| Revision as of 19:37, 6 February 2018 editTonymetz (talk | contribs)Extended confirmed users970 edits test changes for Earny pageTag: Visual edit | Revision as of 00:12, 1 March 2024 edit undoTonymetz (talk | contribs)Extended confirmed users970 editsNo edit summaryNext edit → | ||
| Line 1: | Line 1: | ||
| == Earny == | == Earny == | ||
| Earny is a free mobile & web app service for the US, founded by Oded | Earny is a free mobile & web app service for the US, founded by Oded | ||
| == Man-in-the-Middle Attacks (MITM) == | |||
| Man-in-the-middle Attacks involve a malicious attacker trying to intercept, surveil and/or modify communications between two parties by spoofing one or both party's identities and injecting themselves in-between.<ref name="verizon-mitm"/> | |||
| Types of MITM Attacks | |||
| * IP Address Spoofing, is where the attacker hijacks routing protocols to reroute the targets traffic to a vulnerable network node for traffic interception or injection. | |||
| * Message Spoofing (via Email, SMS or OTT Messaging), is where the attacker spoofs the identity or carrier service while the target is using messaging protocols like Email, SMS or OTT (IP-based) messaging apps. The attacker can then monitor conversations, launch social attacks or trigger zero-day-vulnerabilities to allow for further attacks. | |||
| * WiFi SSID Spoofing, is where the attacker simulates a WIFI base station SSID to capture and modify internet traffic and transactions. The attacker can also use local network addressing and reduced network defenses to penetrate the target's firewall by breaching known vulnerabilities. Sometimes known as a Pineapple attack thanks to a popular device. See also ]. | |||
| * ] is where attackers hijack domain name assignments to redirect traffic to systems under the attackers control, in order to surveil traffic or launch other attacks. | |||
| * SSL hijacking, typically coupled with another media-level MITM attack, the attacker spoofs the SSL authentication and encryption protocol by way of Certificate Authority injection in order to decrypt, surveil & modify traffic. See also ] | |||
| <ref name="verizon-mitm"> | |||
| {{Cite web |url=https://www.verizon.com/business/resources/articles/s/what-is-a-man-in-the-middle-attack-and-how-can-i-protect-my-organization/ |title=What is a man-in-the-middle attack and how can I protect my organization? |website=]}} | |||
| </ref> | |||
Revision as of 00:12, 1 March 2024
Earny
Earny is a free mobile & web app service for the US, founded by Oded
Man-in-the-Middle Attacks (MITM)
Man-in-the-middle Attacks involve a malicious attacker trying to intercept, surveil and/or modify communications between two parties by spoofing one or both party's identities and injecting themselves in-between.
Types of MITM Attacks
- IP Address Spoofing, is where the attacker hijacks routing protocols to reroute the targets traffic to a vulnerable network node for traffic interception or injection.
- Message Spoofing (via Email, SMS or OTT Messaging), is where the attacker spoofs the identity or carrier service while the target is using messaging protocols like Email, SMS or OTT (IP-based) messaging apps. The attacker can then monitor conversations, launch social attacks or trigger zero-day-vulnerabilities to allow for further attacks.
- WiFi SSID Spoofing, is where the attacker simulates a WIFI base station SSID to capture and modify internet traffic and transactions. The attacker can also use local network addressing and reduced network defenses to penetrate the target's firewall by breaching known vulnerabilities. Sometimes known as a Pineapple attack thanks to a popular device. See also Malicious association.
- DNS Spoofing, is where attackers hijack domain name assignments to redirect traffic to systems under the attackers control, in order to surveil traffic or launch other attacks.
- SSL hijacking, typically coupled with another media-level MITM attack, the attacker spoofs the SSL authentication and encryption protocol by way of Certificate Authority injection in order to decrypt, surveil & modify traffic. See also TLS Interception