Man-in-the-Middle Attack to the HTTPS Protocol

Callegati, Franco; Cerroni, Walter; Ramilli, Marco

doi:10.1109/msp.2009.12

Cited by 280 publications

(122 citation statements)

References 1 publication

Supporting

Mentioning

120

Contrasting

Unclassified

Order By: Relevance

“…6, we assume that the hacker is able to intercept the HTTPS connection between the client and the guest book form using a proxy tool by, for example, following the guidelines explained in [1]. The hacker first configures the tool to automatically inject an XSS script in a certain part of the HTTPS request sent to the guest book form (<<create>> and configureAutoInjectXSSscriptInMsgInHTTPSRequest).…”

Section: Identifying Threat Scenarios With Respect To the Integrity Omentioning

confidence: 99%

“…Figure 12 shows likelihood estimates for the third path in which UI1 occurs. Intercepting HTTPS connections is possible and in some situations easy to carry out [1]. However, the exploitability of vulnerabilities in encrypted communication protocols, such as HTTPS, is difficult on a large scale [20].…”

Section: Estimating Risks Posed On the Integrity Of The Guest-book's mentioning

confidence: 99%

“…The tester defines the interpretation of the risk levels. In this demonstration we let numerical values represent risk levels; [1] represents the lowest risk level and [9] represents the highest risk level.…”

mentioning

confidence: 99%

See 2 more Smart Citations

A Systematic Method for Risk-Driven Test Case Design Using Annotated Sequence Diagrams

Erdogan

Refsdal

Stølen

2014

Risk Assessment and Risk-Driven Testing

View full text Add to dashboard Cite

Section: Identifying Threat Scenarios With Respect To the Integrity Omentioning

confidence: 99%

Section: Estimating Risks Posed On the Integrity Of The Guest-book's mentioning

confidence: 99%

See 1 more Smart Citation

A Systematic Method for Risk-Driven Test Case Design Using Annotated Sequence Diagrams

Erdogan

Refsdal

Stølen

2014

Risk Assessment and Risk-Driven Testing

View full text Add to dashboard Cite

“…Un ataque Spoofing consiste en aplicar técnicas de suplantación de identidad generalmente con usos maliciosos o de investigación [20]. El objetivo de este ataque es alcanzar la confianza de su víctima haciéndose pasar por otra máquina.…”

Section: Ataque De Suplantación De Identidad (Spoofing)unclassified

Cascade Structure for Finite Impulse Response Filters and Linear Prediction

Molina¹

2012

ings

View full text Add to dashboard Cite

ResumenLos ataques a redes IP pueden colapsar la continuidad de los servicios de las empresas afectando su imagen y causando graves pérdidas económicas. La presente investigación se centra en la evaluación de diversos ataques reales de redes IP utilizando plataformas de virtualización con el fin de establecer mecanismos de seguridad para mitigarlos. Para llevarlo a cabo, se diseñaron e implementaron varias topologías de experimentación usando entornos virtuales de red, dentro de las cuales se probaron el escaneo de puertos, fuerza bruta, suplantación de identidad y denegación de servicios, tanto en una red de área local como en una extendida. Para cada topología, se utilizó diferente software libre tanto para producir el ataque como para obtener el flujo de tráfico, evaluándose las consecuencias del ataque. Para contrarrestar dichos ataques, se desarrolló un demonio en Shell script que es capaz de detectar, controlar y mitigar los ataques mencionados de manera programable y constante. Los resultados muestran la funcionalidad de esta investigación que reduce las amenazas y vulnerabilidades de las redes en producción.Palabras clave: ataques de seguridad, tecnologías de virtualización. AbstractIP networks attacks can collapse the continuity of business services affecting its image and causing economic losses. This research focuses on the evaluation of several IP networking real attacks using virtualization platforms to provide security mechanisms to mitigate them. To carry out this work, we designed and implemented several experimentation topologies using virtual network environments, within which were tested port scans, brute force, spoofing and denial of services, both on a local area network as wide area network. For each topology, different free open source software was used both to produce the attack and to obtain the traffic flow, evaluating the consequences of these attacks. To deal with such attacks, we developed a demon program that is able to prevent, detect and mitigate these attacks mentioned. The results show the functionality of this research that reduces threats and vulnerabilities in production networks.

show abstract

“…Other types of MITM attack can be found in https [41,42], Bluetooth [43]. [42] shows a more thorough discussion of MITM attacks in tunneled authentication protocols.…”

Section: Man In the Middlementioning

confidence: 99%

Mobile Electronic Identity: Securing Payment on Mobile Phones

Chen¹,

Roscoe²

2011

Information Security Theory and Practice. Security and Privacy of Mobile Devices in Wireless Communication

View full text Add to dashboard Cite

Abstract. The pervasive use of mobile phones has created a dynamic computing platform that a large percentage of the population carries routinely. There is a growing trend of integrating mobile phones with electronic identity, giving the phone the ability to prove or support the identity of the owner by containing, for example, a tuple of name, ID, photo and public key. While this helps phone owners prove who they are, it does not prove to them that they are giving their identities to intended parties. This is important in its own right for reasons of privacy and avoiding cases of "identity theft", but all the more important when identity is being provided to support the transfer of value (e.g. in mobile payment) or information. In this paper we show how Human Interactive Security Protocols can support this type of authentication in cases where PKIs are inappropriate, misunderstood or too expensive, concentrating on the case of payment.

show abstract

Man-in-the-Middle Attack to the HTTPS Protocol

Cited by 280 publications

References 1 publication

A Systematic Method for Risk-Driven Test Case Design Using Annotated Sequence Diagrams

A Systematic Method for Risk-Driven Test Case Design Using Annotated Sequence Diagrams

Cascade Structure for Finite Impulse Response Filters and Linear Prediction

Mobile Electronic Identity: Securing Payment on Mobile Phones

Contact Info

Product

Resources

About