vulnerability disclosurefrom Germany’s Secorvo Security Consulting. The headphone-maker is now urging users to update to new versions of the software after researchers revealed it was installing a root certificate, along with an encrypted private key, into the Trusted Root CA Certificate store,…

[sirbenzelot]

Awesome & moody capture from the last session with @kevthales - thanks a lot! . . #blackandwhitephotography #depthobsessed #portrait #moodygrams #nightowl #portraitkillers #maninthemiddle (hier: Frankfurt, Germany)

[ryadel]

Infrastruttura a chiave pubblica (PKI) - Definizioni e casi d'uso

Una infrastruttura a chiave pubblica (in inglese Public Key Infrastructure, spesso abbreviata in PKI) è un insieme di processi e mezzi tecnologici che consentono a terze parti fidate di verificare e/o farsi garanti dell'identità di un utente, oltre che di associare una chiave pubblica a un utente: queste chiavi pubbliche tipicamente assumono la forma di certificati digitali. In questo articolo proveremo a fornire una panoramica generale di questo tipo di infrastruttura, a partire dalla definizione e dai principali esempi di utilizzo.

Definizione

Negli ultimi anni il termine PKI viene utilizzato per indicare sia l'autorità di certificazione (Certification Authority, CA) e i relativi accordi, sia, in senso più esteso, l'uso di algoritmi crittografici a chiave pubblica nelle comunicazioni elettroniche. Tuttavia, l'utilizzo del termine nell'ultimo senso è errato, in quanto una PKI non necessariamente richiede l'uso di algoritmi a chiave pubblica. Inoltre, la struttura della PKI non riguarda solo la CA ma una pluralità di soggetti e servizi ad essi collegati, ovvero: - Certification Authority (CA), un soggetto terzo di fiducia pubblico o privato abilitato ad emettere un certificato digitale tramite una procedura di certificazione conforme alle normative vigenti; - Registration Authority (RA), ovvero il sistema di registrazione e autenticazione degli utenti che domandano il certificato; - Validation Authority (VA), ovvero il sistema che attesta la corrispondenza tra il certificato emesso e l’entità emittente. - Policy di sicurezza che definisce i principi generali; - Certificate Practise Statement (CPS), un documento che illustra la procedura per l'emissione, registrazione, sospensione e revoca del certificato; Un'infrastruttura PKI è composta gerarchicamente da più Certification Authority al cui vertice si trova una CA root che certifica tutte le altre. Il primo passo per costruire un'infrastruttura PKI è quindi creare la CA radice dell'albero, ossia la CA root. A questo punto, però, si pone un problema: se la CA root è la radice dell’albero, chi ne firma il certificato? La risposta è molto semplice: la CA firma da sé il proprio certificato, emettendo da sola la coppia di chiavi. Da questo si evince l’importanza che la CA root abbia una buona/ottima reputazione, in quanto non c'è nessuna autorità garante sopra di essa.

Esempi di Utilizzo

Il principale scopo delle PKI è quello di fornire le chiavi pubbliche degli utenti e, nel contempo, garantire la loro identità. Le chiavi pubbliche, una volta rilasciate, vengono solitamente utilizzate per assolvere alle seguenti funzioni: - Cifratura e/o autenticazione del mittente nei messaggi e-mail (ad es. usando OpenPGP o S/MIME). - Cifratura e/o autenticazione dei documenti (ad es. gli standard per i documenti XML come XML Signature o XML Encryption). - Autenticazione degli utenti per le applicazioni (ad es. quando si effettua l'accesso ad un sistema tramite smart card o l'autenticazione di un client attraverso SSL/TLS). - Procedure di Bootstrap nei protocolli di comunicazione sicura, come i principali protocolli utilizzati per le connessioni VPN e SSL. In entrambi, l'impostazione iniziale di un canale sicuro viene effettuata attraverso chiavi pubbliche, mentre le comunicazioni vere e proprie utilizzano sistemi a chiave segreta (ovvero Crittografia a chiave simmetrica) più veloci.

