Man-in-the-Middle Attack and Prevention Measures

Grabovica, Nikolina (author), Jurišić, Aleksandar (mentor)

Man-in-the-Middle (MITM) attacks present a big threat to the online security because adversaries have the ability to intercept, store and use personal information, such as personal identification numbers (e.g. passport numbers), credit card numbers, passwords, etc. We will demonstrate how some messages between two parties of the protocol (devices) can be intercepted using Domain name system (DNS) spoofing and Address Resolution Protocol (ARP) cache poisoning attacks, if the communication is carried out in a certain vulnerable environment. We will introduce preventive measures against different MITM attacks, and propose a new tool called SpoofBlocker to detect and prevent MITM-spoofing-based attacks. We will also study new methods for preventing forgery in signature schemes. Two presented hash-and-sign signatures schemes that are based on RSA and Computational Diffie-Hellman (CDH) constructions imposed the adversary’s forgeries in a certain small set of categories and then used selectively-secure techniques to perform adaptively-secure signature schemes.

• Language: English
• Keywords: Man-in-the-Middle attack, key, protocol, DNS spoofing, ARP cache poisoning, Wi-Fi, security, SpoofBlocker, hash-and-sign, Computational Diffie-Hellman, RSA, digital signature, signature scheme
• Work type: Master's thesis/paper
• Typology: 2.09 - Master's Thesis
• Organization: FRI - Faculty of Computer and Information Science
• Year: 2023
• PID: 20.500.12556/RUL-148415
• COBISS.SI-ID: 163560707
• Publication date in RUL: 22.08.2023

Secondary language

• Language: Slovenian
• Title: Napadi s posrednikom in zaščita pred njimi

Abstract

Napadi s posrednikom (MITM) predstavljajo veliko grožnjo spletni varnosti, saj lahko napadalci prestrezajo, shranjujejo in uporabljajo osebne podatke, kot so osebni identifikacijski številki (npr. številke potnega lista), številke kreditnih kartic, gesla itd. Prikazali bomo, kako se lahko sporočila med dvema udeležencema protokola (napravama) prestrezajo z uporabo napadov DNS ponarejanja in zastrupitve predpomnilnika ARP, če se komunikacija izvaja v določenem ranljivem okolju. Predstavili bomo preventivne ukrepe proti različnim MITM napadom in predlagali novo shemo za zaznavanje in preprečevanje napadov, ki temeljijo na ponarejanju v okviru MITM. Prav tako bomo preučili nove metode za preprečevanje ponarejanja v shemah podpisov. Dve predstavljeni shemi podpisov, ki temeljita na RSA in na računski Diffie-Hellmanovi (CDH) konstrukciji, omejujeta napadalčeva ponarejanja na določeno majhno množico kategorij in nato uporabljata tehniko selektivne varnosti za izvajanje prilagodljivo varnih shem podpisov.

• Keywords: Napad s posrednikom, protokol, DNS ponarejanje, zastrupitev predpomnilnika ARP, Wi-Fi, varnost, SpoofBlocker, računski Diffie-Hellman, RSA, digitalni podpis, shema podpisov