2.4 - On-Path Attacks

Question 1

On-path network attack

Answer 1

• How can an attacker watch without you knowing?
  – Formerly known as man-in-the-middle
• Redirects your traffic
  – Then passes it on to the destination
  – You never know your traffic was redirected
• ARP poisoning
  – On-path attack on the local IP subnet
  – ARP has no security
  – ARP poisoning (spoofing)

Question 2

On-path browser attack

Answer 2

• What if the middleman was on the same
  computer as the victim?
  – Malware/Trojan does all of the proxy work
  – Formerly known as man-in-the-browser
• Huge advantages for the attackers
  – Relatively easy to proxy encrypted traffic
  – Everything looks normal to the victim
• The malware in your browser waits for you
  to login to your bank
  – And cleans you out

Question 3

ARP poisoning (spoofing)

Answer 3