Alberto Ornaghi <alor@antifork.org>
Marco Valleri <naga@antifork.org>

Man in the middle attacks
DemosBlackhat Conference - USA 2003

1

The scenario
ServerAttacker
ClientBlackhat Conference - USA 2003

2

Once in the middle…
n Injectionn Key Manipulationn Downgrade attackn Filtering
Blackhat Conference - USA 2003

3

Injecting
nPossibility to add packets to an already establishedconnection (only possible in full-duplex mitm)

nThe attacker can modify the sequence numbers andkeep the connection synchronized while injecting
packets.

nIf the mitm attack is a “proxy attack” it is eveneasier to inject (there are two distinct connections)Blackhat Conference - USA 2003

4

Injecting
Command injectionn Usefulin scenarios where a one timeauthentication is used (e.g. RSA token).
In such scenarios sniffing the password isuseless,buthijacking
analreadyauthenticated session is criticaln Injection of commands to the servern Emulation of fake replies to the clientBlackhat Conference - USA 2003

5

Command Injection
DEMOBlackhat Conference - USA 2003

6

Key Manipulationn SSH v1

n IPSECn HTTPS

Blackhat Conference - USA 2003

7

Key Manipulation
SSH v1n Modification of the public key exchanged byserver and client.
startServer

ClientKEY(rsa)

S-KEY

MITM

Ekey[S-Key]

S-KEY

KEY(rsa)
Ekey[S-Key]

S-KEY

D(E(M))
M

Eskey(M)

D(E(M))
Blackhat Conference - USA 2003

8SSH v1 Attack
DEMO

Blackhat Conference - USA 2003

9

Key Manipulation
IPSEC
If two or more clients share the same “secret”, eachof them can impersonate the server with anotherclient.
Diffie-Hellman
exchange 1 –Authenticated by
pre-shared secret

ClientDiffie-Hellman
exchange 2 –Authenticated by
pre-shared secret

MiM
De-CryptPacketServerRe-CryptPacket

Blackhat Conference - USA 2003

10

Key Manipulation
HTTPS
We can create a fake certificate (eg:issued by VerySign) relying on browser
misconfiguration or user dumbness.

ClientFake cert.

MiMRealConnection
to the serverBlackhat Conference - USA 2003

Server11

HTTPS Attack
DEMO

Blackhat Conference - USA 2003

12

Filteringn The attacker can modify the payload of thepackets by recalculating the checksumn He/she can create filters on the flyn The

length of the payload can also bechanged but only in full-duplex (in this casethe seq has to be adjusted)Blackhat Conference - USA 2003

13

Filtering
Code Filtering / Injectionn Insertion of malicious code into web

pages or mail (javascript, trojans, virus,ecc)
n Modification on the fly of binary
binary files
files

during the download phase (virus,backdoor, ecc)
Blackhat Conference - USA 2003

14

Binary Modification
DEMO

Blackhat Conference - USA 2003

15

Filtering
HTTPS redirection
Let’s see an example
Change form destination
to http://attacker
Http post(login\password)

ClientHttp main page withhttps login form

MiM

Auto-submitting hidden
form with rightauthentication datalogin
password

ServerReal https authentication post
Authenticated connection

Blackhat Conference - USA 2003

16

HTTPS Redirection AttackDEMOBlackhat Conference - USA 2003

17

Downgrade Attacks
n SSH v2n IPSECn PPTPBlackhat Conference - USA 2003

18

Downgrade Attacks

SSH v2 à v1
nParameters exchanged by server and client can besubstituted in the beginning of a connection.
(algorithms to be used later)nThe attacker can force the client to initialize a SSH1
connection instead of SSH2.
– The server replies in this way:n SSH-1.99 -- the server supports ssh1
ssh1 andand ssh2
ssh2
n SSH-1.51 -- the server supports ONLY ssh1
ssh1

– The attacker makes a filter to replace “1.99” with “1.51”
nPossibility to circumvent known_hosts
Blackhat Conference - USA 2003

19

SSH v2 Downgrade
DEMO

Blackhat Conference - USA 2003

20

Downgrade Attacks
IPSEC Failuren Block

the keymaterial exchanged on theport 500 UDP

n End points think that the other cannot startan IPSEC connectionn If the client is configured in rollback mode,

there is a good chance that the user will notnotice that the connection is in clear text
Blackhat Conference - USA 2003

