Dns Tampering Ettercap can intercept DNS requests, check against its own configuration, and reply back with an illegitimate IP Fake response occurs before the real response can reach the target, so the victim computer ignores it Can be done easily in “unified” mode, no bridging required
Dns Tampering • So what does this look like?Victim: where is youtube.com?Ettercap: do I have a record for this? If so, reply with an illegitimate IP addressVictim: I received an answer to my request for www.youtube.com, so all is wellLegit DNS Server: I know this record, replying with legit IPVictim: I just got another response for my request, but it’s already been fulfilled, so I’m ignoring this response
Dns Tampering• This attack is perfect for situations wherebridging isn‟t possible • (perhaps the attacker doesn‟t have physical access that high up in the network)• Isn‟t foolproof though • SSL-protected websites will present certificate errors • If the line is fast enough, the legitimate DNS server can reply before Ettercap has had time to process and submit its own res
SSL Sniffing• Ettercap can sniff and modify SSL packetsby sending an unsigned certificate to thevictim
Carnegie Mellon Study (2010) In an online study conducted among 409 participants, the researchers found that the majority of respondents would ignore warnings about an expired Secure Sockets Layer (SSL) certificate. The more tech-savvy the user, the more likely they would be to ignore it, the study found. 50 percent of Firefox 2 users polled who could identify the term "expired security certificate," 71 percent said they would ignore the warning. Of the 59 percent of Firefox 2 users who understood the significance of a "domain mismatch" warning, 19 percent said they would ignore the hazard. The Carnegie Mellon team conducted a second study, with 100 participants and under lab conditions. The participants were shown an invalid certificate warning when they navigated to a bank Web site. 69 percent of technologically savvy Firefox 2 users ignored an expired certificate warning from their bank. * Taken from http://news.cnet.com/8301-1009_3-10297264-83.html
ISU WebCT Case StudyInyear 2009, the certificate for WebCT was notrenewed before its expirationITS was immediately inundated with calls andrequests for support; employees walked usersthrough how to ignore the certificate error The certificate remained invalid for two daysSuch problems train the average user to simplyignore these types of warnings “I‟ve seen this before, and they just told me to click ignore last time.”
SSL Sniffing What’s the take-away? • It’s easy to sniff SSL with an invalid certificate • People ignore SSL warnings • Most will continue onwards anyway Remember: if you encounter an invalid certificate, be careful and use your head!
Ways to stop it. To keep a static arp for the gateway To use tools like Arpwatch in the background To use arp_cop plugin of the ettercap.