Man-in-the-middle Attack And It's Mode Of Operation

Source

Introduction

A Man In The Middle Attack, the names of these cryptographic attacks can be so funny sometimes I wonder how they came up with the names well, just as the name implies this is a kind of attack where a third party positions himself or herself in a way that he or she is able to secretly intercept details of sensitive communication between two parties.

This attack is facilitated or carried out either by eavesdropping, stealing the information or using a malware or other means to gain unauthorized access into ones data and communications hence, destroying the concept of privacy and classification of sensitive information and data.

In this post of mine I am going to be discussing and explaining some of the modes of operation of the man in the middle attack or you can say some of the significant devastating ways in which the man in the middle attack can compromise the security and integrity of the blockchain ecosystem.

• Ip Spoofing

IP spoofing which basically stands for "Internet Protocol" can simply be said to be a method or technique used by attackers to alter or change the source of a certain IP address making it look like they are legit and coming from a trusted source as a result lowering the guard of individuals or networks so they can sneak up on them, stab them in the back and steal their sensitive information.

The attacker basically just sends out packets which contains a fake or altered IP address to networks they consider to be their targets and potential victims, once the packet is received the network start giving information think that they are the legitimate and legal party they falsely represented themselves to be.

However, we are not left at the mercy of attackers who use the technique of IP spoofing what individuals and networks can do to prevent falling victim to an IP spoofing , or a countermeasure to implement would be to use mechanism that inspect and validate the source of any packet.

• Dns Spoofing

I think I should define Spoofing seeing as this is the second time I will be using it in this post, spoofing can basically be said to be the act of intentionally misrepresenting a particular data or information for the purpose of lowering the guard of networks and individuals enough to gain unauthorized access into their devices and steal their data.

Source

DNS which fully means Domain Name System when combined with spoofing to make DNS Spoofing can be said to be a man in the middle attack mode of operation that involves altering and corrupting the DNS cache of a "revolver" so as to redirect users to a different website other than the original website.

Therefore, with the facilitating of this attack in this way users are made to unknowingly, forcefully visit sites that are owned and controlled by the attacker however, to prevent this attack, certain mechanisms also could be used to periodically verify the authentication of a DNS data in the blockchain network.

• Session Hijacking

Session hijacking which can also be called cookie hijacking which I think is a funny name for a man in the middle attack but who cares, is a mode of operation that practically takes advantage of the vulnerabilities in the session management mechanism by stealing another users session token and gaining access into their account.

How the attack is done starts by stealing a users session token, this is done by intercepting the users browser cookies, the attacker then goes on to use the stolen token to impersonate the user and gain access into his or her account allowing them to have access to sensitive data and the funds of the user.

With this attack not only the information or data of the user is at stake or is being compromised but also his cryptocurrencies and assets however do not panic because this kind of whining can be avoided by simply practicing safe browing practices like using secure browsing cookies and regularly changing session tokens.

• Ssl Striping

SSL which is basically an acronym for Secure Sockets Layer can be defined as a kind of encryption security protocol which can be used to encrypt the connection or links between a browser and a web server, what this mode operation does is that it decrypts the encryption that is keeping the connection between the browser and web server secure, leaving it vulnerable to manipulations and corruption.

How the man in the middle attack is facilitated in this way is that, the attacker eliminates the encryption on a HTTPS network, converting it to HTTP, it does this by intercepting the users request for the application of HTTPS and alters it to be a request for an HTTP which is not secure hence, allowing the attacker to easy access to any information or communication done in or through that browser.

Source

Conclusion

I would like to say a very big thank in advance to everyone who made the time and effort go through, read and comment on this post which I have written, and I hope that you have been able to learn something new as I have explained and discussed the significant modes of operation of the man in the middle attack.