Man-in-the-middle Attack - Forensic Analysis of MITM Attacks

Forensic Analysis of MITM Attacks

Captured network traffic from what is suspected to be a MITM attack can be analyzed in order to determine if it really was a MITM attack or not. Important evidence to analyze when doing network forensics of a suspected SSL MITM attack include:

  • IP address of the server
  • DNS name of the server
  • X.509 certificate of the server
    • Is the certificate self signed?
    • Is the certificate signed by a trusted CA?
    • Has the certificate been revoked?
    • Has the certificate been changed recently?
    • Do other clients, elsewhere on the Internet, also get the same certificate?

Read more about this topic:  Man-in-the-middle Attack

Famous quotes containing the words analysis and/or attacks:

    “Ask anyone committed to Marxist analysis how many angels on the head of a pin, and you will be asked in return to never mind the angels, tell me who controls the production of pins.”
    —Joan Didion (b. 1934)

    “Neither the wrath of Heaven nor the attacks of enemies
    are as fatal as Pleasure alone when she infects the mind.”
    —Silius Italicus (26–101)