Man-in-the-middle Attack - Forensic Analysis of MITM Attacks

Forensic Analysis of MITM Attacks

Captured network traffic from what is suspected to be a MITM attack can be analyzed in order to determine if it really was a MITM attack or not. Important evidence to analyze when doing network forensics of a suspected SSL MITM attack include:

  • IP address of the server
  • DNS name of the server
  • X.509 certificate of the server
    • Is the certificate self signed?
    • Is the certificate signed by a trusted CA?
    • Has the certificate been revoked?
    • Has the certificate been changed recently?
    • Do other clients, elsewhere on the Internet, also get the same certificate?

Read more about this topic:  Man-in-the-middle Attack

Famous quotes containing the words analysis and/or attacks:

    “Ask anyone committed to Marxist analysis how many angels on the head of a pin, and you will be asked in return to never mind the angels, tell me who controls the production of pins.”
    —Joan Didion (b. 1934)

    “I must ... warn my readers that my attacks are directed against themselves, not against my stage figures.”
    —George Bernard Shaw (1856–1950)