21

Downgrade Attacks
PPTP attack (1)nDuring negotiation phase– Force PAP authentication (almost fails)– Force MS-CHAPv1 from MS-CHAPv2 (easier to crack)– Force no encryptionnForce re-negotiation (clear text terminate-ack)– Retrieve passwords from existing tunnels– Perform previous attacksnForce “password change” to obtain password hashes– Hashes can be used directly by a modified SMB or PPTP
client– MS-CHAPv2 hashes are not usefull (you can force v1)
Blackhat Conference - USA 2003

22Downgrade Attacks
PPTP attack (2)Force PAP from CHAPstartServerreq | auth | chap

ClientMITM

req | auth | fakenak | auth | pap

nak| auth | chap

req | auth | pap

req | auth | pap

ack | auth | pap

ack | auth | pap

We don’t have to mess with GRE sequences...
Blackhat Conference - USA 2003

23

Downgrade Attacks
L2TP rollbackn

L2TP can use IPSec ESP as transport layer (strongerthan PPTP)n

By default L2TP is tried before PPTPn

Blocking ISAKMP packets results in an IPSec failuren

Client starts a request for a PPTP tunnel (rollback)n

Now you can perform PPTP previous attacks
Blackhat Conference - USA 2003

24

PPTP Attack
DEMO

Blackhat Conference - USA 2003

25

MITM attacks
Different attacks in different scenarios:
scenarios:
LOCAL AREA NETWORK:- ARP poisoning- DNS spoofing- Port stealing- STP mangling

FROM LOCAL TO REMOTE (through a gateway):- ARP poisoning- DNS spoofing- ICMP redirection- IRDP spoofing- DHCP spoofing- route mangling

REMOTE:- DNS poisoning- route mangling- traffic tunneling

WIRELESS:- Access Point Reassociation
Blackhat Conference - USA 2003

26

MITM attacks
ARP poisoningn

ARP is stateless (we all knows how it works and what
the problems are)nSome operating systems do not update an entry if it isnot already in the cache, others accept only the firstreceived reply (e.g solaris)n

The attacker can forge a spoofed ICMP packets to force
the host to make an ARP request. Immediately after theICMP it sends the fake ARP replaynUsefull on switched lan (the switch will not notice theattack)Blackhat Conference - USA 2003

27

MITM attacksARP poisoning - countermeasures
YES - passive monitoring (arpwatch)
n YES - active monitoring (ettercap)
n YES - IDS (detect but not avoid)
nYES - Static ARP entries (avoid it)
n YES - Secure-ARP (public key auth)n

NO - Port security on the switch
n NO - anticap, antidote, middleware approachnBlackhat Conference - USA 2003

28

ARP Poisoning
DEMO(all we have done until now …)Blackhat Conference - USA 2003

29

ARP Poisoning
Antidote Kernel Patchn

http://www. securityfocus.com/archive/1/299929

n“Kernel will send ARP request to test if there is ahost at old MAC address. If such response isreceived it lets us know than one IP pretends tohave several MAC addresses at one moment, thatprobably caused by ARP spoof attack.”n

We can fake this protection if the ARP entry is notin the cache and the real mac address will bebannedBlackhat Conference - USA 2003

30

Antidote Attack
DEMO

Blackhat Conference - USA 2003

31

MITM attack
Port stealingn

The attacker sends many layer 2 packets with:– Source address equal to victim hosts’
hosts’ address– Destination address equal to its own mac addressn

The attacker now has “stolen” victim hosts’ portsnWhen the attacker receives a packet for one of the victims it
generates a broadcast ARP request for the victim’s IP address.

n

When the attacker receives the ARP reply from the victim, thevictim’s port has been restored to the original binding staten

The attacker can now forward the packet and restart the stealing
processn

Possibility to circumvent static-mapped arp entries
Blackhat Conference - USA 2003

32

MITM attack
Port stealing - countermeasuresn YES - port security on the switch

n NO - static ARPBlackhat Conference - USA 2003

33

Port Stealing
DEMO

Blackhat Conference - USA 2003

34

Q&A
Alberto Ornaghi <alor@antifork.org>
Marco Valleri <naga@antifork.org>

Blackhat Conference - USA 2003

35