Cyber threats : Man-in-the-Middle (MitM) Attacks

DEWI IKA (2110501032) AUGUSTA UNIVERSITY Cyber threats : Man-in-the-Middle (MitM) attacks 1. An attacker intends to use the WPA2-PSK protocol to conduct a Man-in-the-Middle (MitM) assault on an encrypted wireless network. How can the attacker attack the network using a MitM assault? The "Evil Twin Attack" approach is required by a MitM attack on a wireless network that uses WPA2-PSK encryption. This method involves the attacker building a phony wireless connection with the identical name as the legitimate network. The attacker can launch a MitM attack after the victim joins to the phony network by obtaining login credentials for the real network.The attacker often installs an unauthorized access point using a strong signal near to the victim's position to conduct an Evil Twin Attack. The victim won't be able to tell the difference between the two access points since they will have the identical name (SSID) and encryption preferences. In order to deceive the victim into joining to the malicious access point, the attacker may also employ various forms of social engineering, such as building a captive portal that looks just like the authentic login page. The attacker can intercept and change the victim's traffic, particularly passwords and sensitive information, after the victim establishes a connection. Users should exercise caution in connecting to public Wi-Fi networks and confirm the validity of the network before entering any critical information to avoid this kind of attack. Additionally, even if an attacker manages to steal the victim's password, establishing two-factor authentication can assist prevent unauthorized access. 2. An HTTPS-enabled website is the target of a MitM attack by an attacker. How is the attacker able to achieve it? The "SSL Stripping" approach can be used by the attacker to conduct a MitM attack against a website that makes use of the HTTPS protocol. In this method, the attacker builds a phony website that does not adhere to the HTTPS protocol and then tampers with the victim's requests to direct them to the false website. The attacker can get the victim's personal information and launch a MitM attack while the victim is utilizing the bogus website.Attackers can downgrade secure connections over HTTPS to insecure HTTP connections by intercepting messages exchanged between the target's web browser and the target website. This is accomplished by rerouting traffic from the victim to the attacker's website, which is not HTTPS-secured. In order to access and alter any personally identifiable information being communicated, the intruder then relays traffic among the victim and the object in question website while disabling HTTPS encryption. Websites should utilize HTTPS encryption and implement HTTP Strict Transport Security (HSTS) to avoid downgrade to HTTP in order to defend against SSL Stripping attacks. Additionally, consumers may safeguard themselves by utilizing browser add-ons that require HTTPS connections or by looking up the SSL certificate of a website before providing any critical information. 3. A TCP/IP-based computer network is the target of a MitM attack by an attacker. How is the attacker able to achieve it? The "ARP Spoofing" technique can be used by the attacker to conduct a MitM attack on a computer network using the TCP/IP protocol.In this method, the attacker forges a network computer's MAC address in order to redirect data meant for that computer to the attacker's computer. A MitM attack may be carried out by the attacker as long as they have access to monitor and alter the data transferred between two cooperating machines.During an ARP spoofing attack, the attacker pretends to be another computer on the network, such as the default gateway, by sending the victim's computer phony Address Resolution Protocol (ARP) packets. All traffic meant for the target computer is then diverted to the attacker's computer via the victim's PC.After that, the attacker has the option to intercept, alter, or forward the two parties' communication. in order to counteract ARP Network administrators may defend against spoofing attacks by using strategies including network segmentation, encryption, and ARP spoofing detection and avoidance tools. Virtual Private Networks (VPNs), which encrypt communication between a user's computer and the target network, are another way for users to secure themselves.