Forensic Analysis of MITM Attacks
Captured network traffic from what is suspected to be a MITM attack can be analyzed in order to determine if it really was a MITM attack or not. Important evidence to analyze when doing network forensics of a suspected SSL MITM attack include:
- IP address of the server
- DNS name of the server
- X.509 certificate of the server
- Is the certificate self signed?
- Is the certificate signed by a trusted CA?
- Has the certificate been revoked?
- Has the certificate been changed recently?
- Do other clients, elsewhere on the Internet, also get the same certificate?
Read more about this topic: Man-in-the-middle Attack
Famous quotes containing the words analysis and/or attacks:
“Ask anyone committed to Marxist analysis how many angels on the head of a pin, and you will be asked in return to never mind the angels, tell me who controls the production of pins.”
—Joan Didion (b. 1934)
“I find that with me low spirits and feeble health come and go together. The last two or three months I have had frequent attacks of the blues. They generally are upon me or within me when I am somewhat out of order in bowels, throat, or head.”
—Rutherford Birchard Hayes (1822–1893)