|Name ||Man in the Middle Attack |
|Summary ||This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed on to the other component as if it was never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identify between two components. |
|Prerequisites ||There are two components communicating with each other.
An attacker is able to identify the nature and mechanism of communication between the two target components.
An attacker can eavesdrop on the communication between the target components.
Strong mutual authentication is not used between the two target components yielding opportunity for attacker interposition.
The communication occurs in clear (not encrypted) or with insufficient and spoofable encryption. |
|Solutions ||Get your Public Key signed by a Certificate Authority
Encrypt your communication using cryptography (SSL,...)
Use Strong mutual authentication to always fully authenticate both ends of any communications channel.
Exchange public keys using a secure channel |
|CWE ID ||Description |
|CWE-287 ||Improper Authentication |
|CWE-290 ||Authentication Bypass by Spoofing |
|CWE-294 ||Authentication Bypass by Capture-replay |
|CWE-300 ||Channel Accessible by Non-Endpoint ('Man-in-the-Middle') |
|CWE-593 ||Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created |
|CWE-724 ||OWASP Top Ten 2004 Category A3 - Broken Authentication and Session Management |