Man, the minute a tax or an item.
OK.
Now, what is meant in the attack now it is a common type of cyber security attack that allows attackers
to eavesdrop on the communication between to target.
The attack takes place in between two legitimately communicating posts, allowing the attacker to listen
to a conversation they should normally not be able to listen to.
Hence the name man in the middle.
As you can see from this graph, we have and we have Bob and I will send a message to Bob now.
We have Eve, which is the eavesdropper, and it will start listening to that message and intercepting
the traffic.
And actually, this is what Eliot did in the scene, when you start intercepting the traffic and he
noticed that our website.
Don't worry, we will talk about this later on, indicates how he managed to do such a thing technically.
I mean.
Now, here you can see that Alice and Bob are having conversation and even want to eavesdrop on the
conversation, but also remain transparent.
Now, Eve could tell that she was booked and that she was Alice.
This would lead us to believe she's speaking to Bob while actually revealing her part of their conversation
to it.
And if I could then gather information from this and have the responses.
The message I wrote to Bob, who thinks he's talking to Alice as a result, if he's able to transparently
hijack their conversation.
So the types of men in the middle attacks, we have the privilege at this point.
So device is equipped with wireless cards, with open try to connect to the access point that is emitting
the strongest signal.
Attackers can set up their own wireless access point and track nearby devices to join.
It's to meet all of the victims network traffic can now be manipulated by the attacker.
This is a dangerous because the attacker doesn't even have to be a trusted network to do this.
The attacker simply needs a close enough physical proximity.
We have to stop spoofing.
Now, Art is the address whose illusion of Brautigan and it is used to resolve the IP addresses to physical
makk or media access control addresses in a local Nettwerk area.
OK, now, when a host needs to talk to us with a given IP address, it references the art cache to
resolve the idea.
This to a Mac address.
If the evidence is not known, a request is made asking for Mac address of the device with the IP address.
Because after all, this is a letter to the detailing player, which is Mac address.
So we need the answer to resolution or to map the IP to Mac and vice versa.
Actually we have something called Reverse R US as well.
Rob, this is to do the bus visit.
Think OK.
No, actually, this is the thing that it used to hijack the traffic technique.
OK, but again, we will talk about this, how he managed to do that.
What are the tools and how to do such a tech?
Don't worry, we will do that and we will build the environment for that.
Now we have and also the dotcom wishing to pose as another host.
Good response to request.
It shouldn't be responding to it with its own Mac address.
So with some precisely placed Becket's, an attacker can sniff the private traffic between two hosts.
Valuable information can be extracted from the traffic, such as the extent of station Tucanes yearning
for access to application accounts that that should not be able to access.
Now we have the DNS spoofing or the multicast DNS.
So the multicast that is similar to DNS, but it is done on local area network Dilan using broadcast
like the.
This makes it the perfect target for spoofing attacks and the local Namba solution system is supposed
to make the configuration of the device extremely simple.
Also, the that do not have to know exactly which addresses their devices should be communicating with
them.
The system preserves it for them.
Devices such as TVs, printers and entertainment systems make use of this protocol since they are typically
on trusted network.
So when an application needs to know the address of a certain device such as TV, the clothing and attacker
can easily respond to that request, with big data instructing it to resort to an address it has control
over.
So since devices keep a local cache of addresses, the victim will now see that device and trusted for
a duration of time.
We have the DNA spoofing similar to the way our IP address to Mac address on the Lamborghini's resolved
domain name to EBE.
OK, I think you are familiar with that.
If you are not, it's OK.
This is the domain name system or server.
This is to map domain names to IP or IP to domain names.
So when using DNA spoofing attack that Dukkha attempts to introduce corrupt DNS cache information to
a host in an attempt to exploit another host using their domain name.
OK, so this leads to victim sending sensitive information to malicious hosts with the belief they are
sending information to a trusted source.
An attacker who has already spoofed an IP address could have a much easier time spoofing Deanna simply
by reserving the IP address, by reserving the address of a DNS server to attack us at this.
So we have men in the middle attack techniques.
The first thing which is the sniffing attackers can use Becket's capture tools to inspect baggage at
a lower level.
Using specific wireless devices that are allowed to be put into monitoring or promiscuous mode can allow
an attacker to see Becket's that are not intended for a see, such as addressed or to other hosts.
Now we have the injection, and Ataka can also leverage their devices, monitoring not to inject malicious
Becket's into data.
Communication streams to markets can blend in with their data communication streams appearing to be
part of the communication.
But many issues in nature and Beckert injection usually involves first sniffing to determine how and
when to craft.
And Becket's we have the session highjacking most web application use and Nojin mechanism that generates
a temporary session talking to us for future requests to avoid requiring the user to type a password
at every page so an attacker can sniff sensitive topic to identify the session, talking for a user
and use it to make a request as the user and the attacker doesn't need to speak once he had a session
talking.
We have the Strabane, since using HDTV is a common safeguard against art or DNA spoofing, attack US,
use SS and strobing to intercept packets and act up their HDTV Espace address requests to go to there
actually to be equivalent point forcing the host to make requests to the server.
Unencrypted sensitive information can be leaked in a plain text.
No how to detect man in the at.
Now, do think many the middle at that can be very difficult without taking the proper steps, if you
are actively searching to determine if your communication have been intercepted, the Middle East,
that can potentially go unnoticed until it is too late.
So checking for proper authentication and implementation, some sort of time detection are typically
the key methods to detect possible attack.
So the timber tomber or timber detection.
But this procedure might require extra forensic analysis after the fact.
OK, so it is important to take precautionary measures to prevent many attacks before they occur rather
than attempting to detect them while they are actively accurate, being aware of browsing practices
and recognizing potentially harmful areas can be essential to maintaining a secure network.
OK, now what is the best practices to prevent many of the major attacks?
The first thing, strong web or web encryption on access point.
So having a strong encryption mechanism on wireless access point prevents unwanted user from joining
your network just by being nearby.
A weak encryption mechanism can allow an attacker to brute force his way into a network and begin management
genetic.
So the stronger the encryption implementation, that's easier for you are.
Another thing which is strong Rolton login credentials, of course, don't you, as admin admin, so
it is essential to make sure your login is checked, not just your wi fi password, but your router
login credentials if an attacker finds your login credentials.
They can change your DNS servers to their malicious servers or even worse, infect your rather with
the malicious software.
We have virtual private network, the VPN, so we can be used to create a secure environment for sensitive
information within a local area network.
So they use a key best encryption to create a subnet for secure communication.
This way, even if an attacker happens to get on a network that is shared, he will not be able to decipher
the traffic in the VPN because it is encrypted.
We can force activities so actually we can be used to securely communicate over activity using public
private key exchange.
This prevents an attacker from having any use of data.
He may be sniffing website.
So you should only use expletives and not provide alternatives.
Users can install browser ins to enforce always using HDTV on requests.
The public Quebecer based authentication, many of them attacks typically involve spoofing something
or another.
So public Kieber based authentication like oracy can be used in various layers of this deck to help
ensure whether the things you are communicating with are actually the things you want to communicate
to be communicating with.
Thanks for watching.