Revisiting man-in-the-middle attacks against HTTPS

被引：0

作者：

Kampourakis V. ^{[1
]}

Kambourakis G. ^{[1
]}

Chatzoglou E. ^{[1
]}

Zaroliagis C. ^{[1
]}

机构：

[1] Univ. of Patras European Commission Joint Research Centre University of Aegean University of Patras

来源：

Network Security | 2022年 / 2022卷 / 03期

关键词：

Electronic commerce - HTTP - Open systems;

D O I：

10.12968/S1353-4858(22)70028-1

中图分类号：

学科分类号：

摘要：

A man-in-the-middle (MitM) attack enables threat actors to position themselves in a conversation between two parties. It can be used to eavesdrop on, or impersonate, either of the parties and may enable the perpetrator to steal personal information, including login credentials, payment card data and account details. By leveraging the hijacked information, the attacker can perform an unsanctioned password change, commit identity theft, authorise money transfers, and so on. This article re-examines MitM against HTTPS by both briefly referring to its constituents and assessing its feasibility on modern browsers. We show that under certain circumstances, specific variations of MitM can be effective on all mainstream browsers using cheap, pocket-sized hardware, open-source software and a script-kiddie level of understanding.. © 2022 MA Healthcare Ltd. All rights reserved.

引用