Crittografia asimmetrica

Al contrario della cifratura simmetrica che utilizza un’unica chiave per cifrare e decifrare, la cifratura asimmetrica o a chiave pubblica si avvale di una coppia di chiavi: una chiave pubblica e una chiave privata, rispettivamente utilizzate per cifrare e per decifrare. Le CA sono la soluzione per il problema dell'associazione fra una chiave pubblica e la persona che possiede la relativa chiave privata. - Alice e Bob vogliono scambiarsi messaggi firmati e crittografati; a tale scopo entrambi creano la loro coppia di chiavi e pubblicano quelle pubbliche su un keyserver; - Alice scrive un messaggio per Bob, lo firma con la propria chiave privata e lo cripta con la chiave pubblica di Bob, quindi invia il messaggio; - in ricezione Bob decripta il messaggio con la propria chiave privata e verifica la firma con la chiave pubblica intestata ad Alice. Bob a questo punto è in grado di poter determinare due cose: - il messaggio era diretto a lui, in quanto è riuscito a decifrarlo con la propria chiave privata; - il messaggio è stato crittografato con la chiave privata che corrisponde alla chiave pubblica da lui utilizzata per verificare la firma. Man in the Middle Se riflettiamo sull'esempio iniziato in precedenza, possiamo facilmente renderci conto di come Bob non sia in grado di poter determinare con certezza che il messaggio provenga realmente da Alice; è infatti possibile che una terza persona sia riuscita a intercettare la comunicazione in cui Bob ottiene la chiave di pubblica di Alice e sia riuscita a sostituirla con la propria, spacciandosi in questo modo per Alice. Se questo avviene, Bob non ha alcun modo per scoprire l’inganno. Si tratta di una tipologia di attacco nota come Man in the Middle, termine utilizzato in riferimento a tutte le situazioni in cui una terza persona si frappone tra una comunicazione tra due soggetti. Per risolvere situazioni di questo tipo nascono le CA che si fanno carico di verificare e garantire la corrispondenza tra chiave e proprietario, verificando l’identità dell’utente quando questo richiede un certificato e poi firmando un certificato digitale che attesta l’identità dell’utente. In questo modo il Man in the Middle non ha più modo per spacciarsi per Alice, in quanto non è in grado di riprodurre la firma della CA. La legislazione italiana, in attuazione della direttiva europea 1999/93/CE, ha identificato nel CNIPA, oggi noto come Agenzia per l’Italia Digitale, l'ente pubblico che accredita i principali soggetti certificatori (es. Infocert, Aruba, Poste Italiane, ecc.): oltre ad accreditare i certificatori, AgID ne controlla anche l'operato ed emana i regolamenti in conformità alla legislazione applicabile corrente.

Conclusioni

Per il momento è tutto: ci auguriamo che questo articolo possa aiutare gli interessati a far luce sulla struttura e sul funzionamento delle PKI.   Read the full article

[megasoft012]

TLS Interception Thought Of Dangerous - Video And Slides

TLS Interception Thought Of Dangerous – Video And Slides

On the latest Chaos Communication Camp I held a chat summarizing the issues with TLS interception or Man-in-the-Middle proxies. This was initially motivated by the occurence of Superfish and my very own investigations on Privdog, however I discovered prior to now month that this may be a far greater drawback. I used to be stunned and considerably shocked to be taught that it appears to be…

[derechodelared]

BlueBorne: una vulnerabilidad en Bluetooth pone en riesgo a millones de dispositivos.

BlueBorne: una vulnerabilidad en Bluetooth pone en riesgo a millones de dispositivos.

Los investigadores de seguridad de la firma Armis han descubierto un total de 8 vulnerabilidades de día cero en el protocolo Bluetooh que afectan a más de 5.300 millones de dispositivos, desde Android, iOS, Windows y Linux hasta los dispositivos del Internet de las Cosas (IoT). A partir de estas vulnerabilidades, los investigadores…