lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <20110302213828.GQ2141@sentinelchicken.org> Date: Wed, 2 Mar 2011 13:38:28 -0800 From: Tim <tim-security@...tinelchicken.org> To: Charles Morris <cmorris@...odu.edu> Cc: full-disclosure@...ts.grok.org.uk Subject: Re: Python ssl handling could be better... > The list does go on. However, I completely disagree with your > assertion that "O(MitM) = O(sniff)" > > Yes there are many vectors to MITM at many levels, but they are > (perhaps not ALL) not only detectable but also preventable in many scenarios. > > > * DNS cache poisoning => Don't fail at DNS > > * ARP poisoning => use static ARP tables (and before you say "who on earth does that"- I do) > > * routing protocol poisoning (many kinds) => (many solutions) > > * ICMP router redirects => Get filtered by firewall before they ever reach me > > * NETBIOS name poisoning => Don't ever use netbios for anything > > That should be fairly self-evident. Ok great, but by comparing MitM with sniffing, we're already assuming the attacker has access to the traffic. Think about it. There aren't any networks in common use today which in their physical implementation make alteration of packets harder than observation of packets. This is why the big-Os are the same. I've had this conversation at many different times with different people over the years. I don't really have the time to continue this one. I think if you take the time to think about it from a theoretical perspective, you'll come to understand the solid arguments several of us are making. tim _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists